Issue 460917 in chromium: Rare CrRendererMain crash in V8RequestAnimationFrameCallback

[chro...@googlecode.com]

Status: Unconfirmed
Owner: ----
Labels: Type-Bug Pri-2

New issue 460917 by fc...@onshape.com: Rare CrRendererMain crash in
V8RequestAnimationFrameCallback
https://code.google.com/p/chromium/issues/detail?id=460917

Chrome Version : 42.0.2311.0 (Developer Build) (64-bit)
URLs (if applicable) :
Other browsers tested:
Add OK or FAIL after other browsers where you have tested this issue:
Safari 7.1.3: OK
Firefox 35.0.1: OK
IE 7/8/9/10: N/A

What steps will reproduce the problem?
1. Turn on a specific graphics feature (section plane view) in our
WebGL-based software (www.onshape.com)
2. Manipulate the view, rotate the camera, etc.
3. Shortly after, sometimes an Aw Snap tab crash will happen.

What is the expected result?

Tab doesn't crash

What happens instead?

Tab crashes (Aw Snap)

Please provide any additional information below. Attach a screenshot if
possible.

I apologize that this report does not include solid repro steps. This is a
rare crash that feels like a race condition and occurs perhaps 1 of 5-10
times a specific visualization mode is used. Unfortunately the software
itself (www.onshape.com) is also closed for a little while longer, but if
anyone would like to work on this bug I can provide an invitation.

This bug appears on Mac and Windows in the latest Chrome and Chromium.

I have managed to trap the crash in Xcode in a debug Chromium build. It
appears that somehow the internal v8 javascript function handle for the
requestAnimationFrame callback becomes NULL. I have seen it crash the same
way twice in the debugger. The crash is definitely triggered by a specific
WebGL graphics feature (section view) that shows a cutaway of the model,
though the causal link there is mysterious.

I have attached a screenshot of the debugger stopped at the offending line.

The about version information is:


Chromium 42.0.2311.0 (Developer Build) (64-bit)
Revision
ca068183ed1ef472599cbd1acb69d954d7a3b635-refs/heads/master@{#317350}
OS Mac OS X
Blink 537.36 (@190452)
JavaScript V8 4.2.77
Flash (Disabled)
User Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.0 Safari/537.36
Command Line
/Users/fcole/chromium/src/out/Debug/Chromium.app/Contents/MacOS/Chromium
--disable-background-networking --disable-client-side-phishing-detection
--disable-component-update --disable-default-apps --disable-hang-monitor
--disable-prompt-on-repost --disable-sync --disable-web-resources
--enable-logging --ignore-certificate-errors --ignore-gpu-blacklist
--enable-logging --v=1
--load-extension=/var/folders/pf/llj71sj90r30369h0pnfgrn40000gn/T/.org.chromium.Chromium.sc8Vm8/internal
--log-level=0 --metrics-recording-only --no-first-run
--password-store=basic --remote-debugging-port=12997
--safebrowsing-disable-auto-update
--safebrowsing-disable-download-protection --test-type=webdriver
--use-mock-keychain
--user-data-dir=/var/folders/pf/llj71sj90r30369h0pnfgrn40000gn/T/.org.chromium.Chromium.fLrNZY
--enable-avfoundation --flag-switches-begin --flag-switches-end data:,
Executable Path
/Users/fcole/chromium/src/out/Debug/Chromium.app/Contents/MacOS/Chromium
Profile Path
/private/var/folders/pf/llj71sj90r30369h0pnfgrn40000gn/T/.org.chromium.Chromium.fLrNZY/Default
Variations InfiniteCache:No
Prerender:PrerenderEnabled

Attachments:
chrome_crash_screen.png 624 KB

--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings

[chro...@googlecode.com]

Updates:
Cc: rse...@chromium.org
Labels: OS-Mac Stability-Crash

Comment #1 on issue 460917 by meh...@chromium.org: Rare CrRendererMain

crash in V8RequestAnimationFrameCallback
https://code.google.com/p/chromium/issues/detail?id=460917

(No comment was entered for this change.)

[chro...@googlecode.com]

Comment #5 on issue 460917 by fc...@onshape.com: Rare CrRendererMain crash
in V8RequestAnimationFrameCallback
https://code.google.com/p/chromium/issues/detail?id=460917

Sorry, I somehow thought that crash ids were only for crashes for the whole
program. I just reran my test and got:

Crash ID 7ec4e9dfbe7cb48e (Chrome)

Occurred Monday, February 23, 2015 at 5:58:30 PM

[chro...@googlecode.com]

Updates:
Cc: a...@chromium.org

Comment #6 on issue 460917 by a...@chromium.org: Rare CrRendererMain crash
in V8RequestAnimationFrameCallback
https://code.google.com/p/chromium/issues/detail?id=460917

This is crash in invoke as per the stack trace of crash id
7ec4e9dfbe7cb48e.The crash id is from the chrome version:40.0.2214.115.

fcole@: Could you please confirm the chrome version where you are facing
this issue.

Stack trace of 7ec4e9dfbe7cb48e :
===========================================
Thread 0 CRASHED [EXC_BAD_ACCESS / 0x0000000d @ 0x00000000] MAGIC SIGNATURE
THREAD
0x00003a781d5a9398
0x00003a781f2d748d
0x00003a781d539865
0x00003a781e882303
0x00003a781f13219a
0x00003a781f15b281
0x00003a781f15afeb
0x00003a781f15afeb
0x00003a781e6b5284
0x00003a781f226fb0
0x00003a781d506a74
0x00003a781f2bb61a
0x00003a781d53681f
0x00003a781d531030
0x000000010e00dbfd [Google Chrome Framework -execution.cc:103 ]
v8::internal::Invoke(bool, v8::internal::Handle<v8::internal::JSFunction>,
v8::internal::Handle<v8::internal::Object>, int,
v8::internal::Handle<v8::internal::Object>*)
0x000000010df02730 [Google Chrome Framework -api.cc:4216 ]
v8::Function::Call(v8::Handle<v8::Value>, int, v8::Handle<v8::Value>*)
0x000000010eb94b2d [Google Chrome Framework -V8ScriptRunner.cpp:231 ]
blink::V8ScriptRunner::callFunction(v8::Handle<v8::Function>,
blink::ExecutionContext*, v8::Handle<v8::Value>, int,
v8::Handle<v8::Value>*, v8::Isolate*)
0x000000010eb6208b [Google Chrome Framework -ScriptController.cpp:171 ]
blink::ScriptController::callFunction(blink::ExecutionContext*,
v8::Handle<v8::Function>, v8::Handle<v8::Value>, int,
v8::Handle<v8::Value>*, v8::Isolate*)
0x000000010eced8ba [Google Chrome Framework
-V8RequestAnimationFrameCallback.cpp:47 ]
blink::V8RequestAnimationFrameCallback::handleEvent(double)
0x000000010e3db11e [Google Chrome Framework
-ScriptedAnimationController.cpp:188 ]
blink::ScriptedAnimationController::executeCallbacks(double)
0x000000010e3db309 [Google Chrome Framework
-ScriptedAnimationController.cpp:220 ]
blink::ScriptedAnimationController::serviceScriptedAnimations(double)
0x000000010e89def8 [Google Chrome Framework -PageAnimator.cpp:66 ]
blink::PageAnimator::serviceScriptedAnimations(double)
0x000000010e2f7e28 [Google Chrome Framework -PageWidgetDelegate.cpp:56 ]
blink::PageWidgetDelegate::animate(blink::Page&, double, blink::LocalFrame&)
0x000000010e34bbc4 [Google Chrome Framework -WebViewImpl.cpp:1878 ]
blink::WebViewImpl::beginFrame(blink::WebBeginFrameArgs const&)
0x00000001102d7f61 [Google Chrome Framework
-render_widget_compositor.cc:790 ] non-virtual thunk to
content::RenderWidgetCompositor::BeginMainFrame(cc::BeginFrameArgs const&)
0x000000010d808d09 [Google Chrome Framework -layer_tree_host.cc:252 ]
cc::LayerTreeHost::BeginMainFrame(cc::BeginFrameArgs const&)
0x000000010d834b3c [Google Chrome Framework -thread_proxy.cc:763 ]
cc::ThreadProxy::BeginMainFrame(scoped_ptr<cc::ThreadProxy::BeginMainFrameAndCommitState,
base::DefaultDeleter<cc::ThreadProxy::BeginMainFrameAndCommitState> >)
0x000000010d838d27 [Google Chrome Framework -bind_internal.h:190 ]
base::internal::InvokeHelper<true, void,
base::internal::RunnableAdapter<void
(cc::ThreadProxy::*)(scoped_ptr<cc::ThreadProxy::BeginMainFrameAndCommitState,
base::DefaultDeleter<cc::ThreadProxy::BeginMainFrameAndCommitState> >)>,
void (base::WeakPtr<cc::ThreadProxy> const&,
scoped_ptr<cc::ThreadProxy::BeginMainFrameAndCommitState,
base::DefaultDeleter<cc::ThreadProxy::BeginMainFrameAndCommitState>
>)>::MakeItSo(base::internal::RunnableAdapter<void
(cc::ThreadProxy::*)(scoped_ptr<cc::ThreadProxy::BeginMainFrameAndCommitState,
base::DefaultDeleter<cc::ThreadProxy::BeginMainFrameAndCommitState> >)>,
base::WeakPtr<cc::ThreadProxy> const&,
scoped_ptr<cc::ThreadProxy::BeginMainFrameAndCommitState,
base::DefaultDeleter<cc::ThreadProxy::BeginMainFrameAndCommitState> >)
0x000000010d838c84 [Google Chrome Framework -bind_internal.h:1248 ]
base::internal::Invoker<2,
base::internal::BindState<base::internal::RunnableAdapter<void
(cc::ThreadProxy::*)(scoped_ptr<cc::ThreadProxy::BeginMainFrameAndCommitState,
base::DefaultDeleter<cc::ThreadProxy::BeginMainFrameAndCommitState> >)>,
void (cc::ThreadProxy*,
scoped_ptr<cc::ThreadProxy::BeginMainFrameAndCommitState,
base::DefaultDeleter<cc::ThreadProxy::BeginMainFrameAndCommitState> >),
void (base::WeakPtr<cc::ThreadProxy>,
base::internal::PassedWrapper<scoped_ptr<cc::ThreadProxy::BeginMainFrameAndCommitState,
base::DefaultDeleter<cc::ThreadProxy::BeginMainFrameAndCommitState> > >)>,
void ()(cc::ThreadProxy*,
scoped_ptr<cc::ThreadProxy::BeginMainFrameAndCommitState,
base::DefaultDeleter<cc::ThreadProxy::BeginMainFrameAndCommitState>
>)>::Run(base::internal::BindStateBase*)
0x000000010cce1f43 [Google Chrome Framework -callback.h:401 ]
base::debug::TaskAnnotator::RunTask(char const*, char const*,
base::PendingTask const&)
0x000000010cd1381e [Google Chrome Framework -message_loop.cc:446 ]
base::MessageLoop::RunTask(base::PendingTask const&)
0x000000010cd13c3e [Google Chrome Framework -message_loop.cc:456 ]
base::MessageLoop::DoWork()
0x000000010cccbfc0 [Google Chrome Framework -message_pump_mac.mm:325 ]
base::MessagePumpCFRunLoopBase::RunWork()
0x00007fff91e585b0 [CoreFoundation + 0x0007f5b0 ]
__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__
0x00007fff91e49c61 [CoreFoundation + 0x00070c61 ] __CFRunLoopDoSources0
0x00007fff91e493ee [CoreFoundation + 0x000703ee ] __CFRunLoopRun
0x00007fff91e48e74 [CoreFoundation + 0x0006fe74 ] CFRunLoopRunSpecific
0x00007fff89f5916b [Foundation + 0x0006916b ] -[NSRunLoop(NSRunLoop)
runMode:beforeDate:]
0x000000010cccc423 [Google Chrome Framework -message_pump_mac.mm:592 ]
base::MessagePumpNSRunLoop::DoRun(base::MessagePump::Delegate*)
0x000000010cccbe2b [Google Chrome Framework -message_pump_mac.mm:235 ]
base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*)
0x000000010cd28ab2 [Google Chrome Framework -run_loop.cc:55 ]
base::RunLoop::Run()
0x000000010cd1313c [Google Chrome Framework -message_loop.cc:308 ]
base::MessageLoop::Run()
0x000000011035c97f [Google Chrome Framework -renderer_main.cc:234 ]
content::RendererMain(content::MainFunctionParams const&)
0x000000010ccae553 [Google Chrome Framework -content_main_runner.cc:789 ]
content::ContentMainRunnerImpl::Run()
0x000000010ccadba5 [Google Chrome Framework -content_main.cc:19 ]
content::ContentMain(content::ContentMainParams const&)
0x000000010c6483f1 [Google Chrome Framework -chrome_main.cc:57 ] ChromeMain
0x000000010c63ff38 [Google Chrome Helper -chrome_exe_main_mac.cc:16 ] main
0x000000010c63ff23 [Google Chrome Helper + 0x00000f23 ] start

[chro...@googlecode.com]

Comment #7 on issue 460917 by fc...@onshape.com: Rare CrRendererMain crash
in V8RequestAnimationFrameCallback
https://code.google.com/p/chromium/issues/detail?id=460917

I can provoke the crash both in Chrome and Chromium. I was debugging it in
Chromium, but I submitted the crash report from my system Chrome because
apparently crash reporting is disabled in Chromium (that's the message on
chrome://crashes at least).

We've also seen this issue intermittently for a while (months) on windows
and mac, and different versions of Chrome. I can't be certain it's the same
crash but the symptoms are the same.

[chro...@googlecode.com]

Comment #8 on issue 460917 by rse...@chromium.org: Rare CrRendererMain

crash in V8RequestAnimationFrameCallback
https://code.google.com/p/chromium/issues/detail?id=460917

Do you have a reduced test case that we could try?

[chro...@googlecode.com]

Comment #10 on issue 460917 by fc...@onshape.com: Rare CrRendererMain crash
in V8RequestAnimationFrameCallback
https://code.google.com/p/chromium/issues/detail?id=460917

Have you guys had any luck reproducing this issue? Please let me know if I
can help provide any more information.

[chro...@googlecode.com]

Comment #11 on issue 460917 by rse...@chromium.org: Rare CrRendererMain

crash in V8RequestAnimationFrameCallback
https://code.google.com/p/chromium/issues/detail?id=460917

I was not able to reproduce the issue, sorry. It would be very helpful if
you could create an isolated test case file that minimizes the reproducible
issue.

[chro...@googlecode.com]

Comment #14 on issue 460917 by fc...@onshape.com: Rare CrRendererMain crash
in V8RequestAnimationFrameCallback
https://code.google.com/p/chromium/issues/detail?id=460917

Unfortunately, it's not that simple to produce a simple test case. The
system is a cloud-based CAD modeling system and it loads geometry over a
socket connection for rendering. The crash happens when rendering graphics
after a lot of socket communication has occurred. While theoretically
possible, it isn't practical for us right now to engineer a version that
will run standalone in a page.

For what it's worth, it still reproduces using the steps I put in the
google doc above.