Pages using WebAssembly eventually crash with enough reloads

[liamcurry]

Description

Pages that use WebAssembly will eventually crash after enough reloads. The error message will look like this:

RangeError: WebAssembly Instantiation: Out of memory: wasm memory

or

RangeError: WebAssembly.Memory(): could not allocate memory

Once you see that error the page will crash after every reload. The only way to fix it is to open a new tab. I'm not seeing this happen in Chrome or Firefox.

Steps to Reproduce

This seems to happen on any page that uses WebAssembly.

1. Go to a page that uses WebAssembly. Example URLs:
   • https://rustwasm.github.io/wasm-bindgen/exbuild/console_log/
   • https://rustwasm.github.io/wasm-bindgen/exbuild/fetch/
   • https://d2jta7o2zej4pf.cloudfront.net/
2. Open the developer console.
3. Reload the page until you see an error in the console. It took me ~30-40 reloads.

Actual result:

Expected result:

No errors.

Reproduces how often:

Consistently.

Brave version (brave://version info)

Brave	0.59.35 Chromium: 72.0.3626.81 (Official Build) (64-bit)
Revision	ac8b982e05014492d1bd7d317628a4f22a97ffa0-refs/branch-heads/3626@{#796}
OS	Windows
JavaScript	V8 7.2.502.24
Flash	(Disabled)
User Agent	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.81 Safari/537.36
Command Line	"C:\Program Files (x86)\BraveSoftware\Brave-Browser\Application\brave.exe" --enable-dom-distiller --disable-domain-reliability --disable-chrome-google-url-tracking-client --no-pings --enable-features=EnableEmojiContextMenu,DesktopPWAWindowing,fill-on-account-select,NewExtensionUpdaterService --disable-features=SharedArrayBuffer,DefaultEnableOopRasterization,AutofillSaveCardSignInAfterLocalSave,AudioServiceOutOfProcess,AutofillServerCommunication,UnifiedConsent --flag-switches-begin --flag-switches-end
Executable Path	C:\Program Files (x86)\BraveSoftware\Brave-Browser\Application\brave.exe
Profile Path	C:\Users\sagan\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default
Variations	c134752e-f685ead32c707b42-dcf7018a411b6d4e-3f4a17dfd01ab0d3-5ac89433e006338-3f4a17dfb0271b40-360900151a0d11d4-2f9febdfe202a358-3f4a17df66df3e9d-a85d0b2f2b6b7805-d13c2832b7e2524c-c92d551c411c711e-3f4a17dfb3888d8d-afba0f916c18ba9d-3f4a17df8982496f-3f4a17df61832c80-3f4a17dfcc20827f-77c422c1d411afe-60fc1672591560a-29acad42db4845-ace4e13874785582-3f4a17df241fff6c-ddf208789853922b-3f4a17df9def365c-9def365c2342e907-3f4a17df9ca1387e-3f4a17df1c752ce9-1c752ce941e765a5-3f4a17dfab3d6cfd-3f4a17df776de70c-e0278d3ded9149a9-3f4a17dfa5cb8590-3f4a17df34d450b1-3f4a17df6c6c4f61-3f4a17dfc4c21d73-f6964d8d8f4db35c-3f4a17df76b48ab8-d4bd105cc70841c8-a256700714bdbe54-e8c7a65bd8343fa3-3f4a17df8ee5ed19-c3125ea274658432-fa79b94c7f7844ec-69483e07121ae2bc-65969d679e201a2b-3f4a17df652e14d1-f4950e9927212adc-27212adc591576c8-3f4a17df5274eb09-3f4a17df36115667-3f4a17dfceff87ec-3f4a17df44827ee5-3f4a17df8ca44045-3f4a17df334aa58d-3f4a17df3f79ac13-3f4a17df8f1e27f-3f4a17df345b5b61-3f4a17dfedbcf7c5-ddf1844d77bbdddc-3f4a17df5485fc4d-3f4a17dfde47491b-3f4a17df93731dca-3f4a17df9b4c4257-3f4a17df8fa604e0-ace4e13843f62d3b-3f4a17df4ae380f4-3f4a17df165e16d1-3f4a17df9e5c75f1-30e1b12b6fa07eb4-7282ca762981bcb4-3f4a17df5139837c-3f4a17df4934552d-3f4a17df7f8176d9-3f4a17dff7217a71-b204717823a898eb-fc93cf747a5ba892-3f4a17dfd1cd70a5-80f9a33e4ea303a6-3f4a17dfb19465ab-b19465abe5373d71-3d47f4f43d7e3f6a-2eb014556e6e0c7e-3f17a7d895876445-2b71ffe4d92562a9-441539fd2b33233e-881ca6c9b363a81f-3f4a17df4da5ae82-3f4a17df56302f8c-2f882e7014c5a050-61ceed18dc5b1f29-dc5b1f29cc54eb06-803f8fc4b2612322-8a9180b2cac0a91c-3f4a17dfdf072bba-9a6c5085f56e0452-3f4a17df8576baf1-3f4a17dff3ea30a0-3f4a17df3038aa2e-3f4a17df51b9b54d-3f4a17df7345ea6-3f4a17df9a2f4e5b-4bc735ae1354da85-f1a864dc17507c76-3f4a17df6844d8aa-669a04e0494d8760-3f4a17dff9e5da91-508355f5fcdd9ed9-fcdd9ed93a4029d-d7f231f3bbb8f811-3f4a17dfb0ea13bc-3f4a17df41aa6aaa-da82a76f94e68624-803f8fc4cc73f8a1-3f4a17dfb4e8892d-3f4a17df10a311eb-10a311eb8834fcca-3f4a17df6204e469-3f4a17df80eda620-3f4a17df71140742-3f4a17df9f0ebdd7-3f4a17df3f33c9bd-3f4a17dfe9ce63c1-36ab09a2e0a8874-e0a8874ea0f933d-29e3c6deb77dc7f0-3f4a17df493ac2c5-803f8fc4

Reproducible on current release:

• Does it reproduce on brave-browser dev/beta builds? Unknown

Website problems only:

• Does the issue resolve itself when disabling Brave Shields? No
• Is the issue reproducible on the latest version of Chrome? No

[SupremeTechnopriest]

Im seeing this same issue in Chrome 72.0.3626.121 (Official Build) (64-bit). Im thinking its a chromium bug. Can't reproduce in firefox.

[ixcviw7bw]

Indeed it's a Chromium bug. Here are relevant issues:
https://bugs.chromium.org/p/chromium/issues/detail?id=921473
https://bugs.chromium.org/p/chromium/issues/detail?id=877055
https://bugs.chromium.org/p/chromium/issues/detail?id=935169

SharedArrayBuffer objects fail to get garbage collected, causing memory leak.

[SupremeTechnopriest]

@bilgorajskim awesome thanks for digging those up.

[bsclifton]

Thanks for digging in, folks! 😄👍 There are some updates to threading in web assembly with Chromium 74 (which we'll have a build of soon). Curious if that will fix this up

cc: @mkarolin