Discussion:
Issue 138506 in chromium: Chrome crashes on xhr-downloading a large file with xhr.responseType set to "arraybuffer"
(too old to reply)
c***@googlecode.com
2012-07-23 07:35:40 UTC
Permalink
Status: Unconfirmed
Owner: ----
Labels: Type-Bug Pri-2 Area-Undefined OS-Windows

New issue 138506 by ***@royalappbooks.com: Chrome crashes on
xhr-downloading a large file with xhr.responseType set to "arraybuffer"
http://code.google.com/p/chromium/issues/detail?id=138506

Chrome Version : 20.0.1132.57
OS Version: 6.1 (Windows 7, Windows Server 2008 R2)
URLs (if applicable) :
Other browsers tested:
Add OK or FAIL after other browsers where you have tested this issue:
Safari 5: OK
Firefox 4.x: OK
IE 7/8/9: FAIL (No Support for array buffer

What steps will reproduce the problem?
Downloading a large video file (~160MB) via javascript (xhr2 with a
responsetype "arraybuffer") crashes the Chrome tab.
(Tested with the Ice Age 4 1080p Trailer from Apple Trailers)

var downloadStuff = function(arg, callback) {
var params = arg;
if (typeof arg === 'string') {
params = {url: arg};
}

var xhr = new XMLHttpRequest();
xhr.open('GET', params.url);
xhr.mozResponseType = xhr.responseType = 'arraybuffer';
xhr.expected = (document.URL.indexOf('file:') === 0) ? 0 : 200;
xhr.onprogress = params.progress || undefined;

xhr.onreadystatechange = function() {
var data;
if (xhr.readyState === 4 && xhr.status === xhr.expected) {
data = (xhr.mozResponseArrayBuffer || xhr.mozResponse ||
xhr.responseArrayBuffer || xhr.response);
callback(data);
}
};
xhr.send(null);
};

var url = "http://localhost/H5-Tests/offlineTest/iceage4-tlr2_h1080p.mp4";
downloadStuff(url, function(data){
console.log(data);
});


What is the expected result?
An entry in the console (console.log(data);)

What happens instead?
Chrome tab crashes

Please provide any additional information below. Attach a screenshot if
possible.

UserAgentString: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.11
(KHTML, like Gecko) Chrome/20.0.1132.57 Safari/536.11
--
Automated mail from issue updates at http://crbug.com/
Subscription options: http://groups.google.com/a/chromium.org/group/chromium-bugs
c***@googlecode.com
2012-11-15 13:55:22 UTC
Permalink
Comment #3 on issue 138506 by ***@gmail.com: Chrome crashes on
xhr-downloading a large file with xhr.responseType set to "arraybuffer"
http://code.google.com/p/chromium/issues/detail?id=138506

I am able to reproduce this error with a responsetype of "blob".
Large files keeps crashing the tab (sad tab)
--
Automated mail from issue updates at http://crbug.com/
Subscription options: http://groups.google.com/a/chromium.org/group/chromium-bugs
c***@googlecode.com
2012-11-21 15:55:01 UTC
Permalink
Updates:
Cc: ***@chromium.org ***@chromium.org

Comment #14 on issue 138506 by ***@google.com: Chrome crashes on
xhr-downloading a large file with xhr.responseType set to "arraybuffer"
http://code.google.com/p/chromium/issues/detail?id=138506

Based on #12, the crash is out of memory. abarth, rdsmith: is this within
your area of work?

https://crash.corp.google.com/reportdetail?reportid=dfe8ef0a48c85917

Thread 0 *CRASHED* ( EXCEPTION_BREAKPOINT @ 0x5e3a9d97 )

0x5e3a9d97 [chrome.dll] - process_util_win.cc:109] base::`anonymous
namespace'::OnNoMemory()
0x5de8165f [chrome.dll] - allocator_shim.cc:135] malloc
0x5dec8c18 [chrome.dll] - fastmalloc.cpp:268] WTF::fastMalloc(unsigned
int)
0x5e0ebff3 [chrome.dll] - vector.h:903]
WTF::Vector<char,0>::reserveCapacity(unsigned int)
0x5e0ebfc7 [chrome.dll] - vector.h:820]
WTF::Vector<char,0>::expandCapacity(unsigned int)
0x5e271993 [chrome.dll] - sharedbuffer.cpp:224]
WebCore::SharedBuffer::buffer()
0x5e85df0d [chrome.dll] - cachedrawresource.cpp:53]
WebCore::CachedRawResource::data(WTF::PassRefPtr<WebCore::SharedBuffer>,bool)
0x5e26cf82 [chrome.dll] - subresourceloader.cpp:253]
WebCore::SubresourceLoader::sendDataToResource(char const *,int)
0x5e26cba8 [chrome.dll] - subresourceloader.cpp:227]
WebCore::SubresourceLoader::didReceiveData(char const *,int,__int64,bool)
0x5e072dc2 [chrome.dll] - resourceloader.cpp:442]
WebCore::ResourceLoader::didReceiveData(WebCore::ResourceHandle *,char
const *,int,int)
0x5e072d81 [chrome.dll] - resourcehandle.cpp:140]
WebCore::ResourceHandleInternal::didReceiveData(WebKit::WebURLLoader *,char
const *,int,int)
0x5e072d45 [chrome.dll] - weburlloader_impl.cc:609]
webkit_glue::WebURLLoaderImpl::Context::OnReceivedData(char const *,int,int)
0x5e072cb9 [chrome.dll] - resource_dispatcher.cc:402]
ResourceDispatcher::OnReceivedData(IPC::Message const &,int,void *,int,int)
0x5e072be3 [chrome.dll] - resource_messages.h:159]
ResourceMsg_DataReceived::Dispatch<ResourceDispatcher,ResourceDispatcher,int,void
*,int,int>(IPC::Message const *,ResourceDispatcher *,ResourceDispatcher
*,void ( ResourceDispatcher::*)(IPC::Message const &,int,void *,int,int))
0x5e06e43b [chrome.dll] - resource_dispatcher.cc:557]
ResourceDispatcher::DispatchMessageW(IPC::Message const &)
0x5deba003 [chrome.dll] - resource_dispatcher.cc:326]
ResourceDispatcher::OnMessageReceived(IPC::Message const &)
0x5deb9dfa [chrome.dll] - child_thread.cc:172]
ChildThread::OnMessageReceived(IPC::Message const &)
0x5dea983a [chrome.dll] - ipc_channel_proxy.cc:268]
IPC::ChannelProxy::Context::OnDispatchMessage(IPC::Message const &)
0x5dea750c [chrome.dll] - bind_internal.h:1254]
base::internal::Invoker<2,base::internal::BindState<base::internal::RunnableAdapter<void
( media::FFmpegVideoDecoder::*)(base::Callback<void (void)> const &)>,void
(media::FFmpegVideoDecoder *,base::Callback<void (void)> const &),void
(media::FFmpegVideoDecoder *,base::Callback<void (void)>)>,void
(media::FFmpegVideoDecoder *,base::Callback<void (void)> const
&)>::Run(base::internal::BindStateBase *)
0x5dea6815 [chrome.dll] - message_loop.cc:458]
MessageLoop::RunTask(base::PendingTask const &)
0x5dea5815 [chrome.dll] - message_loop.cc:660] MessageLoop::DoWork()
0x5debf4ac [chrome.dll] - message_pump_default.cc:55]
base::MessagePumpDefault::Run(base::MessagePump::Delegate *)
0x5dea5385 [chrome.dll] - message_loop.cc:390] MessageLoop::RunHandler()
0x5dea5332 [chrome.dll] - message_loop.cc:300] MessageLoop::Run()
0x5df0ec9a [chrome.dll] - renderer_main.cc:241]
RendererMain(content::MainFunctionParams const &)
0x5dea1d2d [chrome.dll] - content_main_runner.cc:282] `anonymous
namespace'::RunNamedProcessTypeMain(std::basic_string<char,std::char_traits<char>,std::allocator<char>
const &,content::MainFunctionParams const &,content::ContentMainDelegate
*)
0x5dea1cb2 [chrome.dll] - content_main_runner.cc:511] `anonymous
namespace'::ContentMainRunnerImpl::Run()
0x5de9468a [chrome.dll] - content_main.cc:35]
content::ContentMain(HINSTANCE__ *,sandbox::SandboxInterfaceInfo
*,content::ContentMainDelegate *)
0x5de94615 [chrome.dll] - chrome_main.cc:28] ChromeMain
0x012e796c [chrome.exe] - client_util.cc:424]
MainDllLoader::Launch(HINSTANCE__ *,sandbox::SandboxInterfaceInfo *)
0x012e7be7 [chrome.exe] - chrome_exe_main_win.cc:37]
RunChrome(HINSTANCE__ *)
0x012e7c36 [chrome.exe] - chrome_exe_main_win.cc:48] wWinMain
0x0130545b [chrome.exe] - crt0.c:263] __tmainCRTStartup
0x767933a9 [kernel32.dll] + 0x000133a9] BaseThreadInitThunk
0x77839ef1 [ntdll.dll] + 0x00039ef1] __RtlUserThreadStart
0x77839ec4 [ntdll.dll] + 0x00039ec4] _RtlUserThreadStart
--
Automated mail from issue updates at http://crbug.com/
Subscription options: http://groups.google.com/a/chromium.org/group/chromium-bugs
c***@googlecode.com
2012-11-22 05:43:56 UTC
Permalink
Updates:
Status: Assigned
Owner: ***@chromium.org
Labels: Feature-Downloads

Comment #15 on issue 138506 by ***@google.com: Chrome crashes on
xhr-downloading a large file with xhr.responseType set to "arraybuffer"
http://code.google.com/p/chromium/issues/detail?id=138506

Randy, can you look at this?
--
Automated mail from issue updates at http://crbug.com/
Subscription options: http://groups.google.com/a/chromium.org/group/chromium-bugs
c***@googlecode.com
2013-01-28 20:50:06 UTC
Permalink
Comment #22 on issue 138506 by ***@gmail.com: Chrome crashes on
xhr-downloading a large file with xhr.responseType set to "arraybuffer"
http://code.google.com/p/chromium/issues/detail?id=138506

I think the XHR should end with an error instead of crashing the process.
Errors can be caught, reported and worked around. Can't recover from a
process crash in JavaScript.

Will you please reconsider?
--
Automated mail from issue updates at http://crbug.com/
Subscription options: http://groups.google.com/a/chromium.org/group/chromium-bugs
c***@googlecode.com
2013-02-06 09:04:56 UTC
Permalink
Comment #23 on issue 138506 by ***@gmail.com: Chrome crashes on
xhr-downloading a large file with xhr.responseType set to "arraybuffer"
http://code.google.com/p/chromium/issues/detail?id=138506

I just want to mention that Safari and Firefox don't crash.

Furthermore even Google thinks this should work (as stated by Eric Bidelman
on his post about the HTML5 Filesystem API:
http://www.html5rocks.com/en/tutorials/file/filesystem/#toc-usecases)

"Offline video viewer
It downloads large files (>1GB) for later viewing."

How else would one download large video files via javascript?
--
--
Automated mail from issue updates at http://crbug.com/
Subscription options: http://groups.google.com/a/chromium.org/group/chromium-bugs
c***@googlecode.com
2013-03-19 06:14:02 UTC
Permalink
Comment #26 on issue 138506 by ***@gmail.com: Chrome crashes on
xhr-downloading a large file with xhr.responseType set to "arraybuffer"
http://code.google.com/p/chromium/issues/detail?id=138506

This bug should be re-opened.

I'm seeing Chrome renderers crashing on much smaller files that shouldn't
be causing an OOM condition. If I use XHR with responseType
= 'arraybuffer', to fetch a 300MB file, the renderer quickly consumes 2GB
of RAM and crashes. This should not happen.

Chrome is really broken if we can't fetch even 300MB files using XHR. This
issue does not exist in Safari or Firefox.
--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings
--
--
Automated mail from issue updates at http://crbug.com/
Subscription options: http://groups.google.com/a/chromium.org/group/chromium-bugs
Loading...