I think there is no need to visit that website.

1. Launch Chrome
2. Install the extension.
2. Launch Incognito window, Ctrl+N
3. Close incognito window
4. Crach!

This looks likely to be a dupe of https://bugs.chromium.org/p/chromium/issues/detail?id=412090 ?

Hmm. None of the steps given here are reproing for me on ToT. Maybe there's another factor involved?

I believe this is a security regression issue, it doesn't repro on 52.0.2707.0, so it's probably a recent change.

Good Build :  52.0.2707.0
Bad Build :  52.0.2708.0
...
Bad bluid : 52.0.2711.0

Tried with 52.0.2711.0, 52.0.2709.0, and 52.0.2708.0. None of them repro, though I just noticed the report was for Windows and I've been building on Linux. I wouldn't expect it to matter but I'll try Windows builds now.

I have tried 52.0.2711.0 on Windows as well with no repro.

I am still able to repro this issue on 52.0.2711.0 canary.

Note: This crach doesn't repro on ASan bluid.

Khalil: can you double-check that you don't have any other extensions installed?

Also, does it repro with a clean profile? i.e. with --user-data-dir=somethingnew

I've checked there is no extensions installed and there is no need to switch a profile or something like that, I've made a video to see how I repro this crash as well on windows.

What I mean is, have you actually tried this with a clean profile?

I've already followed the steps in your report and video, and I cannot repro the crash on Windows Canary (52.0.2711.0), so there is some piece missing here.

Can you please try your own steps on a clean profile and see if it still crashes?

Hmm understood, I tried on a clean profile and it still crashes. Also, I tried on another machine windows and I am still able to repro.

I reproduce this on Windows 7 with Version 52.0.2712.0 canary (64-bit)

https://crash.corp.google.com/browse?stbtiq=79086c6200000000

Steps:
Drop two files from the ZIP in C:\src\dummyExt
Use chrome://extensions/ to load unpacked extension
Open an Incognito window from that window
Close the Incognito window

Yeah, still can't repro. I only have a Windows 10 box to test on, so maybe that has something to do with it. Anyone on extensions able to repro this?

Ken, Did you try to repro on Windows 7?

I can repro this at will in Windows 10 14316 and Chrome 52.0.2712.0. https://crash.corp.google.com/browse?stbtiq=06d91c6200000000

Is it possible that there's some experiment (maybe one of the process isolation ones?) that accounts for the difference in our ability to repro?

Re #20: I don't have the means to test on Windows 7 at this time, but it sounds like that shouldn't matter.

Re #21: That's plausible. Hopefully someone from the extensions team can also repro this.

When you tried to repro, did you get the "Disable Developer Extensions?" info bubble?

Based on prior issues here and the stack trace in https://crash.corp.google.com/browse?stbtiq=06d91c6200000000, is the problem that we've unloaded the profile but then we try to touch it in the destructor for the info bubble?

https://chromium.googlesource.com/chromium/src/+/5251920ddf61989a550ba9e49c8d1663a824a81f%5E%21/chrome/browser/extensions/extension_message_bubble_controller.cc

I just tried reproducing with "52.0.2712.0 (Official Build) canary (64-bit)" running against a blank profile on a windows 7 machine and wasn't able to.

elawrence - can you provide the Variations value from chrome://version so we can see if there is indeed an experiment at play here?

Ok, I take it back - I was just playing with it again, and this time I was able to reproduce the crash by doing the following:

-making sure to check the "allow in Incognito" checkbox on chrome://extensions
-I used the "New Incognito Window" menu item from the hamburger menu to open the window, instead of using CTL-SHIFT-N

I'll kick off a local build and see if I can repro in a Debug binary

Sorry, my mistake, I failed to mention "Tick allow incognito" in my repro steps. Notably, this bug still repros if the content script is just "console.log("nothing");", so this bug isn't likely to be about anything that the script contains.

My variations, if relevant, are: Variations	16e0dd70-3f4a17df b3888d8d-bb338302 6345b824-3f4a17df 7c1bc906-ff96eb58 c4455df5-4ad60575 f049a919-3f4a17df 775ebbd7-65bced95 31362330-3f4a17df f15c1c09-ca7d8d80 9ffc5535-301ba80c dd4da2fc-3f4a17df fd02e767-f23d1dea 93731dca-3f4a17df 9e5c75f1-7491430a 2c3080ba-3f4a17df 64cbdfc2-ca7d8d80 7ea1191-82bd42b5 f79cb77b-3f4a17df 23a898eb-ca7d8d80 4ea303a6-f23d1dea d5b671a5-3f4a17df 4117e878-23622c9b 7aa46da5-4995b330 9736de91-3f4a17df 535ce4f1-f23d1dea ad6d27cc-7075cd8 ca314179-ca7d8d80 69bf80fa-f23d1dea a35118-3f4a17df 867c4c68-3d47f4f4 5e3f6590-ca7d8d80 12a73824-3d47f4f4 d747916f-e510b2e9 6844d8aa-669a04e0 3ac60855-3ec2a267 f296190c-5c63917a 4442aae2-4ad60575 ed1d377-e1cc0f14 75f0f0a0-e1cc0f14 e2b18481-cdc3d902 e7e71889-e1cc0f14 b39ea213-d1372334 46567c16-f23d1dea

Re #23, I think you're right. I'm able to repro consistently by including --force-fieldtrials=ExtensionDeveloperModeWarning/Enabled.

So this is most likely not a dupe of bug 412090. Over to Devlin who AFAIK worked on the bubble code.

hmm... looks like this could be a dupe of issue 604003, which should be fixed as of a couple hours ago.  Let's try this on tomorrow's (or maybe Thursday's, depending on cut off's) canary.

This medium+ severity security issue is a regression on trunk.

Please fix this asap. If you are unable to look into this soon, please revert your change.

- Your friendly ClusterFuzz

Verified, seems like fixed on 52.0.2713.0.

Agreed. Okay in Version 52.0.2713.0 canary (64-bit).

Should resolve as dupe?

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot