Google Sheets tabs crash with SIGILL/SIGTRAP

[jamestmartin]

Trivalent tabs with Google Sheets opened in edit mode consistently crash every few minutes. This occurs whether the tab is opened in the foreground or background. With one particular sheet open, this has consistently been a SIGILL error code, and when I tested with a new sheet, I encountered a SIGTRAP error code.

Trivalent version: Version 143.0.7499.169 (Official Build) trivalent (64-bit)
OS: This is a brand-new Secureblue install as of Monday. I have standard kargs hardening (the OS won't boot with unstable kargs), but otherwise, all non-flatpak audits pass. I haven't tweaked any other settings.

dmesg log associated with the SIGILL crash:

[Jan 8 10:57] traps: DedicatedWorker[29549] trap invalid opcode ip:56d78b8259d8 sp:78a540ef4f80 error:0 in trivalent[abb19d8,56d78372a000+dc6c000]
[Jan 8 11:04] traps: DedicatedWorker[29803] trap invalid opcode ip:56d78b8259d8 sp:78a54105df80 error:0 in trivalent[abb19d8,56d78372a000+dc6c000]
[Jan 8 11:12] traps: DedicatedWorker[29939] trap invalid opcode ip:56d78b8259d8 sp:78a5412f5b10 error:0 in trivalent[abb19d8,56d78372a000+dc6c000]

dmesg log associated with the SIGTRAP crash:

[Jan 8 12:03] traps: DedicatedWorker[31570] trap invalid opcode ip:56d78b8259d8 sp:78a541b5dd70 error:0 in trivalent[abb19d8,56d78372a000+dc6c000]
[Jan 8 12:09] traps: ThreadPoolForeg[32398] trap invalid opcode ip:56d78b8259d8 sp:78a5437fb0f0 error:0 in trivalent[abb19d8,56d78372a000+dc6c000]
[  +0.000007] traps: ThreadPoolForeg[32393] trap invalid opcode ip:56d78b8259d8 sp:78a5cf1d80f0 error:0
[  +0.000001] traps: ThreadPoolForeg[32397] trap invalid opcode ip:56d78b8259d8 sp:78a543ffc0f0 error:0

[  +0.000004]  in trivalent[abb19d8,56d78372a000+dc6c000]
[  -0.000003] traps: ThreadPoolForeg[32391] trap invalid opcode ip:56d78b8259d8 sp:78a5d01fa0f0 error:0
[  +0.000004]  in trivalent[abb19d8,56d78372a000+dc6c000]


[  +0.000005]  in trivalent[abb19d8,56d78372a000+dc6c000]

Let me know if you'd like any additional information. I looked briefly for instructions for creating an issue, but didn't see any, so I'm not sure exactly what you need.

[RoyalOughtness]

Interesting. I'm unable to reproduce. @RKNF404 are you able to reproduce?

Potentially testing with hwaccel off would be worth trying?

[RKNF404]

Could be related to drumbrake, sheets makes heavy usage of WebAssembly

[RoyalOughtness]

@jamestmartin can you see if it reproduces with chrome://flags/#jitless-wasm disabled?

[jamestmartin]

I was unable to reproduce the issue with jitless wasm disabled, but turning jitless wasm back on made the issue return.

For the sake of reproduction: out of the dozen or so times I've encountered the crash, it has consistently been 7-12 minutes after opening/refreshing the tab, typically on the low end. It's never happened in less than seven minutes and has always happened within twelve. With jitless wasm off, I encountered no crashes with three tabs open over a duration of 30~45 minutes. The SIGTRAP only occurred once; every other crash has been SIGILL with either sheet.

If relevant, this is with a AMD Ryzen 5 5500U.

[RKNF404]

@jamestmartin could you open trivalent from commandline, then reproduce the issue with dumbrake enabled? It may give some info on what is happening

[jamestmartin]

Two tabs crashing. All of the disk cache stuff was when trivalent started, not alongside the crash. A third tab crashing produced the same messages, but much more of them.

user@aurastys:~$ trivalent 
Checking Subresource Filter version...
  Installed version: 1766163
  Package version: 1766163
No need to update, versions match
[45790:45836:0109/121626.439363:ERROR:net/disk_cache/simple/simple_backend_impl.cc:81] Failed to create directory: /dev/null/Default/Code Cache/js
[45790:45833:0109/121626.439391:ERROR:net/disk_cache/simple/simple_backend_impl.cc:81] Failed to create directory: /dev/null/Default/Code Cache/wasm
[45790:45836:0109/121626.439602:ERROR:net/disk_cache/simple/simple_backend_impl.cc:81] Failed to create directory: /dev/null/Default/Code Cache/js
[45790:45836:0109/121626.439632:ERROR:net/disk_cache/simple/simple_backend_impl.cc:749] Simple Cache Backend: wrong file structure on disk: 1 path: /dev/null/Default/Code Cache/js
[45790:45833:0109/121626.439893:ERROR:net/disk_cache/simple/simple_backend_impl.cc:81] Failed to create directory: /dev/null/Default/Code Cache/wasm
[45790:45833:0109/121626.439908:ERROR:net/disk_cache/simple/simple_backend_impl.cc:749] Simple Cache Backend: wrong file structure on disk: 1 path: /dev/null/Default/Code Cache/wasm
[45790:45847:0109/121626.440795:ERROR:net/disk_cache/disk_cache.cc:236] Unable to create cache
[45790:45847:0109/121626.440823:ERROR:net/disk_cache/disk_cache.cc:236] Unable to create cache
[45790:45790:0109/121626.653595:ERROR:dbus/object_proxy.cc:573] Failed to call method: org.freedesktop.systemd1.Manager.StartTransientUnit: object_path= /org/freedesktop/systemd1: org.freedesktop.DBus.Error.AccessDenied: SELinux policy denies access: Permission denied
[45844:45853:0109/121631.459912:ERROR:net/disk_cache/simple/simple_backend_impl.cc:81] Failed to create directory: /dev/null/Default/Cache/Cache_Data
[45844:45853:0109/121631.460160:ERROR:net/disk_cache/simple/simple_backend_impl.cc:81] Failed to create directory: /dev/null/Default/Cache/Cache_Data
[45844:45853:0109/121631.460177:ERROR:net/disk_cache/simple/simple_backend_impl.cc:749] Simple Cache Backend: wrong file structure on disk: 1 path: /dev/null/Default/Cache/Cache_Data
[45844:45854:0109/121631.460406:ERROR:net/disk_cache/disk_cache.cc:236] Unable to create cache

<--- Last few GCs --->

[1:0x45405f3c000]   450941 ms: Scavenge (during sweeping) 3812.7 (3999.4) -> 3807.3 (4000.1) MB, pooled: 0.0 MB, 57.96 / 0.00 ms (average mu = 0.610, current mu = 0.507) allocation failure; 
[1:0x45405f3c000]   452153 ms: Scavenge (during sweeping) 3834.9 (4016.1) -> 3819.9 (4020.4) MB, pooled: 0.0 MB, 49.56 / 0.00 ms (average mu = 0.610, current mu = 0.507) allocation failure; 

[46073:13:0109/122454.789196:ERROR:third_party/blink/renderer/bindings/core/v8/v8_initializer.cc:852] V8 javascript OOM (MarkCompactCollector: young object promotion failed).
[0109/122454.789742:WARNING:third_party/crashpad/crashpad/handler/linux/exception_handler_server.cc:204] no ptrace

<--- Last few GCs --->

[1:0x45404c18000]   437260 ms: Mark-Compact 3785.1 (4040.1) -> 3731.2 (4040.9) MB, pooled: 0.0 MB, 12630.13 / 0.00 ms (average mu = 0.573, current mu = 0.472) allocation failure; scavenge might not succeed
[1:0x45404c18000]   456280 ms: Mark-Compact 3763.2 (4040.9) -> 3745.7 (4041.6) MB, pooled: 0.8 MB, 17264.93 / 0.00 ms (average mu = 0.392, current mu = 0.092) allocation failure; scavenge might not succeed

[46051:12:0109/122457.416172:ERROR:third_party/blink/renderer/bindings/core/v8/v8_initializer.cc:852] V8 javascript OOM (MarkCompactCollector: young object promotion failed).
[0109/122457.416584:WARNING:third_party/crashpad/crashpad/handler/linux/exception_handler_server.cc:204] no ptrace

When I saw the GC-related issues, I decided to check htop. Having Google Sheets open appears to pin a thread to 100% CPU utilization, and slowly but steadily increases memory usage. That is, there appears to be some sort of memory leak. The tab dying frees the memory and core. The system still has abundant free memory when the tab crashes, so this is not a system-wide OOM issue.