Status: Untriaged Owner: [email protected] CC: [email protected] Labels: Type-Bug Pri-2 OS-All Area-Misc
New issue 8760 by [email protected]: renderer lockup in webkit_glue::HistoryItemToString http://code.google.com/p/chromium/issues/detail?id=8760 This happens with chrome buildbot page kept running for several days, but could happen elsewhere, quickly. What steps will reproduce the problem? 1. Load chrome buildbot page. 2. Keep it running for several days. 3. Renderer locks up for several seconds. This is due to webkit_glue::HistoryItemToString writing item with large number of subitems, >30K, resulting in > 30MB allocations. This exposes a pathological case for Pickle, when it incrementally allocates just the size it needs for ever growing buffer. Imagine, extending 30MB buffer by 4 bytes to write next string and so on. Call stack is: 029df190 770b589d ntdll!memcpy+0x33 029df2a8 77083671 ntdll!RtlpReAllocateHeap+0x9da 029df31c 711f05be ntdll!RtlReAllocateHeap+0x2bf 029df364 710d79fb chrome_70c40000!realloc+0x1bb [f:\sp\vctools\crt_bld\self_x86\crt\src\realloc.c @ 323] 029df374 710d76c0 chrome_70c40000!Pickle::Resize+0x12 [c:\b\slave\chrome- official\build\src\base\pickle.cc @ 327] 029df384 710d7777 chrome_70c40000!Pickle::BeginWrite+0x28 [c:\b\slave\chrome-official\build\src\base\pickle.cc @ 236] 029df428 70c745c0 chrome_70c40000!Pickle::WriteBytes+0x7f [c:\b\slave\chrome-official\build\src\base\pickle.cc @ 257] 029df43c 70c747a3 chrome_70c40000!webkit_glue::WriteString+0x4d [c:\b\slave\chrome-official\build\src\webkit\glue\glue_serialize.cc @ 141] 029df460 70c748de chrome_70c40000!webkit_glue::WriteHistoryItem+0x36 [c:\b\slave\chrome-official\build\src\webkit\glue\glue_serialize.cc @ 235] 029df488 70c74c63 chrome_70c40000!webkit_glue::WriteHistoryItem+0x171 [c:\b\slave\chrome-official\build\src\webkit\glue\glue_serialize.cc @ 257] 029df4d0 70c65982 chrome_70c40000!webkit_glue::HistoryItemToString+0x35 [c:\b\slave\chrome-official\build\src\webkit\glue\glue_serialize.cc @ 318] 029df5fc 70db34d5 chrome_70c40000!WebFrameImpl::GetCurrentState+0x5e [c:\b\slave\chrome-official\build\src\webkit\glue\webframe_impl.cc @ 506] 029df6c4 70db59fb chrome_70c40000!RenderView::SyncNavigationState+0x72 [c:\b\slave\chrome-official\build\src\chrome\renderer\render_view.cc @ 1885] 029df6e0 70c4adfc chrome_70c40000!base::BaseTimer<RenderView,0>::TimerTask::Run+0x31 [c:\b\slave\chrome-official\build\src\base\timer.h @ 147] 029df784 70c4ae38 chrome_70c40000!MessageLoop::RunTask+0x7c [c:\b\slave\chrome-official\build\src\base\message_loop.cc @ 304] 029df790 70c4b0f3 chrome_70c40000!MessageLoop::DeferOrRunPendingTask+0x28 [c:\b\slave\chrome-official\build\src\base\message_loop.cc @ 314] 029df7cc 70c57c23 chrome_70c40000!MessageLoop::DoDelayedWork+0xa4 [c:\b\slave\chrome-official\build\src\base\message_loop.cc @ 430] 029df884 70c4ab3c chrome_70c40000!base::MessagePumpDefault::Run+0x90 [c:\b\slave\chrome-official\build\src\base\message_pump_default.cc @ 27] 029df928 70c4aaab chrome_70c40000!MessageLoop::RunInternal+0x8b [c:\b\slave\chrome-official\build\src\base\message_loop.cc @ 193] 029df960 70c4aa4e chrome_70c40000!MessageLoop::RunHandler+0x4f [c:\b\slave\chrome-official\build\src\base -- You received this message because you are listed in the owner or CC fields of this issue, or because you starred this issue. You may adjust your issue notification preferences at: http://code.google.com/hosting/settings --~--~---------~--~----~------------~-------~--~----~ Automated mail from issue updates at http://crbug.com/ Subscription options: http://groups.google.com/group/chromium-bugs -~----------~----~----~----~------~----~------~--~---
