Users experienced this crash on the following builds:

Win Canary 51.0.2671.0 - 232 reports, 204 clients (signature v8::internal::GlobalHandles::Node::DecreaseBlockUses)

If this update was incorrect, please add "Fracas-Wrong" label to prevent future updates.

- Go/Fracas

This crash spiked recently. #1 crash on windows.

51.0.2671.1	0.08%	21	
51.0.2671.0	1.50%	385	
51.0.2664.1	0.00%	1	

204 clients with 232 reports as of now.
CPM PLs  : 42.84

Link to the builds which introduced the crash:

https://crash.corp.google.com/browse?q=product.name%3D%27Chrome%27%20AND%20custom_data.ChromeCrashProto.magic_signature_1.name%3D%27v8%3A%3Ainternal%3A%3AGlobalHandles%3A%3ANode%3A%3ADecreaseBlockUses%27&ignore_case=false#-samplereports:5,productversion:1000

Forwarding to V8 team to investigate.

This looks more likely to be a Bindings or Oilpan issue than v8, since most of the stack is in Blink. Assigning to haraken@for more triage.

This comment is for Fracas team.

Adding Fracas-Wrong label due to below reason.

Bug is shown as stale while hoovering.Message is " Issue 593092  is open in New Status and is missing an owner. Assign it to dev for triage".
But the bug already have all the required info with an owner.

Fracas currently has a 30 min update latency, in future, we will be shortening that. As you can see the owner assignment was done 29 minutes ago.

This is top#2 renderer crash on Latest Canary#51.0.2672.0 with 137 crash instances.

haraken@, could you please look into this?

Many thanks!

We are seeing a sudden spike in the 'windows' crash instances (8829) for Latest Canary#51.0.2672.0.

I see no spike in crashes with this stack (a total of 176 still). The big spike is in "v8::internal::`anonymous namespace'::Invoke", which I believe is issue 593332 (which is already fixed on master).

oops., Its my bad, updated the wrong bug. Thanks Adam for correcting me.

I think that 5940f25b9d91258d698a5ce9f48e8a253c7b1652 is almost certainly the problematic commit (in Blink). It falls in the blamelist between 51.0.2670.0 and 51.0.2671.0, and adds exactly the code that's triggering the crash (ThreadState::detachMainThread() inside shutdownWithoutV8()).

haraken, ptal.

haraken@, it would be great if you can revert the above CL (5940f25b9d91258d698a5ce9f48e8a253c7b1652) if it is causing this v8 crash. We are targeting tonight's 8 PM PST build for tomorrow's Dev release.

Thank you!

I'll revert the CL at the moment.

I need to revert two or three CLs via CQ. The first revert is still in the CQ (https://codereview.chromium.org/1783673002/). It may take a couple of more hours to revert all relevant CLs.

Hmm, I noticed that I need to revert too many CLs.

Alternately let me prepare a fix for this. I'll try to land the fix by the end of today.

Uploaded a fix: https://codereview.chromium.org/1771353010/

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/29a57aad9a5cd9388811408f1a457493d6f9671d

commit 29a57aad9a5cd9388811408f1a457493d6f9671d
Author: haraken <haraken@chromium.org>
Date: Thu Mar 10 15:49:51 2016

Finish completeSweep before shutting down V8

If Oilpan runs completeSweep after shutting down V8, some destructor
may access V8 and cause crash. Oilpan should finish completeSweep before
shutting down V8.

BUG= 593092 

Review URL: https://codereview.chromium.org/1771353010

Cr-Commit-Position: refs/heads/master@{#380415}

[modify] https://crrev.com/29a57aad9a5cd9388811408f1a457493d6f9671d/third_party/WebKit/Source/bindings/core/v8/V8Initializer.cpp
[modify] https://crrev.com/29a57aad9a5cd9388811408f1a457493d6f9671d/third_party/WebKit/Source/platform/heap/HeapTest.cpp
[modify] https://crrev.com/29a57aad9a5cd9388811408f1a457493d6f9671d/third_party/WebKit/Source/platform/heap/ThreadState.cpp
[modify] https://crrev.com/29a57aad9a5cd9388811408f1a457493d6f9671d/third_party/WebKit/Source/platform/heap/ThreadState.h
[modify] https://crrev.com/29a57aad9a5cd9388811408f1a457493d6f9671d/third_party/WebKit/Source/web/WebKit.cpp

To which branch should I merge the change?

haraken@, thank you for the fix. We are not seeing any crash instances on Latest Canary#51.0.2674.0.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot