New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 708468 link

Starred by 9 users

Issue metadata

Status: Fixed
Owner:
Out until 24 Jan
Closed: Apr 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , Mac
Pri: 1
Type: Bug-Regression



Sign in to add a comment

Chrome_Mac: Crash Report - page_load_metrics::PageLoadTracker::UpdateChildFrameMetadata

Project Member Reported by ajha@chromium.org, Apr 5 2017

Issue description

Product name: Chrome_Mac
Magic Signature: page_load_metrics::PageLoadTracker::UpdateChildFrameMetadata

Current link:
https://crash.corp.google.com/browse?q=product.name%3D'Chrome_Mac'%20AND%20product.version%3D'59.0.3063.0'%20AND%20custom_data.ChromeCrashProto.channel%3D'canary'%20AND%20custom_data.ChromeCrashProto.ptype%3D'browser'%20AND%20custom_data.ChromeCrashProto.magic_signature_1.name%3D'page_load_metrics%3A%3APageLoadTracker%3A%3AUpdateChildFrameMetadata'%20AND%20ReportID%3D'0848a29640000000'&ignore_case=false&enable_rewrite=true&omit_field_name=&omit_field_value=&omit_field_opt=%3D#3


Search properties:
product.name: Chrome_Mac
product.version: 59.0.3063.0
custom_data.chromecrashproto.channel: canary
custom_data.chromecrashproto.ptype: browser
custom_data.chromecrashproto.magic_signature_1.name: page_load_metrics::PageLoadTracker::UpdateChildFrameMetadata
reportid: 0848a29640000000

Metadata :
Product Name: Chrome_Mac
Product Version: 59.0.3063.0
Report ID: 0848a29640000000
Report Time: Wed, 05 Apr 2017 09:08:14 GMT
Uptime: 4000 ms
Cumulative Uptime: 0 ms
User Email: 
OS Name: Mac OS X
OS Version: 10.11.5 15F34
CPU Architecture: amd64
CPU Info: family 6 model 69 stepping 1

Stack trace:
============
Thread 0 CRASHED [EXC_BAD_ACCESS / KERN_INVALID_ADDRESS @ 0x00000274 ] MAGIC SIGNATURE THREAD
Stack Quality77%Show frame trust levels
0x000000010bfc4e93	(Google Chrome Framework -page_load_tracker.cc:515 )	page_load_metrics::PageLoadTracker::UpdateChildFrameMetadata(page_load_metrics::PageLoadMetadata const&)
0x000000010bfb76b6	(Google Chrome Framework -ipc_message_templates.h:40 )	bool IPC::MessageT<PageLoadMetricsMsg_TimingUpdated_Meta, std::__1::tuple<page_load_metrics::PageLoadTiming, page_load_metrics::PageLoadMetadata>, void>::Dispatch<page_load_metrics::MetricsWebContentsObserver, page_load_metrics::MetricsWebContentsObserver, content::RenderFrameHost, void (page_load_metrics::MetricsWebContentsObserver::*)(content::RenderFrameHost*, page_load_metrics::PageLoadTiming const&, page_load_metrics::PageLoadMetadata const&)>(IPC::Message const*, page_load_metrics::MetricsWebContentsObserver*, page_load_metrics::MetricsWebContentsObserver*, content::RenderFrameHost*, void (page_load_metrics::MetricsWebContentsObserver::*)(content::RenderFrameHost*, page_load_metrics::PageLoadTiming const&, page_load_metrics::PageLoadMetadata const&))
0x000000010bfb75bc	(Google Chrome Framework -metrics_web_contents_observer.cc:129 )	page_load_metrics::MetricsWebContentsObserver::OnMessageReceived(IPC::Message const&, content::RenderFrameHost*)
0x000000010b079f1c	(Google Chrome Framework -web_contents_impl.cc:738 )	content::WebContentsImpl::OnMessageReceived(content::RenderFrameHostImpl*, IPC::Message const&)
0x000000010ae11c7f	(Google Chrome Framework -render_frame_host_impl.cc:726 )	content::RenderFrameHostImpl::OnMessageReceived(IPC::Message const&)
0x000000010c8d232a	(Google Chrome Framework -ipc_channel_proxy.cc:329 )	IPC::ChannelProxy::Context::OnDispatchMessage(IPC::Message const&)
0x000000010c32ca70	(Google Chrome Framework -callback.h:91 )	base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*)
0x000000010c35261a	(Google Chrome Framework -message_loop.cc:423 )	base::MessageLoop::RunTask(base::PendingTask*)
0x000000010c35296b	(Google Chrome Framework -message_loop.cc:434 )	base::MessageLoop::DeferOrRunPendingTask(base::PendingTask)
0x000000010c352d32	(Google Chrome Framework -message_loop.cc:527 )	base::MessageLoop::DoWork()
0x000000010c3561d9	(Google Chrome Framework -message_pump_mac.mm:420 )	base::MessagePumpCFRunLoopBase::RunWork()
0x000000010c346b49	(Google Chrome Framework + 0x01af1b49 )	base::mac::CallWithEHFrame(void () block_pointer)
0x000000010c355bfe	(Google Chrome Framework -message_pump_mac.mm:396 )	base::MessagePumpCFRunLoopBase::RunWorkSource(void*)
0x00007fff9dfb5880	(CoreFoundation + 0x000aa880 )	__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__
0x00007fff9df94fbb	(CoreFoundation + 0x00089fbb )	__CFRunLoopDoSources0
0x00007fff9df944de	(CoreFoundation + 0x000894de )	__CFRunLoopRun
0x00007fff9df93ed7	(CoreFoundation + 0x00088ed7 )	CFRunLoopRunSpecific
0x00007fff9c996934	(HIToolbox + 0x00030934 )	RunCurrentEventLoopInMode
0x00007fff9c99676e	(HIToolbox + 0x0003076e )	ReceiveNextEventCommon
0x00007fff9c9965ae	(HIToolbox + 0x000305ae )	_BlockUntilNextEventMatchingListInModeWithFilter
0x00007fff96a1ddf5	(AppKit + 0x00048df5 )	_DPSNextEvent
0x00007fff96a1d225	(AppKit + 0x00048225 )	-[NSApplication _nextEventMatchingEventMask:untilDate:inMode:dequeue:]
0x000000010beea7af	(Google Chrome Framework -chrome_browser_application_mac.mm:187 )	__71-[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:]_block_invoke
0x000000010c346b49	(Google Chrome Framework + 0x01af1b49 )	base::mac::CallWithEHFrame(void () block_pointer)
0x000000010beea6f3	(Google Chrome Framework -chrome_browser_application_mac.mm:186 )	-[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:]
0x00007fff96a11d7f	(AppKit + 0x0003cd7f )	-[NSApplication run]
0x000000010c356a1d	(Google Chrome Framework -message_pump_mac.mm:755 )	base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*)
0x000000010c35603b	(Google Chrome Framework -message_pump_mac.mm:292 )	base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*)
0x000000010c374842	(Google Chrome Framework -run_loop.cc:37 )	base::RunLoop::Run()
0x000000010bef04a4	(Google Chrome Framework -chrome_browser_main.cc:1970 )	ChromeBrowserMainParts::MainMessageLoopRun(int*)
0x000000010ad1f473	(Google Chrome Framework -browser_main_loop.cc:1173 )	content::BrowserMainLoop::RunMainMessageLoopParts()
0x000000010ad21d11	(Google Chrome Framework -browser_main_runner.cc:140 )	content::BrowserMainRunnerImpl::Run()
0x000000010ad1b32b	(Google Chrome Framework -browser_main.cc:46 )	content::BrowserMain(content::MainFunctionParams const&)
0x000000010bea60af	(Google Chrome Framework -content_main_runner.cc:729 )	content::ContentMainRunnerImpl::Run()
0x000000010d64f8eb	(Google Chrome Framework -main.cc:179 )	service_manager::Main(service_manager::MainParams const&)
0x000000010bea5693	(Google Chrome Framework -content_main.cc:19 )	content::ContentMain(content::ContentMainParams const&)
0x000000010a857ee6	(Google Chrome Framework -chrome_main.cc:123 )	ChromeMain
0x000000010a5eed99	(Google Chrome Canary + 0x00000d99 )	
0x00007fff897da5ac	(libdyld.dylib + 0x000035ac )	start
0x00007fff897da5ac	(libdyld.dylib + 0x000035ac )	start

Link to the list of the builds:
================================
https://crash.corp.google.com/browse?q=custom_data.ChromeCrashProto.magic_signature_1.name%3D%27page_load_metrics%3A%3APageLoadTracker%3A%3AUpdateChildFrameMetadata%27&ignore_case=false&enable_rewrite=true&omit_field_name=&omit_field_value=&omit_field_opt=%3D

Note:
=====
1. This is #1 browser crash on the latest canary(59.0.3063.0) of Mac live for 3 hours. 26 crashes from 26 clients reported so far and spiking consistently.
2. Windows canary(59.0.3063.0) crash data is not available. Will update the behavior once its available.

Considering below as the changelog:
====================================
https://chromium.googlesource.com/chromium/src/+log/59.0.3062.0..59.0.3063.0?pretty=fuller&n=10000

Suspecting: https://codereview.chromium.org/2795283003 for 'metrics_web_contents_observer.cc' related change.

nasko@: Could you please take a look at these crashes.

Thank you!

 
Though I'm not sure if nasko's change is the cause, I'll go ahead and roll it back for now. We can dig in and figure out what might be going wrong after the rollback lands.

Comment 2 by ajha@chromium.org, Apr 5 2017

Components: Internals>Core
Labels: OS-Windows
Thanks bmcquade@ for an update, crashes are also showing on Windows canary version(59.0.3063.0). 
Labels: -Restrict-View-Google
Issue 708534 has been merged into this issue.

Comment 5 by nasko@chromium.org, Apr 5 2017

Status: Fixed (was: Assigned)
Yeah, my CL caused it. It is a straightforward null pointer dereference, since the method call moved up in the method and above a null check for that pointer :(.

Since that CL was reverted, I'll close this one as fixed.

Comment 6 by nasko@chromium.org, Apr 5 2017

Cc: msrchandra@chromium.org nasko@chromium.org
 Issue 708412  has been merged into this issue.

Comment 7 by nasko@chromium.org, Apr 5 2017

 Issue 708427  has been merged into this issue.

Comment 8 by nasko@chromium.org, Apr 5 2017

 Issue 708438  has been merged into this issue.
nasko@, can you please merge this revert to 3063 branch? I would like to consider Dev RC from the same branch.

PS: You do not need to follow any 'Merge-Approval' process since 3063 is yet to be branched officially.

Thank you!
Project Member

Comment 11 by ClusterFuzz, Apr 5 2017

Labels: OS-Linux

Comment 12 by ajha@chromium.org, Apr 6 2017

Labels: OS-Android

Comment 13 by ajha@chromium.org, Apr 6 2017

 Issue 708822  has been merged into this issue.

Comment 14 by ajha@chromium.org, Apr 6 2017

Labels: TE-Verified-M59 TE-Verified-59.0.3063.4
Windows and Mac canary version with the merged fix(59.0.3063.4) was live for 2 hours without any crash instances. No crashes seen on the latest Windows & Mac canary version(59.0.3064.0) live for 3 and 6 hours respectively.

Based on 2 consecutive available canary crash data on Windows and Mac, this looks to be fixed. Hence adding the verified label.
Issue 708963 has been merged into this issue.
Issue 708722 has been merged into this issue.

Sign in to add a comment