New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 658132 link

Starred by 4 users

Issue metadata

Status: Verified
Owner:
Closed: Dec 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 1
Type: Bug-Regression



Sign in to add a comment

Regression: Browser crash is seen on clicking on metrics link in Report an issue overlay.

Project Member Reported by jbanavatu@chromium.org, Oct 21 2016

Issue description

Version: 56.0.2895.0/8918.0.0 dev-channel Winky,Wolf,Panther.
OS: Chrome OS

What steps will reproduce the problem?
(1)Launch chrome>>Hit Alt+Shift+I for Report An Issue overlay>>Now click on metrics link and Observe browser crash.

Expected: Browser should not crash on clicking metrics link in Report An Issue overlay.
Actual: Instead browser crash is seen.

Crash id's: af74d9bb00000000

This is Regression issue as it is working fine in 54.0.2840.68/8743.69.0 Beta channel butterfly.

Stack Trace:

Thread 0 CRASHED [SIGILL @ 0x00007f5cf4e2edca ] MAGIC SIGNATURE THREAD

0x00007f5cf4e2edca	(chrome -app_window.cc:487)	extensions::AppWindow::OnReadyToCommitFirstNavigation()
0x00007f5cf4c36206	(chrome -web_contents_impl.cc:3227)	content::WebContentsImpl::ReadyToCommitNavigation(content::NavigationHandle*)
0x00007f5cf4a34357	(chrome -navigation_handle_impl.cc:639)	content::NavigationHandleImpl::MaybeTransferAndProceed()
0x00007f5cf4a352f7	(chrome -navigation_handle_impl.cc:481)	content::NavigationHandleImpl::WillProcessResponse(content::RenderFrameHostImpl*, scoped_refptr<net::HttpResponseHeaders>, content::SSLStatus const&, content::GlobalRequestID const&, bool, bool, bool, base::Callback<void (), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, base::Callback<void (content::NavigationThrottle::ThrottleCheckResult), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&)
0x00007f5cf4acd026	(chrome -navigation_resource_throttle.cc:173)	WillProcessResponseOnUIThread
0x00007f5cf4acca05	(chrome -bind_internal.h:164)	base::internal::Invoker<base::internal::BindState<void (*)(base::Callback<void (content::NavigationThrottle::ThrottleCheckResult), (base::internal::CopyMode)1, (base::internal::RepeatMode)1>, int, int, scoped_refptr<net::HttpResponseHeaders>, content::SSLStatus const&, content::GlobalRequestID const&, bool, bool, bool, base::Callback<void (), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, std::unique_ptr<content::NavigationData, std::default_delete<content::NavigationData> >), base::Callback<void (content::NavigationThrottle::ThrottleCheckResult), (base::internal::CopyMode)1, (base::internal::RepeatMode)1>, int, int, scoped_refptr<net::HttpResponseHeaders>, content::SSLStatus, content::GlobalRequestID, bool, bool, bool, base::Callback<void (), (base::internal::CopyMode)1, (base::internal::RepeatMode)1>, base::internal::PassedWrapper<std::unique_ptr<content::NavigationData, std::default_delete<content::NavigationData> > > >, void ()>::Run(base::internal::BindStateBase*)
0x00007f5cf3d7370c	(chrome -callback.h:47)	base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*)
0x00007f5cf3d5fac2	(chrome -message_loop.cc:413)	base::MessageLoop::DoWork()
0x00007f5cf3d600d2	(chrome -message_pump_libevent.cc:217)	base::MessagePumpLibevent::Run(base::MessagePump::Delegate*)
0x00007f5cf55d4f17	(chrome -run_loop.cc:35)	base::RunLoop::Run()
0x00007f5cf52b9314	(chrome -chrome_browser_main.cc:2118)	ChromeBrowserMainParts::MainMessageLoopRun(int*)
0x00007f5cf49888fa	(chrome -browser_main_loop.cc:975)	content::BrowserMainLoop::RunMainMessageLoopParts()
0x00007f5cf498a5e4	(chrome -browser_main_runner.cc:155)	content::BrowserMainRunnerImpl::Run()
0x00007f5cf498517b	(chrome -browser_main.cc:46)	content::BrowserMain(content::MainFunctionParams const&)
0x00007f5cf525b770	(chrome -content_main_runner.cc:776)	content::ContentMainRunnerImpl::Run()
0x00007f5cf525a3ba	(chrome -content_main.cc:20)	content::ContentMain(content::ContentMainParams const&)
0x00007f5cf3fdc975	(chrome -chrome_main.cc:97)	ChromeMain
0x00007f5cf1615fb5	(libc-2.19.so -libc-start.c:292)	__libc_start_main
0x00007f5cf3fdc7c4	(chrome+ 0x011e47c4)	_start
0x00007ffd2c2077b7	
 
This issue is not applicable to Linux as metrics link is not available.

Comment 2 by gkihumba@google.com, Oct 24 2016

Owner: abodenha@chromium.org
Status: Assigned (was: Untriaged)
Albert, please pass this along to the right owner. Thanks
Labels: -ReleaseBlock-Dev ReleaseBlock-Stable
Owner: clamy@chromium.org
Looks like this MIGHT be triggered by https://codereview.chromium.org/2392283005

clamy@ any thoughts here?

RB-Dev seems extreme for this.
Issue is still seen in latest ToT build 56.0.2899.0/8931.0.0. Issue also re-pros on Daisy,Blaze,Peach-pit devices.
 
Note:
1.This issue is not seen in latest M55 55.0.2883.17/8872.15.0 butterfly.

Comment 5 by clamy@chromium.org, Nov 2 2016

This is likely caused by https://codereview.chromium.org/2392283005. It seems that in some racy conditions, following that patch we can hit a function that we only expect to hit when PlzNavigate is enabled. I'll send a patch to fix this.

Comment 6 by son...@google.com, Nov 8 2016

Cc: ka...@chromium.org helenzhang@chromium.org
it's still reproducible in 8992.0.0 / 56.0.2920.0
Project Member

Comment 8 by bugdroid1@chromium.org, Nov 21 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/4c429f9b2a054e4d8b26e4a907c1f3c04ca730a1

commit 4c429f9b2a054e4d8b26e4a907c1f3c04ca730a1
Author: clamy <clamy@chromium.org>
Date: Mon Nov 21 18:29:53 2016

Remove invalid check

Following https://codereview.chromium.org/2392283005,
WebContentsObserver::ReadyToCommitNavigation is called outside of
PlzNavigate. This CL removes a CHECK(IsBrowserSideNavigationEnabled())
in one of the functions called by an implementation of
ReadyToCommitNavigation, since we can now reach it when browser-side
navigation is not enabled.

BUG= 658132 

Review-Url: https://codereview.chromium.org/2504973002
Cr-Commit-Position: refs/heads/master@{#433591}

[modify] https://crrev.com/4c429f9b2a054e4d8b26e4a907c1f3c04ca730a1/extensions/browser/app_window/app_window.cc

Comment 9 by clamy@chromium.org, Nov 29 2016

Status: Fixed (was: Assigned)
Labels: Merge-TBD
[Auto-generated comment by a script] We noticed that this issue is targeted for M-56; it appears the fix may have landed after branch point, meaning a merge might be required. Please confirm if a merge is required here - if so add Merge-Request-56 label, otherwise remove Merge-TBD label. Thanks.
The issue still seen in ChromeOs 9000.15.0, 56.0.2924.12. Tested on Kevin. 
Status: Untriaged (was: Fixed)
it's still reproducible in 9000.18.0, 56.0.2924.17. 

re-open.
Cc: -rohi...@chromium.org
Labels: -Merge-TBD Merge-Request-56
Status: Fixed (was: Untriaged)

Comment 15 by dimu@chromium.org, Dec 5 2016

Labels: -Merge-Request-56 Merge-Approved-56 Hotlist-Merge-Approved
Your change meets the bar and is auto-approved for M56 (branch: 2924)
It's still reproducible in ChromeOS: 9000.19.0,	56.0.2924.18.
Indeed, it seemed it landed just after branch point. My bad, I thought the patch landed before. I'll be cherry-picking it to M56 asap.
Project Member

Comment 18 by bugdroid1@chromium.org, Dec 7 2016

Labels: -merge-approved-56 merge-merged-2924
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/bba81655761aeb01fbf3b17ea5283b894d40e1d2

commit bba81655761aeb01fbf3b17ea5283b894d40e1d2
Author: clamy <clamy@chromium.org>
Date: Wed Dec 07 14:22:12 2016

Remove invalid check

Following https://codereview.chromium.org/2392283005,
WebContentsObserver::ReadyToCommitNavigation is called outside of
PlzNavigate. This CL removes a CHECK(IsBrowserSideNavigationEnabled())
in one of the functions called by an implementation of
ReadyToCommitNavigation, since we can now reach it when browser-side
navigation is not enabled.

BUG= 658132 

Review-Url: https://codereview.chromium.org/2504973002
Cr-Commit-Position: refs/heads/master@{#433591}
(cherry picked from commit 4c429f9b2a054e4d8b26e4a907c1f3c04ca730a1)

Review URL: https://codereview.chromium.org/2558043002 .

Cr-Commit-Position: refs/branch-heads/2924@{#377}
Cr-Branched-From: 3a87aecc31cd1ffe751dd72c04e5a96a1fc8108a-refs/heads/master@{#433059}

[modify] https://crrev.com/bba81655761aeb01fbf3b17ea5283b894d40e1d2/extensions/browser/app_window/app_window.cc

The fix has been cherry-picked, so it should be good by now.
Status: Verified (was: Fixed)
Verified in 9000.27.0, 56.0.2924.26.
Project Member

Comment 21 by sheriffbot@chromium.org, Dec 16 2016

Labels: Merge-Review-56 Hotlist-Merge-Review
This bug requires manual review: No test file found in commits.
Please contact the milestone owner if you have questions.
Owners: amineer@(clank), cmasso@(bling), gkihumba@(cros), bustamante@(desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 22 by sheriffbot@chromium.org, Dec 16 2016

This bug requires manual review: No test file found in commits.
Please contact the milestone owner if you have questions.
Owners: amineer@(clank), cmasso@(bling), gkihumba@(cros), bustamante@(desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 23 by dimu@google.com, Dec 16 2016

Labels: -Merge-Review-56 -Hotlist-Merge-Review
[Automated comment] removing mislabelled Merge-Review-56, Hotlist-Merge-Review

Sign in to add a comment