chromedriver segfaults on large responses |
||||
Issue descriptionChrome Version: (copy from chrome://version) OS: (e.g. Win10, MacOS 10.12, etc...) What steps will reproduce the problem? (1) Get chromedriver from https://chromedriver.storage.googleapis.com/2.41/chromedriver_linux64.zip (2) ./chromedriver (get port, for this repro, it was 9515) (3) curl -X POST http://127.0.0.1:9515/session -d '{"desiredCapabilities":{"browserName":"chrome","platform":"LINUX"}}' (get sessionId, for this repro, it was c4d2883b5f427c7d561e177f63eef6bb) (4) curl -X POST http://127.0.0.1:9515/session/c4d2883b5f427c7d561e177f63eef6bb/execute -d '{"script":"return new Array(10000001).join(\"0\");","args":[]}' (that works) (5) curl -X POST http://127.0.0.1:9515/session/c4d2883b5f427c7d561e177f63eef6bb/execute -d '{"script":"return new Array(100000001).join(\"0\");","args":[]}' What is the expected result? What happens instead? (that should work but causes chromedriver to segfault) Note that this works with Firefox/Marionette/geckodriver. Note that for a large enough Array, I would expect a WebDriver error to occur. (Going 10X from this causes Firefox to return a WebDriver error saying the JavaScript engine OOM'd). Note that: new Array(100000001).join("0"); works in DevTools console. Note that while Firefox console handles the 1000000001 case nicely, (eventually "InternalError: allocation size overflow", Chrome results in page crash & DevTools issues. Why is it important Chrome/ChromeDriver handle large responses like other browsers/browser drivers? Users' code coverage development workflows rely upon receiving potentially large responses over WebDriver, and they are starting to have to disable code coverage as their app codebase grows - or leave the Chrome/ChromeDriver ecosystem.
,
Sep 19
Issue chromedriver:2587 has been merged into this issue.
,
Sep 19
,
Oct 1
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/14eb261d565c16d25e5bb5468a23e845fb5f6db2 commit 14eb261d565c16d25e5bb5468a23e845fb5f6db2 Author: John Chen <johnchen@chromium.org> Date: Mon Oct 01 17:40:18 2018 [ChromeDriver] Fix stack overflow due to huge data Fix a stack overflow that can be caused by receiving a large amount of data from Chrome. Also increase the maximum buffer size for communication between app and ChromeDriver. Bug: chromium:877105 , chromedriver:2587 , b/112588554 Change-Id: Ie98544237472da629c01b9422b2e01a4716e8b88 Reviewed-on: https://chromium-review.googlesource.com/1233177 Commit-Queue: John Chen <johnchen@chromium.org> Reviewed-by: Caleb Rouleau <crouleau@chromium.org> Cr-Commit-Position: refs/heads/master@{#595477} [modify] https://crrev.com/14eb261d565c16d25e5bb5468a23e845fb5f6db2/chrome/test/chromedriver/net/websocket.cc [modify] https://crrev.com/14eb261d565c16d25e5bb5468a23e845fb5f6db2/chrome/test/chromedriver/net/websocket.h [modify] https://crrev.com/14eb261d565c16d25e5bb5468a23e845fb5f6db2/chrome/test/chromedriver/server/chromedriver_server.cc
,
Oct 4
,
Oct 4
The fix is verified.
,
Oct 11
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/29a238888a13381cf43b95b06d7b2ed363d14674 commit 29a238888a13381cf43b95b06d7b2ed363d14674 Author: John Chen <johnchen@chromium.org> Date: Thu Oct 11 17:02:51 2018 [ChromeDriver] Add unit test of socket reading many packs This is the unit test for https://crrev.com/595477, which fixes a crash when ChromeDriver receives a large number of message packs from Chrome ( issue #877105 ). The test forces a large number of message packs by using a very small buffer size. Bug: 877105 Change-Id: I20895447ef33d75acd07135d8234e899ab1ed91d Reviewed-on: https://chromium-review.googlesource.com/c/1272068 Commit-Queue: John Chen <johnchen@chromium.org> Reviewed-by: Caleb Rouleau <crouleau@chromium.org> Cr-Commit-Position: refs/heads/master@{#598807} [modify] https://crrev.com/29a238888a13381cf43b95b06d7b2ed363d14674/chrome/test/chromedriver/net/websocket.cc [modify] https://crrev.com/29a238888a13381cf43b95b06d7b2ed363d14674/chrome/test/chromedriver/net/websocket.h [modify] https://crrev.com/29a238888a13381cf43b95b06d7b2ed363d14674/chrome/test/chromedriver/net/websocket_unittest.cc |
||||
►
Sign in to add a comment |
||||
Comment 1 by crouleau@chromium.org
, Aug 23Labels: -Pri-3 Pri-2
Status: Available (was: Untriaged)