ForceEphemeralProfiles policy causes Chrome to crash on exit
Reported by
dgustaf...@delnorte.k12.ca.us,
Feb 13 2017
|
||||||||||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (Linux; Android 6.0.1; SM-G920V Build/MMB29K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.91 Mobile Safari/537.36 Steps to reproduce the problem: 1. Enforce ForceEphemeralProfiles 2. Run chrome 3. Quit chrome What is the expected behavior? I expect the browser to close quietly without problem. What went wrong? Chrome crashes when you quit. This has been confirmed by many other admins in different organizations. Did this work before? N/A Chrome version: 56 Channel: n/a OS Version: 10.12 Flash Version:
,
Feb 14 2017
I may have labeled this bug with the wrong component. "Enterprise" may not be correct. We would all really like the Ephemeral mode to work.
,
Feb 14 2017
@reporter:Could you please elaborate on point no one in given steps(Enforce ForceEphemeralProfiles)from test team end which would help us to triage the issue further. Thanks in Advance.
,
Feb 14 2017
I am attempting to use an Apple Configuration Profile to enable ForceEphemeralProfiles. I created the profile using Apple Profile Manager. I have included some screen shots to hopefully illustrate the problem.
,
Feb 14 2017
Here is the configuration profile I am attempting to use. This specific profile contains only one chrome policy, so as to not be overly complicated.
,
Feb 14 2017
Thanks for the report. Unfortunately I do not have a profile management setup in Mac. Tried in windows,but cannot set "Force Ephemeral policy" means its not reflected in chrome://policy even though the bit is set. Steps followed =============== 1. Setup a server, Navigated to http://chromium-dm-test.appspot.com/js/app.html 2. Logged in with google.com account 3. Setup Tab-> Enter a name for the server instance(eg:test), SAVE. 4. Exit and launch chrome pointing to the server instance chrome.exe --device-management-url=http://chromium-dm-test.appspot.com/d/test\ 5. User Policy Tab->ForceEphemeralProfiles, set the policy value( Screenshot), Save 6. Exited and relaunch as in step 4. 7. Navigate to chrome://policy ( See attachment) Expected : Policy to be set Observed : Policy NOT set. Looping to Julian, for taking a look and guide me through the repro steps if I missed anything important. Note: This issue is about chrome crashing once the policy is enabled. dgustafson@delnorte.k12.ca.us, It would be great if you can share the crash id from chrome://crashes which helps in tracking us further.
,
Feb 15 2017
Crash ID b36e470e-0c43-480a-9fae-f962f45ad731 THANKS!
,
Feb 15 2017
There has been quite a few changes to the code related to deleting profiles. I guess one of those is causing the issues you observed. It seems like I can repro the issue on my Win box with this policy set so I should be able to investigate further.
,
Feb 15 2017
,
Feb 15 2017
So far I found two debug checks being triggered when this policy is on and when I remove them I hit a use after free but only in debug builds - I will try to do custom build bisect and report here after the I get it done. Here are the two DHECKs I hit so far: [79424:92576:0215/102512.070:FATAL:safe_browsing_service.cc(705)] Check failed: false. Backtrace: base::debug::StackTrace::StackTrace [0x00000000008C4235+69] (c:\src\chromium\src\base\debug\stack_trace_win.cc:217) base::debug::StackTrace::StackTrace [0x00000000008C3C38+24] (c:\src\chromium\src\base\debug\stack_trace.cc:195) logging::LogMessage::~LogMessage [0x000000000092BFA6+70] (c:\src\chromium\src\base\logging.cc:538) safe_browsing::SafeBrowsingService::RemovePrefService [0x0000000004C5BACE+302] (c:\src\chromium\src\chrome\browser\safe_browsing\safe_browsing_service.cc:707) safe_browsing::SafeBrowsingService::Observe [0x0000000004C5A767+711] (c:\src\chromium\src\chrome\browser\safe_browsing\safe_browsing_service.cc:664) content::NotificationServiceImpl::Notify [0x0000000012B30D02+1474] (c:\src\chromium\src\content\browser\notification_service_impl.cc:122) Profile::MaybeSendDestroyedNotification [0x0000000004917A5E+126] (c:\src\chromium\src\chrome\browser\profiles\profile.cc:233) ProfileDestroyer::DestroyProfileWhenAppropriate [0x000000000506B512+370] (c:\src\chromium\src\chrome\browser\profiles\profile_destroyer.cc:39) ProfileManager::ProfileInfo::~ProfileInfo [0x0000000004C2988E+30] (c:\src\chromium\src\chrome\browser\profiles\profile_manager.cc:1611) ProfileManager::ProfileInfo::`scalar deleting destructor' [0x0000000004C2CD47+23] linked_ptr<ProfileManager::ProfileInfo>::depart [0x0000000004C3FA4F+79] (c:\src\chromium\src\base\memory\linked_ptr.h:144) linked_ptr<ProfileManager::ProfileInfo>::~linked_ptr<ProfileManager::ProfileInfo> [0x0000000004C29323+19] (c:\src\chromium\src\base\memory\linked_ptr.h:82) std::pair<base::FilePath const ,linked_ptr<ProfileManager::ProfileInfo> >::~pair<base::FilePath const ,linked_ptr<ProfileManager::ProfileInfo> > [0x0000000004C2938A+26] std::pair<base::FilePath const ,linked_ptr<ProfileManager::ProfileInfo> >::`scalar deleting destructor' [0x0000000004C2CC57+23] std::allocator<std::_Tree_node<std::pair<base::FilePath const ,linked_ptr<ProfileManager::ProfileInfo> >,void * __ptr64> >::destroy<std::pair<base::FilePath const ,linked_ptr<ProfileManager::ProfileInfo> > > [0x0000000004C2600A+26] (c:\src\depot_tools\win_toolchain\vs_files\d3cb0e37bdd120ad0ac4650b674b09e81be45616\vc\include\xmemory0:745) std::allocator_traits<std::allocator<std::_Tree_node<std::pair<base::FilePath const ,linked_ptr<ProfileManager::ProfileInfo> >,void * __ptr64> > >::destroy<std::pair<base::FilePath const ,linked_ptr<ProfileManager::ProfileInfo> > > [0x0000000004C2603D+29] (c:\src\depot_tools\win_toolchain\vs_files\d3cb0e37bdd120ad0ac4650b674b09e81be45616\vc\include\xmemory0:865) std::_Wrap_alloc<std::allocator<std::_Tree_node<std::pair<base::FilePath const ,linked_ptr<ProfileManager::ProfileInfo> >,void * __ptr64> > >::destroy<std::pair<base::FilePath const ,linked_ptr<ProfileManager::ProfileInfo> > > [0x0000000004C25FDD+29] (c:\src\depot_tools\win_toolchain\vs_files\d3cb0e37bdd120ad0ac4650b674b09e81be45616\vc\include\xmemory0:1004) std::_Tree<std::_Tmap_traits<base::FilePath,linked_ptr<ProfileManager::ProfileInfo>,std::less<base::FilePath>,std::allocator<std::pair<base::FilePath const ,linked_ptr<ProfileManager::ProfileInfo> > >,0> >::erase [0x0000000004C415CA+2090] (c:\src\depot_tools\win_toolchain\vs_files\d3cb0e37bdd120ad0ac4650b674b09e81be45616\vc\include\xtree:1434) ProfileManager::OnProfileCreated [0x0000000004C369C4+868] (c:\src\chromium\src\chrome\browser\profiles\profile_manager.cc:1133) ProfileImpl::OnPrefsLoaded [0x0000000005045C98+392] (c:\src\chromium\src\chrome\browser\profiles\profile_impl.cc:874) base::internal::FunctorTraits<void (__cdecl ProfileImpl::*)(enum Profile::CreateMode,bool) __ptr64,void>::Invoke<ProfileImpl * __ptr64,enum Profile::CreateMode const & __ptr64,bool> [0x000000000503DB42+82] (c:\src\chromium\src\base\bind_internal.h:215) base::internal::InvokeHelper<0,void>::MakeItSo<void (__cdecl ProfileImpl::*const & __ptr64)(enum Profile::CreateMode,bool) __ptr64,ProfileImpl * __ptr64,enum Profile::CreateMode const & __ptr64,bool> [0x000000000503DDEF+111] (c:\src\chromium\src\base\bind_internal.h:287) base::internal::Invoker<base::internal::BindState<void (__cdecl ProfileImpl::*)(enum Profile::CreateMode,bool) __ptr64,base::internal::UnretainedWrapper<ProfileImpl>,enum Profile::CreateMode>,void __cdecl(bool)>::RunImpl<void (__cdecl ProfileImpl::*const [0x000000000503E18C+140] (c:\src\chromium\src\base\bind_internal.h:365) base::internal::Invoker<base::internal::BindState<void (__cdecl ProfileImpl::*)(enum Profile::CreateMode,bool) __ptr64,base::internal::UnretainedWrapper<ProfileImpl>,enum Profile::CreateMode>,void __cdecl(bool)>::Run [0x0000000005046662+82] (c:\src\chromium\src\base\bind_internal.h:343) base::internal::RunMixin<base::Callback<void __cdecl(bool),1,1> >::Run [0x00000000107148A0+112] (c:\src\chromium\src\base\callback.h:86) PrefNotifierImpl::OnInitializationCompleted [0x0000000010738550+336] (c:\src\chromium\src\components\prefs\pref_notifier_impl.cc:82) PrefValueStore::CheckInitializationCompleted [0x000000001076AC26+198] (c:\src\chromium\src\components\prefs\pref_value_store.cc:290) PrefValueStore::OnInitializationCompleted [0x000000001076B7C5+101] (c:\src\chromium\src\components\prefs\pref_value_store.cc:273) PrefValueStore::PrefStoreKeeper::OnInitializationCompleted [0x000000001076B749+41] (c:\src\chromium\src\components\prefs\pref_value_store.cc:49) SegregatedPrefStore::AggregatingObserver::OnInitializationCompleted [0x0000000008FED88E+574] (c:\src\chromium\src\components\user_prefs\tracked\segregated_pref_store.cc:48) JsonPrefStore::FinalizeFileRead [0x00000000107114AE+686] (c:\src\chromium\src\components\prefs\json_pref_store.cc:508) base::internal::FunctorTraits<void (__cdecl JsonPrefStore::*)(bool,std::unique_ptr<base::DictionaryValue,std::default_delete<base::DictionaryValue> >,bool) __ptr64,void>::Invoke<base::WeakPtr<JsonPrefStore> const & __ptr64,bool const & __ptr64,std::unique [0x000000001070B2D8+152] (c:\src\chromium\src\base\bind_internal.h:215) base::internal::InvokeHelper<1,void>::MakeItSo<void (__cdecl JsonPrefStore::*const & __ptr64)(bool,std::unique_ptr<base::DictionaryValue,std::default_delete<base::DictionaryValue> >,bool) __ptr64,base::WeakPtr<JsonPrefStore> const & __ptr64,bool const & _ [0x000000001070BD96+198] (c:\src\chromium\src\base\bind_internal.h:308) base::internal::Invoker<base::internal::BindState<void (__cdecl JsonPrefStore::*)(bool,std::unique_ptr<base::DictionaryValue,std::default_delete<base::DictionaryValue> >,bool) __ptr64,base::WeakPtr<JsonPrefStore>,bool>,void __cdecl(std::unique_ptr<base::D [0x000000001070C7BB+171] (c:\src\chromium\src\base\bind_internal.h:365) base::internal::Invoker<base::internal::BindState<void (__cdecl JsonPrefStore::*)(bool,std::unique_ptr<base::DictionaryValue,std::default_delete<base::DictionaryValue> >,bool) __ptr64,base::WeakPtr<JsonPrefStore>,bool>,void __cdecl(std::unique_ptr<base::D [0x0000000010714600+112] (c:\src\chromium\src\base\bind_internal.h:343) base::internal::RunMixin<base::Callback<void __cdecl(std::unique_ptr<base::DictionaryValue,std::default_delete<base::DictionaryValue> >,bool),1,1> >::Run [0x0000000008FE442D+141] (c:\src\chromium\src\base\callback.h:85) PrefHashFilter::FinalizeFilterOnLoad [0x0000000008FE2C2F+1855] (c:\src\chromium\src\components\user_prefs\tracked\pref_hash_filter.cc:265) base::internal::FunctorTraits<void (__cdecl InterceptablePrefFilter::*)(base::Callback<void __cdecl(std::unique_ptr<base::DictionaryValue,std::default_delete<base::DictionaryValue> >,bool),1,1> const & __ptr64,std::unique_ptr<base::DictionaryValue,std::de [0x0000000008FF2A98+152] (c:\src\chromium\src\base\bind_internal.h:215) base::internal::InvokeHelper<1,void>::MakeItSo<void (__cdecl InterceptablePrefFilter::*const & __ptr64)(base::Callback<void __cdecl(std::unique_ptr<base::DictionaryValue,std::default_delete<base::DictionaryValue> >,bool),1,1> const & __ptr64,std::unique_p [0x0000000008FF2C66+198] (c:\src\chromium\src\base\bind_internal.h:308) base::internal::Invoker<base::internal::BindState<void (__cdecl InterceptablePrefFilter::*)(base::Callback<void __cdecl(std::unique_ptr<base::DictionaryValue,std::default_delete<base::DictionaryValue> >,bool),1,1> const & __ptr64,std::unique_ptr<base::Dic [0x0000000008FF2D4B+171] (c:\src\chromium\src\base\bind_internal.h:365) base::internal::Invoker<base::internal::BindState<void (__cdecl InterceptablePrefFilter::*)(base::Callback<void __cdecl(std::unique_ptr<base::DictionaryValue,std::default_delete<base::DictionaryValue> >,bool),1,1> const & __ptr64,std::unique_ptr<base::Dic [0x0000000008FF38C0+112] (c:\src\chromium\src\base\bind_internal.h:343) base::internal::RunMixin<base::Callback<void __cdecl(std::unique_ptr<base::DictionaryValue,std::default_delete<base::DictionaryValue> >,bool),1,1> >::Run [0x0000000008FE442D+141] (c:\src\chromium\src\base\callback.h:85) `anonymous namespace'::TrackedPreferencesMigrator::MigrateIfReady [0x0000000008FF0016+678] (c:\src\chromium\src\components\user_prefs\tracked\tracked_preferences_migration.cc:294) `anonymous namespace'::TrackedPreferencesMigrator::InterceptFilterOnLoad [0x0000000008FEFD33+163] (c:\src\chromium\src\components\user_prefs\tracked\tracked_preferences_migration.cc:253) base::internal::FunctorTraits<void (__cdecl `anonymous namespace'::TrackedPreferencesMigrator::*)(enum A0xdb34d2fc::TrackedPreferencesMigrator::PrefFilterID,base::Callback<void __cdecl(std::unique_ptr<base::DictionaryValue,std::default_delete<base::Dictio [0x0000000008FEEC74+132] (c:\src\chromium\src\base\bind_internal.h:215) base::internal::InvokeHelper<0,void>::MakeItSo<void (__cdecl `anonymous namespace'::TrackedPreferencesMigrator::*const & __ptr64)(enum A0xdb34d2fc::TrackedPreferencesMigrator::PrefFilterID,base::Callback<void __cdecl(std::unique_ptr<base::DictionaryValue, [0x0000000008FEEE1B+139] (c:\src\chromium\src\base\bind_internal.h:287) base::internal::Invoker<base::internal::BindState<void (__cdecl `anonymous namespace'::TrackedPreferencesMigrator::*)(enum A0xdb34d2fc::TrackedPreferencesMigrator::PrefFilterID,base::Callback<void __cdecl(std::unique_ptr<base::DictionaryValue,std::default [0x0000000008FEEF9B+171] (c:\src\chromium\src\base\bind_internal.h:365) base::internal::Invoker<base::internal::BindState<void (__cdecl `anonymous namespace'::TrackedPreferencesMigrator::*)(enum A0xdb34d2fc::TrackedPreferencesMigrator::PrefFilterID,base::Callback<void __cdecl(std::unique_ptr<base::DictionaryValue,std::default [0x0000000008FF07D0+112] (c:\src\chromium\src\base\bind_internal.h:343) base::internal::RunMixin<base::Callback<void __cdecl(base::Callback<void __cdecl(std::unique_ptr<base::DictionaryValue,std::default_delete<base::DictionaryValue> >,bool),1,1> const & __ptr64,std::unique_ptr<base::DictionaryValue,std::default_delete<base:: [0x0000000008FF397D+141] (c:\src\chromium\src\base\callback.h:85) InterceptablePrefFilter::FilterOnLoad [0x0000000008FF36B0+304] (c:\src\chromium\src\components\user_prefs\tracked\interceptable_pref_filter.cc:33) JsonPrefStore::OnFileRead [0x000000001071281B+1179] (c:\src\chromium\src\components\prefs\json_pref_store.cc:451) base::internal::FunctorTraits<void (__cdecl JsonPrefStore::*)(std::unique_ptr<JsonPrefStore::ReadResult,std::default_delete<JsonPrefStore::ReadResult> >) __ptr64,void>::Invoke<base::WeakPtr<JsonPrefStore> const & __ptr64,std::unique_ptr<JsonPrefStore::Rea [0x000000001070B371+97] (c:\src\chromium\src\base\bind_internal.h:215) base::internal::InvokeHelper<1,void>::MakeItSo<void (__cdecl JsonPrefStore::*const & __ptr64)(std::unique_ptr<JsonPrefStore::ReadResult,std::default_delete<JsonPrefStore::ReadResult> >) __ptr64,base::WeakPtr<JsonPrefStore> const & __ptr64,std::unique_ptr< [0x000000001070BBEC+124] (c:\src\chromium\src\base\bind_internal.h:308) base::internal::Invoker<base::internal::BindState<void (__cdecl JsonPrefStore::*)(std::unique_ptr<JsonPrefStore::ReadResult,std::default_delete<JsonPrefStore::ReadResult> >) __ptr64,base::WeakPtr<JsonPrefStore> >,void __cdecl(std::unique_ptr<JsonPrefStore [0x000000001070C658+104] (c:\src\chromium\src\base\bind_internal.h:365) base::internal::Invoker<base::internal::BindState<void (__cdecl JsonPrefStore::*)(std::unique_ptr<JsonPrefStore::ReadResult,std::default_delete<JsonPrefStore::ReadResult> >) __ptr64,base::WeakPtr<JsonPrefStore> >,void __cdecl(std::unique_ptr<JsonPrefStore [0x0000000010714502+82] (c:\src\chromium\src\base\bind_internal.h:343) base::internal::RunMixin<base::Callback<void __cdecl(std::unique_ptr<JsonPrefStore::ReadResult,std::default_delete<JsonPrefStore::ReadResult> >),1,1> >::Run [0x0000000010714791+113] (c:\src\chromium\src\base\callback.h:85) base::internal::ReplyAdapter<std::unique_ptr<JsonPrefStore::ReadResult,std::default_delete<JsonPrefStore::ReadResult> >,std::unique_ptr<JsonPrefStore::ReadResult,std::default_delete<JsonPrefStore::ReadResult> > > [0x000000001070C2A0+64] (c:\src\chromium\src\base\post_task_and_reply_with_result_internal.h:29) base::internal::FunctorTraits<void (__cdecl*)(base::Callback<void __cdecl(std::unique_ptr<JsonPrefStore::ReadResult,std::default_delete<JsonPrefStore::ReadResult> >),1,1> const & __ptr64,std::unique_ptr<JsonPrefStore::ReadResult,std::default_delete<JsonPr [0x000000001070B04B+59] (c:\src\chromium\src\base\bind_internal.h:165) base::internal::InvokeHelper<0,void>::MakeItSo<void (__cdecl*const & __ptr64)(base::Callback<void __cdecl(std::unique_ptr<JsonPrefStore::ReadResult,std::default_delete<JsonPrefStore::ReadResult> >),1,1> const & __ptr64,std::unique_ptr<JsonPrefStore::ReadR [0x000000001070BA93+83] (c:\src\chromium\src\base\bind_internal.h:287) base::internal::Invoker<base::internal::BindState<void (__cdecl*)(base::Callback<void __cdecl(std::unique_ptr<JsonPrefStore::ReadResult,std::default_delete<JsonPrefStore::ReadResult> >),1,1> const & __ptr64,std::unique_ptr<JsonPrefStore::ReadResult,std::d [0x000000001070C4D0+112] (c:\src\chromium\src\base\bind_internal.h:365) base::internal::Invoker<base::internal::BindState<void (__cdecl*)(base::Callback<void __cdecl(std::unique_ptr<JsonPrefStore::ReadResult,std::default_delete<JsonPrefStore::ReadResult> >),1,1> const & __ptr64,std::unique_ptr<JsonPrefStore::ReadResult,std::d [0x0000000010714423+51] (c:\src\chromium\src\base\bind_internal.h:343) base::internal::RunMixin<base::Callback<void __cdecl(void),1,1> >::Run [0x0000000000856614+84] (c:\src\chromium\src\base\callback.h:86) and once this is commented out the next one is: [2176:52812:0215/104825.017:FATAL:profile_manager.cc(1710)] Check failed: status != Profile::CREATE_STATUS_LOCAL_FAIL && status != Profile::CREATE_STATUS_REMOTE_FAIL. Backtrace: base::debug::StackTrace::StackTrace [0x0000000000864235+69] (c:\src\chromium\src\base\debug\stack_trace_win.cc:217) base::debug::StackTrace::StackTrace [0x0000000000863C38+24] (c:\src\chromium\src\base\debug\stack_trace.cc:195) logging::LogMessage::~LogMessage [0x00000000008CBFA6+70] (c:\src\chromium\src\base\logging.cc:538) ProfileManager::OnNewActiveProfileLoaded [0x0000000004D3655E+174] (c:\src\chromium\src\chrome\browser\profiles\profile_manager.cc:1713) base::internal::FunctorTraits<void (__cdecl ProfileManager::*)(base::FilePath const & __ptr64,base::FilePath const & __ptr64,base::Callback<void __cdecl(Profile * __ptr64,enum Profile::CreateStatus),1,1> const & __ptr64,Profile * __ptr64,enum Profile::Cre [0x0000000004D1D730+192] (c:\src\chromium\src\base\bind_internal.h:215) base::internal::InvokeHelper<0,void>::MakeItSo<void (__cdecl ProfileManager::*const & __ptr64)(base::FilePath const & __ptr64,base::FilePath const & __ptr64,base::Callback<void __cdecl(Profile * __ptr64,enum Profile::CreateStatus),1,1> const & __ptr64,Pro [0x0000000004D1DE78+232] (c:\src\chromium\src\base\bind_internal.h:287) base::internal::Invoker<base::internal::BindState<void (__cdecl ProfileManager::*)(base::FilePath const & __ptr64,base::FilePath const & __ptr64,base::Callback<void __cdecl(Profile * __ptr64,enum Profile::CreateStatus),1,1> const & __ptr64,Profile * __ptr [0x0000000004D1E34C+268] (c:\src\chromium\src\base\bind_internal.h:365) base::internal::Invoker<base::internal::BindState<void (__cdecl ProfileManager::*)(base::FilePath const & __ptr64,base::FilePath const & __ptr64,base::Callback<void __cdecl(Profile * __ptr64,enum Profile::CreateStatus),1,1> const & __ptr64,Profile * __ptr [0x0000000004D38530+112] (c:\src\chromium\src\base\bind_internal.h:343) base::internal::RunMixin<base::Callback<void __cdecl(Profile * __ptr64,enum Profile::CreateStatus),1,1> >::Run [0x0000000004D3868D+141] (c:\src\chromium\src\base\callback.h:86) ProfileManager::RunCallbacks [0x0000000004D38726+102] (c:\src\chromium\src\chrome\browser\profiles\profile_manager.cc:1599) ProfileManager::OnProfileCreated [0x0000000004D36AAF+1103] (c:\src\chromium\src\chrome\browser\profiles\profile_manager.cc:1151) ProfileImpl::OnPrefsLoaded [0x0000000005145C98+392] (c:\src\chromium\src\chrome\browser\profiles\profile_impl.cc:874) base::internal::FunctorTraits<void (__cdecl ProfileImpl::*)(enum Profile::CreateMode,bool) __ptr64,void>::Invoke<ProfileImpl * __ptr64,enum Profile::CreateMode const & __ptr64,bool> [0x000000000513DB42+82] (c:\src\chromium\src\base\bind_internal.h:215) base::internal::InvokeHelper<0,void>::MakeItSo<void (__cdecl ProfileImpl::*const & __ptr64)(enum Profile::CreateMode,bool) __ptr64,ProfileImpl * __ptr64,enum Profile::CreateMode const & __ptr64,bool> [0x000000000513DDEF+111] (c:\src\chromium\src\base\bind_internal.h:287) base::internal::Invoker<base::internal::BindState<void (__cdecl ProfileImpl::*)(enum Profile::CreateMode,bool) __ptr64,base::internal::UnretainedWrapper<ProfileImpl>,enum Profile::CreateMode>,void __cdecl(bool)>::RunImpl<void (__cdecl ProfileImpl::*const [0x000000000513E18C+140] (c:\src\chromium\src\base\bind_internal.h:365) base::internal::Invoker<base::internal::BindState<void (__cdecl ProfileImpl::*)(enum Profile::CreateMode,bool) __ptr64,base::internal::UnretainedWrapper<ProfileImpl>,enum Profile::CreateMode>,void __cdecl(bool)>::Run [0x0000000005146662+82] (c:\src\chromium\src\base\bind_internal.h:343) base::internal::RunMixin<base::Callback<void __cdecl(bool),1,1> >::Run [0x00000000108148A0+112] (c:\src\chromium\src\base\callback.h:86) PrefNotifierImpl::OnInitializationCompleted [0x0000000010838550+336] (c:\src\chromium\src\components\prefs\pref_notifier_impl.cc:82) PrefValueStore::CheckInitializationCompleted [0x000000001086AC26+198] (c:\src\chromium\src\components\prefs\pref_value_store.cc:290) PrefValueStore::OnInitializationCompleted [0x000000001086B7C5+101] (c:\src\chromium\src\components\prefs\pref_value_store.cc:273) PrefValueStore::PrefStoreKeeper::OnInitializationCompleted [0x000000001086B749+41] (c:\src\chromium\src\components\prefs\pref_value_store.cc:49) SegregatedPrefStore::AggregatingObserver::OnInitializationCompleted [0x00000000090ED88E+574] (c:\src\chromium\src\components\user_prefs\tracked\segregated_pref_store.cc:48) JsonPrefStore::FinalizeFileRead [0x00000000108114AE+686] (c:\src\chromium\src\components\prefs\json_pref_store.cc:508) base::internal::FunctorTraits<void (__cdecl JsonPrefStore::*)(bool,std::unique_ptr<base::DictionaryValue,std::default_delete<base::DictionaryValue> >,bool) __ptr64,void>::Invoke<base::WeakPtr<JsonPrefStore> const & __ptr64,bool const & __ptr64,std::unique [0x000000001080B2D8+152] (c:\src\chromium\src\base\bind_internal.h:215) base::internal::InvokeHelper<1,void>::MakeItSo<void (__cdecl JsonPrefStore::*const & __ptr64)(bool,std::unique_ptr<base::DictionaryValue,std::default_delete<base::DictionaryValue> >,bool) __ptr64,base::WeakPtr<JsonPrefStore> const & __ptr64,bool const & _ [0x000000001080BD96+198] (c:\src\chromium\src\base\bind_internal.h:308) base::internal::Invoker<base::internal::BindState<void (__cdecl JsonPrefStore::*)(bool,std::unique_ptr<base::DictionaryValue,std::default_delete<base::DictionaryValue> >,bool) __ptr64,base::WeakPtr<JsonPrefStore>,bool>,void __cdecl(std::unique_ptr<base::D [0x000000001080C7BB+171] (c:\src\chromium\src\base\bind_internal.h:365) base::internal::Invoker<base::internal::BindState<void (__cdecl JsonPrefStore::*)(bool,std::unique_ptr<base::DictionaryValue,std::default_delete<base::DictionaryValue> >,bool) __ptr64,base::WeakPtr<JsonPrefStore>,bool>,void __cdecl(std::unique_ptr<base::D [0x0000000010814600+112] (c:\src\chromium\src\base\bind_internal.h:343) base::internal::RunMixin<base::Callback<void __cdecl(std::unique_ptr<base::DictionaryValue,std::default_delete<base::DictionaryValue> >,bool),1,1> >::Run [0x00000000090E442D+141] (c:\src\chromium\src\base\callback.h:85) PrefHashFilter::FinalizeFilterOnLoad [0x00000000090E2C2F+1855] (c:\src\chromium\src\components\user_prefs\tracked\pref_hash_filter.cc:265) base::internal::FunctorTraits<void (__cdecl InterceptablePrefFilter::*)(base::Callback<void __cdecl(std::unique_ptr<base::DictionaryValue,std::default_delete<base::DictionaryValue> >,bool),1,1> const & __ptr64,std::unique_ptr<base::DictionaryValue,std::de [0x00000000090F2A98+152] (c:\src\chromium\src\base\bind_internal.h:215) base::internal::InvokeHelper<1,void>::MakeItSo<void (__cdecl InterceptablePrefFilter::*const & __ptr64)(base::Callback<void __cdecl(std::unique_ptr<base::DictionaryValue,std::default_delete<base::DictionaryValue> >,bool),1,1> const & __ptr64,std::unique_p [0x00000000090F2C66+198] (c:\src\chromium\src\base\bind_internal.h:308) base::internal::Invoker<base::internal::BindState<void (__cdecl InterceptablePrefFilter::*)(base::Callback<void __cdecl(std::unique_ptr<base::DictionaryValue,std::default_delete<base::DictionaryValue> >,bool),1,1> const & __ptr64,std::unique_ptr<base::Dic [0x00000000090F2D4B+171] (c:\src\chromium\src\base\bind_internal.h:365) base::internal::Invoker<base::internal::BindState<void (__cdecl InterceptablePrefFilter::*)(base::Callback<void __cdecl(std::unique_ptr<base::DictionaryValue,std::default_delete<base::DictionaryValue> >,bool),1,1> const & __ptr64,std::unique_ptr<base::Dic [0x00000000090F38C0+112] (c:\src\chromium\src\base\bind_internal.h:343) base::internal::RunMixin<base::Callback<void __cdecl(std::unique_ptr<base::DictionaryValue,std::default_delete<base::DictionaryValue> >,bool),1,1> >::Run [0x00000000090E442D+141] (c:\src\chromium\src\base\callback.h:85) `anonymous namespace'::TrackedPreferencesMigrator::MigrateIfReady [0x00000000090F0016+678] (c:\src\chromium\src\components\user_prefs\tracked\tracked_preferences_migration.cc:294) `anonymous namespace'::TrackedPreferencesMigrator::InterceptFilterOnLoad [0x00000000090EFD33+163] (c:\src\chromium\src\components\user_prefs\tracked\tracked_preferences_migration.cc:253) base::internal::FunctorTraits<void (__cdecl `anonymous namespace'::TrackedPreferencesMigrator::*)(enum A0xdb34d2fc::TrackedPreferencesMigrator::PrefFilterID,base::Callback<void __cdecl(std::unique_ptr<base::DictionaryValue,std::default_delete<base::Dictio [0x00000000090EEC74+132] (c:\src\chromium\src\base\bind_internal.h:215) base::internal::InvokeHelper<0,void>::MakeItSo<void (__cdecl `anonymous namespace'::TrackedPreferencesMigrator::*const & __ptr64)(enum A0xdb34d2fc::TrackedPreferencesMigrator::PrefFilterID,base::Callback<void __cdecl(std::unique_ptr<base::DictionaryValue, [0x00000000090EEE1B+139] (c:\src\chromium\src\base\bind_internal.h:287) base::internal::Invoker<base::internal::BindState<void (__cdecl `anonymous namespace'::TrackedPreferencesMigrator::*)(enum A0xdb34d2fc::TrackedPreferencesMigrator::PrefFilterID,base::Callback<void __cdecl(std::unique_ptr<base::DictionaryValue,std::default [0x00000000090EEF9B+171] (c:\src\chromium\src\base\bind_internal.h:365) base::internal::Invoker<base::internal::BindState<void (__cdecl `anonymous namespace'::TrackedPreferencesMigrator::*)(enum A0xdb34d2fc::TrackedPreferencesMigrator::PrefFilterID,base::Callback<void __cdecl(std::unique_ptr<base::DictionaryValue,std::default [0x00000000090F07D0+112] (c:\src\chromium\src\base\bind_internal.h:343) base::internal::RunMixin<base::Callback<void __cdecl(base::Callback<void __cdecl(std::unique_ptr<base::DictionaryValue,std::default_delete<base::DictionaryValue> >,bool),1,1> const & __ptr64,std::unique_ptr<base::DictionaryValue,std::default_delete<base:: [0x00000000090F397D+141] (c:\src\chromium\src\base\callback.h:85) InterceptablePrefFilter::FilterOnLoad [0x00000000090F36B0+304] (c:\src\chromium\src\components\user_prefs\tracked\interceptable_pref_filter.cc:33) JsonPrefStore::OnFileRead [0x000000001081281B+1179] (c:\src\chromium\src\components\prefs\json_pref_store.cc:451) base::internal::FunctorTraits<void (__cdecl JsonPrefStore::*)(std::unique_ptr<JsonPrefStore::ReadResult,std::default_delete<JsonPrefStore::ReadResult> >) __ptr64,void>::Invoke<base::WeakPtr<JsonPrefStore> const & __ptr64,std::unique_ptr<JsonPrefStore::Rea [0x000000001080B371+97] (c:\src\chromium\src\base\bind_internal.h:215) base::internal::InvokeHelper<1,void>::MakeItSo<void (__cdecl JsonPrefStore::*const & __ptr64)(std::unique_ptr<JsonPrefStore::ReadResult,std::default_delete<JsonPrefStore::ReadResult> >) __ptr64,base::WeakPtr<JsonPrefStore> const & __ptr64,std::unique_ptr< [0x000000001080BBEC+124] (c:\src\chromium\src\base\bind_internal.h:308) base::internal::Invoker<base::internal::BindState<void (__cdecl JsonPrefStore::*)(std::unique_ptr<JsonPrefStore::ReadResult,std::default_delete<JsonPrefStore::ReadResult> >) __ptr64,base::WeakPtr<JsonPrefStore> >,void __cdecl(std::unique_ptr<JsonPrefStore [0x000000001080C658+104] (c:\src\chromium\src\base\bind_internal.h:365) base::internal::Invoker<base::internal::BindState<void (__cdecl JsonPrefStore::*)(std::unique_ptr<JsonPrefStore::ReadResult,std::default_delete<JsonPrefStore::ReadResult> >) __ptr64,base::WeakPtr<JsonPrefStore> >,void __cdecl(std::unique_ptr<JsonPrefStore [0x0000000010814502+82] (c:\src\chromium\src\base\bind_internal.h:343) base::internal::RunMixin<base::Callback<void __cdecl(std::unique_ptr<JsonPrefStore::ReadResult,std::default_delete<JsonPrefStore::ReadResult> >),1,1> >::Run [0x0000000010814791+113] (c:\src\chromium\src\base\callback.h:85) base::internal::ReplyAdapter<std::unique_ptr<JsonPrefStore::ReadResult,std::default_delete<JsonPrefStore::ReadResult> >,std::unique_ptr<JsonPrefStore::ReadResult,std::default_delete<JsonPrefStore::ReadResult> > > [0x000000001080C2A0+64] (c:\src\chromium\src\base\post_task_and_reply_with_result_internal.h:29) base::internal::FunctorTraits<void (__cdecl*)(base::Callback<void __cdecl(std::unique_ptr<JsonPrefStore::ReadResult,std::default_delete<JsonPrefStore::ReadResult> >),1,1> const & __ptr64,std::unique_ptr<JsonPrefStore::ReadResult,std::default_delete<JsonPr [0x000000001080B04B+59] (c:\src\chromium\src\base\bind_internal.h:165) base::internal::InvokeHelper<0,void>::MakeItSo<void (__cdecl*const & __ptr64)(base::Callback<void __cdecl(std::unique_ptr<JsonPrefStore::ReadResult,std::default_delete<JsonPrefStore::ReadResult> >),1,1> const & __ptr64,std::unique_ptr<JsonPrefStore::ReadR [0x000000001080BA93+83] (c:\src\chromium\src\base\bind_internal.h:287) base::internal::Invoker<base::internal::BindState<void (__cdecl*)(base::Callback<void __cdecl(std::unique_ptr<JsonPrefStore::ReadResult,std::default_delete<JsonPrefStore::ReadResult> >),1,1> const & __ptr64,std::unique_ptr<JsonPrefStore::ReadResult,std::d [0x000000001080C4D0+112] (c:\src\chromium\src\base\bind_internal.h:365) base::internal::Invoker<base::internal::BindState<void (__cdecl*)(base::Callback<void __cdecl(std::unique_ptr<JsonPrefStore::ReadResult,std::default_delete<JsonPrefStore::ReadResult> >),1,1> const & __ptr64,std::unique_ptr<JsonPrefStore::ReadResult,std::d [0x0000000010814423+51] (c:\src\chromium\src\base\bind_internal.h:343) base::internal::RunMixin<base::Callback<void __cdecl(void),1,1> >::Run [0x00000000007F6614+84] (c:\src\chromium\src\base\callback.h:86) base::`anonymous namespace'::PostTaskAndReplyRelay::RunReplyAndSelfDestruct [0x0000000000AAA1F7+199] (c:\src\chromium\src\base\threading\post_task_and_reply_impl.cc:65) base::internal::FunctorTraits<void (__cdecl base::`anonymous namespace'::PostTaskAndReplyRelay::*)(void) __ptr64,void>::Invoke<base::`anonymous namespace'::PostTaskAndReplyRelay * __ptr64> [0x0000000000AA9654+36] (c:\src\chromium\src\base\bind_internal.h:215) base::internal::InvokeHelper<0,void>::MakeItSo<void (__cdecl base::`anonymous namespace'::PostTaskAndReplyRelay::*const & __ptr64)(void) __ptr64,base::A0xf1da55ad::PostTaskAndReplyRelay * __ptr64> [0x0000000000AA96E7+55] (c:\src\chromium\src\base\bind_internal.h:287) base::internal::Invoker<base::internal::BindState<void (__cdecl base::`anonymous namespace'::PostTaskAndReplyRelay::*)(void) __ptr64,base::internal::UnretainedWrapper<base::`anonymous namespace'::PostTaskAndReplyRelay> >,void __cdecl(void)>::RunImpl<void [0x0000000000AA9749+73] (c:\src\chromium\src\base\bind_internal.h:365) base::internal::Invoker<base::internal::BindState<void (__cdecl base::`anonymous namespace'::PostTaskAndReplyRelay::*)(void) __ptr64,base::internal::UnretainedWrapper<base::`anonymous namespace'::PostTaskAndReplyRelay> >,void __cdecl(void)>::Run [0x0000000000AAA113+51] (c:\src\chromium\src\base\bind_internal.h:343) base::internal::RunMixin<base::Callback<void __cdecl(void),0,0> >::Run [0x000000000086C989+89] (c:\src\chromium\src\base\callback.h:68) base::debug::TaskAnnotator::RunTask [0x000000000086CCBA+762] (c:\src\chromium\src\base\debug\task_annotator.cc:61) base::MessageLoop::RunTask [0x000000000091222B+939] (c:\src\chromium\src\base\message_loop\message_loop.cc:424) with both commented out I get a segfault at: https://cs.chromium.org/chromium/src/components/user_prefs/tracked/interceptable_pref_filter.cc?rcl=c6892193c349af49244bc4cd88221b82677d88f2&l=33 which smells like use after free when we are trying to do more init stuff on the profile during shut down.
,
Feb 15 2017
Okay, this looks like an error when reading the preferences. In the second stack trace this manifests as an error when creating the profile, which we DCHECK against (apparently assuming that creating a profile will never fail...). The first stack trace is also quite interesting -- we destroy the profile object on error, but because it hasn't been registered with the SafeBrowsingService yet, we run into the NOTREACHED() when trying to unregister it. That might be a separate issue independent of the crash.
,
Feb 15 2017
The reason is the same as in https://codereview.chromium.org/2516613002/ - browser process shutdown while profile creation in process. We can inject keep_alive object, or use a shortcut to FinishDeletingProfile() which make more sense.
,
Feb 16 2017
Fix is on the way https://codereview.chromium.org/2698683002/
,
Feb 19 2017
That's great! I've never reported an issue like this before. When does a fix typically get rolled out after a bug is confirmed like this? Thanks!
,
Feb 20 2017
58 will contain the fix for sure. I think this is critical enough to get it merged in 57 but I doubt we will get the fix in 56. Once the fix hits the next canary/dev it will be great if you can help us by confirming it fixes your problem so that we can support the request for merge with real world data :) Thanks for reporting this and keep them coming!
,
Feb 24 2017
,
Feb 24 2017
,
Mar 3 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/47cf44bdd2b1242e75a2bb5945a9412c41f4073d commit 47cf44bdd2b1242e75a2bb5945a9412c41f4073d Author: palar <palar@yandex-team.ru> Date: Fri Mar 03 15:36:11 2017 Forced ephemeral profile deletion on browser removal crash fix. Skiped all unnecessary activity actual to profile deletion from UI. All async activity is gone, and race on browser shutdown with it. BUG= 691774 R=anthonyvd@chromium.org, bauerb@chromium.org Review-Url: https://codereview.chromium.org/2698683002 Cr-Commit-Position: refs/heads/master@{#454586} [modify] https://crrev.com/47cf44bdd2b1242e75a2bb5945a9412c41f4073d/chrome/browser/profiles/profile_manager.cc [modify] https://crrev.com/47cf44bdd2b1242e75a2bb5945a9412c41f4073d/chrome/browser/profiles/profile_manager.h [modify] https://crrev.com/47cf44bdd2b1242e75a2bb5945a9412c41f4073d/chrome/browser/profiles/profile_manager_unittest.cc
,
Mar 6 2017
I verified that the crashes are all gone and that ephemeral mode still does what it should.
,
Mar 6 2017
I think this fix deserves to go in 57. The number of people that rely on this feature might not be large but it is a deal-breaker without good workarounds for it.
,
Mar 6 2017
This bug requires manual review: We are only 7 days from stable. Please contact the milestone owner if you have questions. Owners: amineer@(clank), cmasso@(bling), ketakid@(cros), govind@(desktop) For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Mar 6 2017
Thank you pastarmovj@. We are cutting M57 Desktop Stable RC today and we would like to minimize the last minute merges unless it is absolutely critical to take in. This bug already exists on M56 and not a large number of people rely on this feature per comment #20. I'm planning to punt this to M58. Please let me know ASAP if there is any concern here. Thank you.
,
Mar 6 2017
Per discussion with the release managers for 57 revoking the merge request for now due to high risk so close to the stable release.
,
Mar 6 2017
Thank you pastarmovj@. Rejecting merge to M57 based on comment #22 and #23.
,
Mar 6 2017
Pls request a merge to M58.
,
Mar 7 2017
,
Mar 7 2017
Your change meets the bar and is auto-approved for M58. Please go ahead and merge the CL to branch 3029 manually. Please contact milestone owner if you have questions. Owners: amineer@(clank), cmasso@(bling), bhthompson@(cros), govind@(desktop) For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Mar 7 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/332d831ed5de659b31e94cec7a61f49a3d179e26 commit 332d831ed5de659b31e94cec7a61f49a3d179e26 Author: Julian Pastarmov <pastarmovj@chromium.org> Date: Tue Mar 07 16:37:50 2017 Forced ephemeral profile deletion on browser removal crash fix. Skiped all unnecessary activity actual to profile deletion from UI. All async activity is gone, and race on browser shutdown with it. BUG= 691774 R=anthonyvd@chromium.org, bauerb@chromium.org Review-Url: https://codereview.chromium.org/2698683002 Cr-Commit-Position: refs/heads/master@{#454586} (cherry picked from commit 47cf44bdd2b1242e75a2bb5945a9412c41f4073d) Review-Url: https://codereview.chromium.org/2732973007 . Cr-Commit-Position: refs/branch-heads/3029@{#44} Cr-Branched-From: 939b32ee5ba05c396eef3fd992822fcca9a2e262-refs/heads/master@{#454471} [modify] https://crrev.com/332d831ed5de659b31e94cec7a61f49a3d179e26/chrome/browser/profiles/profile_manager.cc [modify] https://crrev.com/332d831ed5de659b31e94cec7a61f49a3d179e26/chrome/browser/profiles/profile_manager.h [modify] https://crrev.com/332d831ed5de659b31e94cec7a61f49a3d179e26/chrome/browser/profiles/profile_manager_unittest.cc |
||||||||||||||||||
►
Sign in to add a comment |
||||||||||||||||||
Comment 1 by ajha@chromium.org
, Feb 14 2017