New issue
Advanced search Search tips

Issue 601632 link

Starred by 3 users

Issue metadata

Status: Untriaged
Owner: ----
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 2
Type: Bug



Sign in to add a comment

Crash on removing a profile via chrome://settings

Reported by chromium...@gmail.com, Apr 7 2016

Issue description

VERSION
Chrome Version: 49.0.2623.110 beta-m
Operating System: Windows 7

REPRODUCTION CASE
1. Go to chrome://settings
2. Try to delete a person 
3. Fast doubleclick on "Delete" button.
4. Crash!

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Type of crash: browser 

eax=0040fba0 ebx=00000009 ecx=666f7250 edx=00000005 esi=feeefeee edi=0040fb90
eip=5a86a916 esp=002ce8c0 ebp=002ce8d4 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
chrome_5a850000!std::_Tree<std::_Tmap_traits<std::basic_string<char,std::char_traits<char>,std::allocator<char> >,base::Value *,std::less<std::basic_string<char,std::char_traits<char>,std::allocator<char> > >,std::allocator<std::pair<std::basic_string<char,std::char_traits<char>,std::allocator<char> > const ,base::Value *> >,0> >::_Lbound+0x52:
5a86a916 3b0e            cmp     ecx,dword ptr [esi]  ds:0023:feeefeee=????????
0:000> k
ChildEBP RetAddr  
002ce8d4 5a978009 chrome_5a850000!std::_Tree<std::_Tmap_traits<std::basic_string<char,std::char_traits<char>,std::allocator<char> >,base::Value *,std::less<std::basic_string<char,std::char_traits<char>,std::allocator<char> > >,std::allocator<std::pair<std::basic_string<char,std::char_traits<char>,std::allocator<char> > const ,base::Value *> >,0> >::_Lbound+0x52 [c:\b\depot_tools\win_toolchain\vs2013_files\9ff97c632ae1fee0c98bcd53e71770eb3a0d8deb\vc\include\xtree @ 2110]
002ce8f0 5a9ee75b chrome_5a850000!base::DictionaryValue::GetWithoutPathExpansion+0x20 [c:\b\build\slave\win\build\src\base\values.cc @ 645]
002ce904 5aa0057d chrome_5a850000!base::DictionaryValue::GetDictionaryWithoutPathExpansion+0x10 [c:\b\build\slave\win\build\src\base\values.cc @ 713]
002ce940 5aa5bd04 chrome_5a850000!ProfileInfoCache::GetInfoForProfileAtIndex+0x55 [c:\b\build\slave\win\build\src\chrome\browser\profiles\profile_info_cache.cc @ 1080]
002ce97c 5aa5bc63 chrome_5a850000!ProfileInfoCache::GetGAIAIdOfProfileAtIndex+0x43 [c:\b\build\slave\win\build\src\chrome\browser\profiles\profile_info_cache.cc @ 396]
002ce9d4 5b37c1e8 chrome_5a850000!ProfileInfoCache::ProfileIsAuthenticatedAtIndex+0x2b [c:\b\build\slave\win\build\src\chrome\browser\profiles\profile_info_cache.cc @ 484]
002cea60 5b37cf45 chrome_5a850000!ProfileManager::FinishDeletingProfile+0x10c [c:\b\build\slave\win\build\src\chrome\browser\profiles\profile_manager.cc @ 1308]
002ceb08 5c09eeb6 chrome_5a850000!ProfileManager::ScheduleProfileForDeletion+0x1e1 [c:\b\build\slave\win\build\src\chrome\browser\profiles\profile_manager.cc @ 750]
002ceb28 5c08dabf chrome_5a850000!options::helper::DeleteProfileAtPath+0x53 [c:\b\build\slave\win\build\src\chrome\browser\ui\webui\options\options_handlers_helper.cc @ 62]
002ceb70 5a96d1d3 chrome_5a850000!options::BrowserOptionsHandler::DeleteProfile+0x59 [c:\b\build\slave\win\build\src\chrome\browser\ui\webui\options\browser_options_handler.cc @ 1350]
002ceb80 5b808544 chrome_5a850000!base::internal::Invoker<base::IndexSequence<0>,base::internal::BindState<base::internal::RunnableAdapter<void (__thiscall DownloadItemView::*)(gfx::Image *)>,void __cdecl(DownloadItemView *,gfx::Image *),base::internal::UnretainedWrapper<DownloadItemView> >,base::internal::TypeList<base::internal::UnwrapTraits<base::internal::UnretainedWrapper<DownloadItemView> > >,base::internal::InvokeHelper<0,void,base::internal::RunnableAdapter<void (__thiscall DownloadItemView::*)(gfx::Image *)>,base::internal::TypeList<DownloadItemView *,gfx::Image * const &> >,void __cdecl(gfx::Image * const &)>::Run+0x17 [c:\b\build\slave\win\build\src\base\bind_internal.h @ 350]
002ceb98 5b77a474 chrome_5a850000!content::WebUIImpl::ProcessWebUIMessage+0x40 [c:\b\build\slave\win\build\src\content\browser\webui\web_ui_impl.cc @ 219]
002cec28 5b808520 chrome_5a850000!UberUI::OverrideHandleWebUIMessage+0x64 [c:\b\build\slave\win\build\src\chrome\browser\ui\webui\uber\uber_ui.cc @ 216]
002cec44 5b8084e0 chrome_5a850000!content::WebUIImpl::ProcessWebUIMessage+0x1c [c:\b\build\slave\win\build\src\content\browser\webui\web_ui_impl.cc @ 211]
002cec6c 5b807f1a chrome_5a850000!content::WebUIImpl::OnWebUISend+0x64 [c:\b\build\slave\win\build\src\content\browser\webui\web_ui_impl.cc @ 85]
002cec80 5b7e30a0 chrome_5a850000!base::DispatchToMethodImpl<content::WebUIImpl,void (__thiscall content::WebUIImpl::*)(GURL const &,std::basic_string<char,std::char_traits<char>,std::allocator<char> > const &,base::ListValue const &),GURL,std::basic_string<char,std::char_traits<char>,std::allocator<char> >,base::ListValue,0,1,2>+0x22 [c:\b\build\slave\win\build\src\base\tuple.h @ 253]
002ceca0 5b807ed1 chrome_5a850000!base::DispatchToMethod<content::WebContentsImpl,void (__thiscall content::WebContentsImpl::*)(GURL const &,std::basic_string<char,std::char_traits<char>,std::allocator<char> > const &,base::ListValue const &),GURL,std::basic_string<char,std::char_traits<char>,std::allocator<char> >,base::ListValue>+0x1c [c:\b\build\slave\win\build\src\base\tuple.h @ 259]
002ced58 5ad8370b chrome_5a850000!ViewHostMsg_WebUISend::Dispatch<content::WebUIImpl,content::WebUIImpl,void,void (__thiscall content::WebUIImpl::*)(GURL const &,std::basic_string<char,std::char_traits<char>,std::allocator<char> > const &,base::ListValue const &)>+0x4d [c:\b\build\slave\win\build\src\content\common\view_messages.h @ 1200]
002cedac 5abaa99d chrome_5a850000!content::WebUIImpl::OnMessageReceived+0x59 [c:\b\build\slave\win\build\src\content\browser\webui\web_ui_impl.cc @ 68]
002cefec 5abaa96d chrome_5a850000!content::WebContentsImpl::OnMessageReceived+0x2c [c:\b\build\slave\win\build\src\content\browser\web_contents\web_contents_impl.cc @ 589]

 

Comment 1 by kenrb@chromium.org, Apr 8 2016

Components: UI>Browser>WebUI
Labels: -Type-Bug-Security -Restrict-View-SecurityTeam Stability-Crash Type-Bug
Status: Untriaged (was: Unconfirmed)
Thanks for the report. This doesn't appear to have any security implications so I am removing flags.

I have reproduced the issue with crash ID 5e45da4400000000.

My repros appear to be dereference of a null pointer, but more importantly this bug can only be triggered by either direct user action or a renderer with WebUI bindings.

It looks similar to https://bugs.chromium.org/p/chromium/issues/detail?id=421215.
Labels: Pri-2
Issue has a component, but no priority. Updating to have default priority (Pri-2)

Sign in to add a comment