New issue
Advanced search Search tips

Issue 877105 link

Starred by 3 users

Issue metadata

Status: Verified
Owner:
Closed: Oct 4
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

chromedriver segfaults on large responses

Project Member Reported by joshbruning@google.com, Aug 23

Issue description

Chrome Version: (copy from chrome://version)
OS: (e.g. Win10, MacOS 10.12, etc...)

What steps will reproduce the problem?
(1) Get chromedriver from https://chromedriver.storage.googleapis.com/2.41/chromedriver_linux64.zip

(2) ./chromedriver

(get port, for this repro, it was 9515)

(3) curl -X POST http://127.0.0.1:9515/session -d '{"desiredCapabilities":{"browserName":"chrome","platform":"LINUX"}}'

(get sessionId, for this repro, it was c4d2883b5f427c7d561e177f63eef6bb)

(4) curl -X POST http://127.0.0.1:9515/session/c4d2883b5f427c7d561e177f63eef6bb/execute -d '{"script":"return new Array(10000001).join(\"0\");","args":[]}'

(that works)

(5) curl -X POST http://127.0.0.1:9515/session/c4d2883b5f427c7d561e177f63eef6bb/execute -d '{"script":"return new Array(100000001).join(\"0\");","args":[]}'

What is the expected result?
What happens instead?
(that should work but causes chromedriver to segfault)

Note that this works with Firefox/Marionette/geckodriver. Note that for a large enough Array, I would expect a WebDriver error to occur. (Going 10X from this causes Firefox to return a WebDriver error saying the JavaScript engine OOM'd).

Note that:
new Array(100000001).join("0");
works in DevTools console.

Note that while Firefox console handles the 1000000001 case nicely, (eventually "InternalError: allocation size overflow", Chrome results in page crash & DevTools issues.

Why is it important Chrome/ChromeDriver handle large responses like other browsers/browser drivers?
Users' code coverage development workflows rely upon receiving potentially large responses over WebDriver, and they are starting to have to disable code coverage as their app codebase grows - or leave the Chrome/ChromeDriver ecosystem.
 
Cc: -crouleau@google.com johnchen@chromium.org crouleau@chromium.org
Labels: -Pri-3 Pri-2
Status: Available (was: Untriaged)
Note that this is internal Google bug https://b.corp.google.com/issues/112588554

Thanks for the excellent repro steps. I don't think this needs to be repro'd locally by our TE. We can just directly add it to our queue. 
 Issue chromedriver:2587  has been merged into this issue.
Owner: johnchen@chromium.org
Status: Started (was: Available)
Project Member

Comment 4 by bugdroid1@chromium.org, Oct 1

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/14eb261d565c16d25e5bb5468a23e845fb5f6db2

commit 14eb261d565c16d25e5bb5468a23e845fb5f6db2
Author: John Chen <johnchen@chromium.org>
Date: Mon Oct 01 17:40:18 2018

[ChromeDriver] Fix stack overflow due to huge data

Fix a stack overflow that can be caused by receiving a large amount of
data from Chrome. Also increase the maximum buffer size for
communication between app and ChromeDriver.

Bug:  chromium:877105 ,  chromedriver:2587 , b/112588554
Change-Id: Ie98544237472da629c01b9422b2e01a4716e8b88
Reviewed-on: https://chromium-review.googlesource.com/1233177
Commit-Queue: John Chen <johnchen@chromium.org>
Reviewed-by: Caleb Rouleau <crouleau@chromium.org>
Cr-Commit-Position: refs/heads/master@{#595477}
[modify] https://crrev.com/14eb261d565c16d25e5bb5468a23e845fb5f6db2/chrome/test/chromedriver/net/websocket.cc
[modify] https://crrev.com/14eb261d565c16d25e5bb5468a23e845fb5f6db2/chrome/test/chromedriver/net/websocket.h
[modify] https://crrev.com/14eb261d565c16d25e5bb5468a23e845fb5f6db2/chrome/test/chromedriver/server/chromedriver_server.cc

Status: Fixed (was: Started)
Status: Verified (was: Fixed)
The fix is verified.

Project Member

Comment 7 by bugdroid1@chromium.org, Oct 11

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/29a238888a13381cf43b95b06d7b2ed363d14674

commit 29a238888a13381cf43b95b06d7b2ed363d14674
Author: John Chen <johnchen@chromium.org>
Date: Thu Oct 11 17:02:51 2018

[ChromeDriver] Add unit test of socket reading many packs

This is the unit test for https://crrev.com/595477, which fixes a crash
when ChromeDriver receives a large number of message packs from Chrome
( issue #877105 ). The test forces a large number of message packs by
using a very small buffer size.

Bug:  877105 
Change-Id: I20895447ef33d75acd07135d8234e899ab1ed91d
Reviewed-on: https://chromium-review.googlesource.com/c/1272068
Commit-Queue: John Chen <johnchen@chromium.org>
Reviewed-by: Caleb Rouleau <crouleau@chromium.org>
Cr-Commit-Position: refs/heads/master@{#598807}
[modify] https://crrev.com/29a238888a13381cf43b95b06d7b2ed363d14674/chrome/test/chromedriver/net/websocket.cc
[modify] https://crrev.com/29a238888a13381cf43b95b06d7b2ed363d14674/chrome/test/chromedriver/net/websocket.h
[modify] https://crrev.com/29a238888a13381cf43b95b06d7b2ed363d14674/chrome/test/chromedriver/net/websocket_unittest.cc

Sign in to add a comment