New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 664008 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Feb 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 2
Type: Bug



Sign in to add a comment

SIGSEGV in views::BubbleDialogDelegateView::GetBubbleBounds

Project Member Reported by djkurtz@chromium.org, Nov 10 2016

Issue description

Chrome Version: 55.0.2883.35
Chrome OS Version: 8872.35.0
Chrome OS Platform: elm, veyron_minnie, cyan, glimmer, candy

Steps To Reproduce:
(1) unknown.  From crash reports
(2)
(3)

Expected Result:

Actual Result:

How frequently does this problem reproduce? (Always, sometimes, hard to
reproduce?)

What is the impact to the user, and is there a workaround? If so, what is
it?

Please provide any additional information below. Attach a screen shot or
log if possible.

Crashes reported in versions:

56.0.2905.0	4.52%	10	
55.0.2883.35	7.69%	17	
55.0.2883.29	0.45%	1	
55.0.2883.17	1.36%	3	
55.0.2883.7	4.52%	10	
55.0.2878.0	1.36%	3	
55.0.2869.0	0.90%	2	
54.0.2840.79	1.36%	3	
54.0.2840.68	2.26%	5	
54.0.2840.59	6.33%	14	
54.0.2840.51	0.90%	2	
54.0.2840.43	0.45%	1	
54.0.2840.24	5.43%	12	
54.0.2840.6	2.26%	5	
54.0.2824.5	3.62%	8	
53.0.2785.154	9.50%	21	
53.0.2785.144	13.57%	30	
53.0.2785.129	1.36%	3	
53.0.2785.123	0.90%	2	
53.0.2785.87	0.45%	1	
53.0.2785.70	3.62%	8	
53.0.2785.55	0.45%	1	
53.0.2785.47	9.05%	20	
53.0.2785.36	9.95%	22	
53.0.2785.29	1.36%	3	
53.0.2773.3	0.45%	1	
52.0.2743.116   5.88%   13

Example backtrace (https://crash.corp.google.com/browse?q=ReportID=2b8481a700000000): 

0xf43b5dc4	(chrome -bubble_dialog_delegate.cc:232 )	views::BubbleDialogDelegateView::GetBubbleBounds
0xf43b5941	(chrome -bubble_dialog_delegate.cc:285 )	views::BubbleDialogDelegateView::SizeToContents
0xf5f4749b	(chrome -app_list_presenter_delegate.cc:181 )	ash::AppListPresenterDelegate::UpdateBounds
0xf48e51a9	(chrome -wm_shelf.cc:258 )	ash::WmShelf::NotifyShelfIconPositionsChanged
0xf4936573	(chrome -shelf_view.cc:1591 )	ash::ShelfView::OnBoundsChanged
0xf43da0a3	(chrome -view.cc:1943 )	views::View::BoundsChanged
0xf43da241	(chrome -view.cc:300 )	views::View::SetBoundsRect
0xf43d3e9d	(chrome -fill_layout.cc:20 )	views::FillLayout::Layout
0xf43db091	(chrome -view.cc:532 )	views::View::Layout
0xf48e191b	(chrome -shelf_layout_manager.cc:610 )	ash::ShelfLayoutManager::UpdateBoundsAndOpacity
0xf48e21fb	(chrome -shelf_layout_manager.cc:177 )	ash::ShelfLayoutManager::LayoutShelfAndUpdateBounds
0xf48e8ff9	(chrome -status_area_layout_manager.cc:62 )	ash::StatusAreaLayoutManager::LayoutStatusArea
0xf41821a5	(chrome -window.cc:312 )	aura::Window::SetBounds
0xf43e4f63	(chrome -native_widget_aura.cc:454 )	views::NativeWidgetAura::SetSize
0xf48e9d01	(chrome -status_area_widget_delegate.cc:203 )	ash::StatusAreaWidgetDelegate::UpdateWidgetSize
0xf48e9d4d	(chrome -status_area_widget_delegate.cc:194 )	ash::StatusAreaWidgetDelegate::ChildPreferredSizeChanged
0xf43da6d5	(chrome -view.cc:417 )	views::View::SetVisible
0xf48fc1a1	(chrome -web_notification_tray.cc:609 )	ash::WebNotificationTray::UpdateTrayContent
0xf25e0ddd	(chrome -callback.h:64 )	base::debug::TaskAnnotator::RunTask
0xf25d631b	(chrome -message_loop.cc:405 )	base::MessageLoop::DoWork
0xf25d6693	(chrome -message_pump_libevent.cc:217 )	base::MessagePumpLibevent::Run
0xf37db301	(chrome -run_loop.cc:35 )	base::RunLoop::Run
0xf358bd93	(chrome -chrome_browser_main.cc:2116 )	ChromeBrowserMainParts::MainMessageLoopRun
0xf2ea03ef	(chrome -browser_main_loop.cc:981 )	content::BrowserMainLoop::RunMainMessageLoopParts
0xf2ea18cd	(chrome -browser_main_runner.cc:155 )	content::BrowserMainRunnerImpl::Run
0xf2e9d7ef	(chrome -browser_main.cc:46 )	content::BrowserMain
0xf3546613	(chrome -content_main_runner.cc:779 )	content::ContentMainRunnerImpl::Run
0xf354571d	(chrome -content_main.cc:20 )	content::ContentMain
0xf2775a73	(chrome -chrome_main.cc:97 )	ChromeMain
0xf1934307	(libc-2.19.so -libc-start.c:285 )	__libc_start_main
0xf2775937	(chrome + 0x007a2937 )	_start
0xf6294e4f	(chrome -elf-init.c:87 )	__libc_csu_init
0xf1fbc9df	(ld-2.19.so + 0x0000b9df )	_dl_sort_fini

CC'ing folks who show up in "git blame" in the backtrace.
 
Status: Untriaged (was: Available)

Comment 2 by osh...@chromium.org, Nov 14 2016

Looks like we just need to check null here, as other places assume it can be null. estade@, can you confirm?

https://cs.chromium.org/chromium/src/ui/views/bubble/bubble_dialog_delegate.cc?rcl=1479125882&l=284

Comment 3 by est...@chromium.org, Nov 14 2016

I dunno. Perhaps AppListPresenterDelegate shouldn't be calling UpdateBounds if the bubble isn't shown? From reading the code, I don't understand how this is happening, because it already checks for view_ and is_visible_.
Owner: osh...@chromium.org
Status: Assigned (was: Untriaged)
@oshima, could you triage?

Comment 5 by osh...@chromium.org, Feb 21 2017

Status: Started (was: Assigned)
Found the repro step.

* enable fullscreen applist
* switch to tablet mode
* open app list, and use it for a while.

This is because the fullscreen applist uses frameless window, which 
does not have client view.

Comment 6 by osh...@chromium.org, Feb 22 2017

Owner: tbuck...@chromium.org
Status: Assigned (was: Started)
Actually, this flag looks pretty old (added 2014 by mukai@).

tbuckley@, can we just remove this?

Comment 7 by osh...@chromium.org, Feb 22 2017

This feature looks already broken, so I assume we can and should just remove it.
I made CL so please assign back to me if you agree.

https://codereview.chromium.org/2713603002/
Cc: omrilio@chromium.org tbuck...@chromium.org
Owner: osh...@chromium.org
I'm fine with removing the flag for fullscreen applist.
+omrilio for launcher
Project Member

Comment 9 by bugdroid1@chromium.org, Feb 28 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f55eeecd02288e793a19b1f8fab177f3a9925ddb

commit f55eeecd02288e793a19b1f8fab177f3a9925ddb
Author: oshima <oshima@chromium.org>
Date: Tue Feb 28 04:37:35 2017

Remove fullscreen applist

This was added 3 years ago as an experiment, but it's broken and causing crash. It's time to clean up.

BUG= 664008 

Review-Url: https://codereview.chromium.org/2713603002
Cr-Commit-Position: refs/heads/master@{#453496}

[modify] https://crrev.com/f55eeecd02288e793a19b1f8fab177f3a9925ddb/ash/app_list/app_list_presenter_delegate.cc
[modify] https://crrev.com/f55eeecd02288e793a19b1f8fab177f3a9925ddb/ash/app_list/app_list_presenter_delegate.h
[modify] https://crrev.com/f55eeecd02288e793a19b1f8fab177f3a9925ddb/ash/common/ash_switches.cc
[modify] https://crrev.com/f55eeecd02288e793a19b1f8fab177f3a9925ddb/ash/common/ash_switches.h
[modify] https://crrev.com/f55eeecd02288e793a19b1f8fab177f3a9925ddb/chrome/app/chromeos_strings.grdp
[modify] https://crrev.com/f55eeecd02288e793a19b1f8fab177f3a9925ddb/chrome/browser/about_flags.cc
[modify] https://crrev.com/f55eeecd02288e793a19b1f8fab177f3a9925ddb/ui/app_list/presenter/BUILD.gn
[modify] https://crrev.com/f55eeecd02288e793a19b1f8fab177f3a9925ddb/ui/app_list/presenter/app_list_presenter_impl_unittest.cc
[modify] https://crrev.com/f55eeecd02288e793a19b1f8fab177f3a9925ddb/ui/app_list/views/app_list_view.cc
[modify] https://crrev.com/f55eeecd02288e793a19b1f8fab177f3a9925ddb/ui/app_list/views/app_list_view.h

Status: Fixed (was: Assigned)
Please reopen or file new bug if this is still observed in m58 stable.
Status: Verified (was: Fixed)

Sign in to add a comment