SIGSEGV in views::BubbleDialogDelegateView::GetBubbleBounds |
|||||||
Issue descriptionChrome Version: 55.0.2883.35 Chrome OS Version: 8872.35.0 Chrome OS Platform: elm, veyron_minnie, cyan, glimmer, candy Steps To Reproduce: (1) unknown. From crash reports (2) (3) Expected Result: Actual Result: How frequently does this problem reproduce? (Always, sometimes, hard to reproduce?) What is the impact to the user, and is there a workaround? If so, what is it? Please provide any additional information below. Attach a screen shot or log if possible. Crashes reported in versions: 56.0.2905.0 4.52% 10 55.0.2883.35 7.69% 17 55.0.2883.29 0.45% 1 55.0.2883.17 1.36% 3 55.0.2883.7 4.52% 10 55.0.2878.0 1.36% 3 55.0.2869.0 0.90% 2 54.0.2840.79 1.36% 3 54.0.2840.68 2.26% 5 54.0.2840.59 6.33% 14 54.0.2840.51 0.90% 2 54.0.2840.43 0.45% 1 54.0.2840.24 5.43% 12 54.0.2840.6 2.26% 5 54.0.2824.5 3.62% 8 53.0.2785.154 9.50% 21 53.0.2785.144 13.57% 30 53.0.2785.129 1.36% 3 53.0.2785.123 0.90% 2 53.0.2785.87 0.45% 1 53.0.2785.70 3.62% 8 53.0.2785.55 0.45% 1 53.0.2785.47 9.05% 20 53.0.2785.36 9.95% 22 53.0.2785.29 1.36% 3 53.0.2773.3 0.45% 1 52.0.2743.116 5.88% 13 Example backtrace (https://crash.corp.google.com/browse?q=ReportID=2b8481a700000000): 0xf43b5dc4 (chrome -bubble_dialog_delegate.cc:232 ) views::BubbleDialogDelegateView::GetBubbleBounds 0xf43b5941 (chrome -bubble_dialog_delegate.cc:285 ) views::BubbleDialogDelegateView::SizeToContents 0xf5f4749b (chrome -app_list_presenter_delegate.cc:181 ) ash::AppListPresenterDelegate::UpdateBounds 0xf48e51a9 (chrome -wm_shelf.cc:258 ) ash::WmShelf::NotifyShelfIconPositionsChanged 0xf4936573 (chrome -shelf_view.cc:1591 ) ash::ShelfView::OnBoundsChanged 0xf43da0a3 (chrome -view.cc:1943 ) views::View::BoundsChanged 0xf43da241 (chrome -view.cc:300 ) views::View::SetBoundsRect 0xf43d3e9d (chrome -fill_layout.cc:20 ) views::FillLayout::Layout 0xf43db091 (chrome -view.cc:532 ) views::View::Layout 0xf48e191b (chrome -shelf_layout_manager.cc:610 ) ash::ShelfLayoutManager::UpdateBoundsAndOpacity 0xf48e21fb (chrome -shelf_layout_manager.cc:177 ) ash::ShelfLayoutManager::LayoutShelfAndUpdateBounds 0xf48e8ff9 (chrome -status_area_layout_manager.cc:62 ) ash::StatusAreaLayoutManager::LayoutStatusArea 0xf41821a5 (chrome -window.cc:312 ) aura::Window::SetBounds 0xf43e4f63 (chrome -native_widget_aura.cc:454 ) views::NativeWidgetAura::SetSize 0xf48e9d01 (chrome -status_area_widget_delegate.cc:203 ) ash::StatusAreaWidgetDelegate::UpdateWidgetSize 0xf48e9d4d (chrome -status_area_widget_delegate.cc:194 ) ash::StatusAreaWidgetDelegate::ChildPreferredSizeChanged 0xf43da6d5 (chrome -view.cc:417 ) views::View::SetVisible 0xf48fc1a1 (chrome -web_notification_tray.cc:609 ) ash::WebNotificationTray::UpdateTrayContent 0xf25e0ddd (chrome -callback.h:64 ) base::debug::TaskAnnotator::RunTask 0xf25d631b (chrome -message_loop.cc:405 ) base::MessageLoop::DoWork 0xf25d6693 (chrome -message_pump_libevent.cc:217 ) base::MessagePumpLibevent::Run 0xf37db301 (chrome -run_loop.cc:35 ) base::RunLoop::Run 0xf358bd93 (chrome -chrome_browser_main.cc:2116 ) ChromeBrowserMainParts::MainMessageLoopRun 0xf2ea03ef (chrome -browser_main_loop.cc:981 ) content::BrowserMainLoop::RunMainMessageLoopParts 0xf2ea18cd (chrome -browser_main_runner.cc:155 ) content::BrowserMainRunnerImpl::Run 0xf2e9d7ef (chrome -browser_main.cc:46 ) content::BrowserMain 0xf3546613 (chrome -content_main_runner.cc:779 ) content::ContentMainRunnerImpl::Run 0xf354571d (chrome -content_main.cc:20 ) content::ContentMain 0xf2775a73 (chrome -chrome_main.cc:97 ) ChromeMain 0xf1934307 (libc-2.19.so -libc-start.c:285 ) __libc_start_main 0xf2775937 (chrome + 0x007a2937 ) _start 0xf6294e4f (chrome -elf-init.c:87 ) __libc_csu_init 0xf1fbc9df (ld-2.19.so + 0x0000b9df ) _dl_sort_fini CC'ing folks who show up in "git blame" in the backtrace.
,
Nov 14 2016
Looks like we just need to check null here, as other places assume it can be null. estade@, can you confirm? https://cs.chromium.org/chromium/src/ui/views/bubble/bubble_dialog_delegate.cc?rcl=1479125882&l=284
,
Nov 14 2016
I dunno. Perhaps AppListPresenterDelegate shouldn't be calling UpdateBounds if the bubble isn't shown? From reading the code, I don't understand how this is happening, because it already checks for view_ and is_visible_.
,
Jan 19 2017
@oshima, could you triage?
,
Feb 21 2017
Found the repro step. * enable fullscreen applist * switch to tablet mode * open app list, and use it for a while. This is because the fullscreen applist uses frameless window, which does not have client view.
,
Feb 22 2017
Actually, this flag looks pretty old (added 2014 by mukai@). tbuckley@, can we just remove this?
,
Feb 22 2017
This feature looks already broken, so I assume we can and should just remove it. I made CL so please assign back to me if you agree. https://codereview.chromium.org/2713603002/
,
Feb 22 2017
I'm fine with removing the flag for fullscreen applist. +omrilio for launcher
,
Feb 28 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/f55eeecd02288e793a19b1f8fab177f3a9925ddb commit f55eeecd02288e793a19b1f8fab177f3a9925ddb Author: oshima <oshima@chromium.org> Date: Tue Feb 28 04:37:35 2017 Remove fullscreen applist This was added 3 years ago as an experiment, but it's broken and causing crash. It's time to clean up. BUG= 664008 Review-Url: https://codereview.chromium.org/2713603002 Cr-Commit-Position: refs/heads/master@{#453496} [modify] https://crrev.com/f55eeecd02288e793a19b1f8fab177f3a9925ddb/ash/app_list/app_list_presenter_delegate.cc [modify] https://crrev.com/f55eeecd02288e793a19b1f8fab177f3a9925ddb/ash/app_list/app_list_presenter_delegate.h [modify] https://crrev.com/f55eeecd02288e793a19b1f8fab177f3a9925ddb/ash/common/ash_switches.cc [modify] https://crrev.com/f55eeecd02288e793a19b1f8fab177f3a9925ddb/ash/common/ash_switches.h [modify] https://crrev.com/f55eeecd02288e793a19b1f8fab177f3a9925ddb/chrome/app/chromeos_strings.grdp [modify] https://crrev.com/f55eeecd02288e793a19b1f8fab177f3a9925ddb/chrome/browser/about_flags.cc [modify] https://crrev.com/f55eeecd02288e793a19b1f8fab177f3a9925ddb/ui/app_list/presenter/BUILD.gn [modify] https://crrev.com/f55eeecd02288e793a19b1f8fab177f3a9925ddb/ui/app_list/presenter/app_list_presenter_impl_unittest.cc [modify] https://crrev.com/f55eeecd02288e793a19b1f8fab177f3a9925ddb/ui/app_list/views/app_list_view.cc [modify] https://crrev.com/f55eeecd02288e793a19b1f8fab177f3a9925ddb/ui/app_list/views/app_list_view.h
,
Feb 28 2017
Please reopen or file new bug if this is still observed in m58 stable.
,
Mar 30 2017
|
|||||||
►
Sign in to add a comment |
|||||||
Comment 1 by abodenha@chromium.org
, Nov 11 2016