New issue
Advanced search Search tips

Issue 591356 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Mar 2016
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Mac
Pri: 1
Type: Bug-Regression



Sign in to add a comment

Chrome: Crash Report - data_reduction_proxy::OnResolveProxyHandler

Project Member Reported by ranjitkan@chromium.org, Mar 2 2016

Issue description

Product name: Chrome
Magic Signature: data_reduction_proxy::OnResolveProxyHandler

Current link:
crash.corp.google.com/browse?q=product.name%3D'Chrome'%20AND%20product.version%3D'51.0.2665.0'%20AND%20custom_data.ChromeCrashProto.ptype%3D'browser'%20AND%20ReportID%3D'33030bd400000000'%20AND%20custom_data.ChromeCrashProto.magic_signature_1.name%3D'data_reduction_proxy%3A%3AOnResolveProxyHandler'&ignore_case=false#3


Search properties:
product.name: Chrome
product.version: 51.0.2665.0
custom_data.chromecrashproto.ptype: browser
reportid: 33030bd400000000

Metadata :
Product Name: Chrome
Product Version: 51.0.2665.0
Report ID: 33030bd400000000
Report Time: Wed, 02 Mar 2016 11:44:30 GMT
Uptime: 2000 ms
Cumulative Uptime: 0 ms
User Email: 
OS Name: Windows NT
OS Version: 6.1.7601 19135
CPU Architecture: amd64
CPU Info: family 6 model 58 stepping 9

Stack trace:
=========
CRASHED [EXCEPTION_ACCESS_VIOLATION_READ @ 0x00000000 ] MAGIC SIGNATURE THREAD
0x000007fedf09edce	(chrome.dll -data_reduction_proxy_delegate.cc:124 )	data_reduction_proxy::OnResolveProxyHandler(GURL const &,int,net::ProxyConfig const &,std::map<std::basic_string<char,std::char_traits<char>,std::allocator<char> >,net::ProxyRetryInfo,std::less<std::basic_string<char,std::char_traits<char>,std::allocator<char> > >,std::allocator<std::pair<std::basic_string<char,std::char_traits<char>,std::allocator<char> > const ,net::ProxyRetryInfo> > > const &,data_reduction_proxy::DataReductionProxyConfig const *,net::ProxyInfo *)
0x000007fedf09ed68	(chrome.dll -data_reduction_proxy_delegate.cc:57 )	data_reduction_proxy::DataReductionProxyDelegate::OnResolveProxy(GURL const &,int,net::ProxyService const &,net::ProxyInfo *)
0x000007fede4092cb	(chrome.dll -proxy_service.cc:1384 )	net::ProxyService::DidFinishResolvingProxy(GURL const &,int,net::ProxyDelegate *,net::ProxyInfo *,int,net::BoundNetLog const &,base::TimeTicks,bool)
0x000007fede40addd	(chrome.dll -proxy_service.cc:1053 )	net::ProxyService::ResolveProxyHelper(GURL const &,int,net::ProxyInfo *,base::Callback<void > const &,net::ProxyService::PacRequest * *,net::ProxyDelegate *,net::BoundNetLog const &)
0x000007fede40ac7c	(chrome.dll -proxy_service.cc:1020 )	net::ProxyService::ResolveProxy(GURL const &,int,net::ProxyInfo *,base::Callback<void > const &,net::ProxyService::PacRequest * *,net::ProxyDelegate *,net::BoundNetLog const &)
0x000007fede4baf6a	(chrome.dll -http_stream_factory_impl_job.cc:874 )	net::HttpStreamFactoryImpl::Job::DoResolveProxy()
0x000007fede4bad29	(chrome.dll -http_stream_factory_impl_job.cc:761 )	net::HttpStreamFactoryImpl::Job::DoLoop(int)
0x000007fede4bce20	(chrome.dll -http_stream_factory_impl_job.cc:623 )	net::HttpStreamFactoryImpl::Job::RunLoop(int)
0x000007fede4bc63c	(chrome.dll -http_stream_factory_impl_job.cc:267 )	net::HttpStreamFactoryImpl::Job::Preconnect(int)
0x000007fede43728a	(chrome.dll -http_stream_factory_impl.cc:196 )	net::HttpStreamFactoryImpl::PreconnectStreams(int,net::HttpRequestInfo const &,net::SSLConfig const &,net::SSLConfig const &)
0x000007fedf284112	(chrome.dll -preconnect.cc:114 )	chrome_browser_net::PreconnectOnIOThread(GURL const &,GURL const &,chrome_browser_net::UrlInfo::ResolutionMotivation,int,net::URLRequestContextGetter *,bool)
0x000007fedf223a4e	(chrome.dll -predictor.cc:876 )	chrome_browser_net::Predictor::PreconnectUrlOnIOThread(GURL const &,GURL const &,chrome_browser_net::UrlInfo::ResolutionMotivation,bool,int)
0x000007fedf224242	(chrome.dll -bind_internal.h:354 )	base::internal::Invoker<base::IndexSequence<0,1,2,3,4,5>,base::internal::BindState<base::internal::RunnableAdapter<void ( chrome_browser_net::Predictor::*)(GURL const &,GURL const &,chrome_browser_net::UrlInfo::ResolutionMotivation,bool,int)>,void ,base::internal::UnretainedWrapper<chrome_browser_net::Predictor>,GURL const &,GURL const &,chrome_browser_net::UrlInfo::ResolutionMotivation &,bool &,int &>,base::internal::InvokeHelper<0,void,base::internal::RunnableAdapter<void ( chrome_browser_net::Predictor::*)(GURL const &,GURL const &,chrome_browser_net::UrlInfo::ResolutionMotivation,bool,int)> >,void >::Run(base::internal::BindStateBase *)
0x000007fedd9069dc	(chrome.dll -task_annotator.cc:51 )	base::debug::TaskAnnotator::RunTask(char const *,base::PendingTask const &)
0x000007fedd8a2f04	(chrome.dll -message_loop.cc:476 )	base::MessageLoop::RunTask(base::PendingTask const &)
0x000007fedd8a3a43	(chrome.dll -message_loop.cc:597 )	base::MessageLoop::DoWork()
0x000007fedd905d99	(chrome.dll -message_pump_win.cc:485 )	base::MessagePumpForIO::DoRunLoop()
0x000007fedd905261	(chrome.dll -message_pump_win.cc:50 )	base::MessagePumpWin::Run(base::MessagePump::Delegate *)
0x000007fedd8f1382	(chrome.dll -run_loop.cc:35 )	base::RunLoop::Run()
0x000007fedd8c84c0	(chrome.dll -thread.cc:202 )	base::Thread::Run(base::MessageLoop *)
0x000007fede8050e1	(chrome.dll -browser_thread_impl.cc:215 )	content::BrowserThreadImpl::IOThreadRun(base::MessageLoop *)
0x000007fede8058e4	(chrome.dll -browser_thread_impl.cc:251 )	content::BrowserThreadImpl::Run(base::MessageLoop *)
0x000007fedd8c8817	(chrome.dll -thread.cc:254 )	base::Thread::ThreadMain()
0x000007fedd8d6f9c	(chrome.dll -platform_thread_win.cc:84 )	base::`anonymous namespace'::ThreadFunc(void *)
0x76de59ec	(kernel32.dll + 0x000159ec )	BaseThreadInitThunk
0x7701b370	(ntdll.dll + 0x0002b370 )	RtlUserThreadStart

This is a regression with instances being observed from M42 build 42.0.2311.135, But instances are spiked from M50 Build 50.0.2657.0. Below link Gives in detail about the same.

https://crash.corp.google.com/browse?q=product.name%3D%27Chrome%27%20%20AND%20custom_data.ChromeCrashProto.ptype%3D%27browser%27%20AND%20custom_data.ChromeCrashProto.magic_signature_1.name%3D%27data_reduction_proxy%3A%3AOnResolveProxyHandler%27&ignore_case=false#-samplereports:5,productversion:1000

Using code search suspecting r376860 could be the possible suspect

Review URL: https://codereview.chromium.org/1680893002

@ ryansturm: Request you to please take a look into it. Please help us to reassign to the right owner if not with respect to your change.

Note: 
====
Adding blocker label, since spike is seen from M50 builds and is ranked 1 browser crash for canary 51.0.2665.0 on Windows. Please remove if not the case.
Also seeing instances of this crash on MAC and Linux.
 
Owner: tbansal@chromium.org
Project Member

Comment 2 by ClusterFuzz, Mar 2 2016

Labels: ChromeCrash M-51
This crash was seen on the following builds: Win Canary 51.0.2665.0. Adding tracking labels.
Labels: -Restrict-View-Google -M-51 -ChromeCrash
Labels: M-51
Status: Started (was: Assigned)
Project Member

Comment 5 by ClusterFuzz, Mar 2 2016

Labels: ChromeCrash
This crash was seen on the following builds: Win Canary 51.0.2665.0, adding tracking labels.

-Your friendly Fracas
Project Member

Comment 6 by bugdroid1@chromium.org, Mar 3 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/50eb58711b04bd731486974488e46546bf45b0bb

commit 50eb58711b04bd731486974488e46546bf45b0bb
Author: tbansal <tbansal@chromium.org>
Date: Thu Mar 03 18:58:36 2016

Do not check ProxyInfo if the the DRP config is not valid

A previous CL (https://codereview.chromium.org/1702253002)
made a change and called result->proxy_server() without
checking if DRP config is valid. This caused Chrome
to crash because if config is not valid, calling result-
>proxy_server() may cause crashes (because there may not be
any proxy server in result).

This CL reverts back to behavior before that CL. Before
result->proxy_server() is called, it is ensured that the
DRP config must be valid.

BUG= 591356 

Review URL: https://codereview.chromium.org/1756323002

Cr-Commit-Position: refs/heads/master@{#379048}

[modify] https://crrev.com/50eb58711b04bd731486974488e46546bf45b0bb/components/data_reduction_proxy/core/browser/data_reduction_proxy_delegate.cc
[modify] https://crrev.com/50eb58711b04bd731486974488e46546bf45b0bb/components/data_reduction_proxy/core/browser/data_reduction_proxy_delegate_unittest.cc

Project Member

Comment 7 by bugdroid1@chromium.org, Mar 3 2016

Labels: merge-merged-2666
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/50eb58711b04bd731486974488e46546bf45b0bb

commit 50eb58711b04bd731486974488e46546bf45b0bb
Author: tbansal <tbansal@chromium.org>
Date: Thu Mar 03 18:58:36 2016

Do not check ProxyInfo if the the DRP config is not valid

A previous CL (https://codereview.chromium.org/1702253002)
made a change and called result->proxy_server() without
checking if DRP config is valid. This caused Chrome
to crash because if config is not valid, calling result-
>proxy_server() may cause crashes (because there may not be
any proxy server in result).

This CL reverts back to behavior before that CL. Before
result->proxy_server() is called, it is ensured that the
DRP config must be valid.

BUG= 591356 

Review URL: https://codereview.chromium.org/1756323002

Cr-Commit-Position: refs/heads/master@{#379048}

[modify] https://crrev.com/50eb58711b04bd731486974488e46546bf45b0bb/components/data_reduction_proxy/core/browser/data_reduction_proxy_delegate.cc
[modify] https://crrev.com/50eb58711b04bd731486974488e46546bf45b0bb/components/data_reduction_proxy/core/browser/data_reduction_proxy_delegate_unittest.cc

Labels: -ChromeCrash
Labels: Merge-Request-50
Status: Fixed (was: Started)

Comment 11 by tin...@google.com, Mar 7 2016

Labels: -Merge-Request-50 Merge-Approved-50 Hotlist-Merge-Approved
Your change meets the bar and is auto-approved for M50 (branch: 2661)
Project Member

Comment 12 by bugdroid1@chromium.org, Mar 7 2016

Labels: -merge-approved-50 merge-merged-2661
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/af925bedc19ae2c7a7a2b065baae730edc6e3143

commit af925bedc19ae2c7a7a2b065baae730edc6e3143
Author: Tarun Bansal <tbansal@google.com>
Date: Mon Mar 07 23:04:42 2016

Do not check ProxyInfo if the the DRP config is not valid

A previous CL (https://codereview.chromium.org/1702253002)
made a change and called result->proxy_server() without
checking if DRP config is valid. This caused Chrome
to crash because if config is not valid, calling result-
>proxy_server() may cause crashes (because there may not be
any proxy server in result).

This CL reverts back to behavior before that CL. Before
result->proxy_server() is called, it is ensured that the
DRP config must be valid.

BUG= 591356 

Review URL: https://codereview.chromium.org/1756323002

Cr-Commit-Position: refs/heads/master@{#379048}
(cherry picked from commit 50eb58711b04bd731486974488e46546bf45b0bb)

Review URL: https://codereview.chromium.org/1768163003 .

Cr-Commit-Position: refs/branch-heads/2661@{#111}
Cr-Branched-From: ef6f6ae5e4c96622286b563658d5cd62a6cf1197-refs/heads/master@{#378081}

[modify] https://crrev.com/af925bedc19ae2c7a7a2b065baae730edc6e3143/components/data_reduction_proxy/core/browser/data_reduction_proxy_delegate.cc
[modify] https://crrev.com/af925bedc19ae2c7a7a2b065baae730edc6e3143/components/data_reduction_proxy/core/browser/data_reduction_proxy_delegate_unittest.cc

As per update #12, this is already merged to M50 branch 2661. Is there anything pending for M50?
Nothing is pending for M50.
Labels: TE-Verified-51.0.2671.0
Not seeing this crash in latest canary 51.0.2671.0, it was last reported in - 51.0.2665.1.This should be fixed by now.

Sign in to add a comment