New issue
Advanced search Search tips

Issue 732167 link

Starred by 2 users

Issue metadata

Status: Duplicate
Owner: ----
Closed: Jun 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: ----
Type: Bug-Security



Sign in to add a comment

Security: Crash in content::RenderFrameDevToolsAgentHost::GetTitle

Reported by chromium...@gmail.com, Jun 11 2017

Issue description

Chrome Version: Canary 61.0.3127.0
Operating System: Windows 7


Actually this crash happened three times with opening the Devtools.


rax=00000000efb60001 rbx=000000000028a5c0 rcx=000000001d83db60
rdx=000000000028a5c0 rsi=0000000018e559e8 rdi=000000001d772e60
rip=000007feed8c8c07 rsp=000000000028a4a0 rbp=000000000028a519
 r8=0000000000000000  r9=0000000000000000 r10=0000000018d05d70
r11=0000000018d07af0 r12=0000000018e559c8 r13=0000000018e559c0
r14=0000000018e55a28 r15=000000000028a6f0
iopl=0         nv up ei pl nz na pe nc
cs=0033  ss=0000  ds=0000  es=0000  fs=0053  gs=002b             efl=00010202
*** WARNING: Unable to verify checksum for chrome.dll
chrome_7feed420000!content::RenderFrameDevToolsAgentHost::GetTitle+0xc3:
000007fe`ed8c8c07 ff5060          call    qword ptr [rax+60h] ds:00000000`efb60061=????????????????
0:000> k
  *** Stack trace for last set context - .thread/.cxr resets it
Child-SP          RetAddr           Call Site
00000000`0028a4a0 000007fe`ed8bbcaf chrome_7feed420000!content::RenderFrameDevToolsAgentHost::GetTitle+0xc3 [c:\b\c\b\win64_pgo\src\content\browser\devtools\render_frame_devtools_agent_host.cc @ 1035]
00000000`0028a580 000007fe`ed8be547 chrome_7feed420000!content::protocol::`anonymous namespace'::CreateInfo+0xbf [c:\b\c\b\win64_pgo\src\content\browser\devtools\protocol\target_handler.cc @ 87]
00000000`0028a6d0 000007fe`ed895ec5 chrome_7feed420000!content::protocol::TargetHandler::DevToolsAgentHostCreated+0xbf [c:\b\c\b\win64_pgo\src\content\browser\devtools\protocol\target_handler.cc @ 422]
00000000`0028a760 000007fe`ed8bd0a6 chrome_7feed420000!content::DevToolsAgentHost::AddObserver+0x145 [c:\b\c\b\win64_pgo\src\content\browser\devtools\devtools_agent_host_impl.cc @ 311]
00000000`0028a7b0 000007fe`ed7c2034 chrome_7feed420000!content::protocol::TargetHandler::SetDiscoverTargets+0x5e [c:\b\c\b\win64_pgo\src\content\browser\devtools\protocol\target_handler.cc @ 252]
00000000`0028a820 000007fe`ed79dbac chrome_7feed420000!content::protocol::Target::DispatcherImpl::setDiscoverTargets+0x220 [c:\b\c\b\win64_pgo\src\out\release_x64\gen\content\browser\devtools\protocol\target.cc @ 419]
00000000`0028a930 000007fe`ed7b73b1 chrome_7feed420000!content::protocol::DOM::DispatcherImpl::dispatch+0x160 [c:\b\c\b\win64_pgo\src\out\release_x64\gen\content\browser\devtools\protocol\dom.cc @ 123]
00000000`0028aa10 000007fe`ed89e697 chrome_7feed420000!content::protocol::UberDispatcher::dispatch+0x581 [c:\b\c\b\win64_pgo\src\out\release_x64\gen\content\browser\devtools\protocol\protocol.cc @ 837]
00000000`0028ab30 000007fe`ed8c6ef0 chrome_7feed420000!content::DevToolsSession::Dispatch+0x1b3 [c:\b\c\b\win64_pgo\src\content\browser\devtools\devtools_session.cc @ 80]
00000000`0028abe0 000007fe`eed9f525 chrome_7feed420000!content::RenderFrameDevToolsAgentHost::DispatchProtocolMessage+0x54 [c:\b\c\b\win64_pgo\src\content\browser\devtools\render_frame_devtools_agent_host.cc @ 551]
00000000`0028ace0 000007fe`eeda67f0 chrome_7feed420000!DevToolsUIBindings::DispatchProtocolMessageFromDevToolsFrontend+0x1d [c:\b\c\b\win64_pgo\src\chrome\browser\devtools\devtools_ui_bindings.cc @ 1101]
00000000`0028ad10 000007fe`eeda4e8f chrome_7feed420000!`anonymous namespace'::ParseAndHandle<std::basic_string<char,std::char_traits<char>,std::allocator<char> > const & __ptr64>+0x70 [c:\b\c\b\win64_pgo\src\chrome\browser\devtools\devtools_embedder_message_dispatcher.cc @ 90]
00000000`0028ad70 000007fe`eed9c673 chrome_7feed420000!DispatcherImpl::Dispatch+0x83 [c:\b\c\b\win64_pgo\src\chrome\browser\devtools\devtools_embedder_message_dispatcher.cc @ 123]
00000000`0028adc0 000007fe`edba1c84 chrome_7feed420000!DevToolsUIBindings::HandleMessageFromDevToolsFrontend+0x24f [c:\b\c\b\win64_pgo\src\chrome\browser\devtools\devtools_ui_bindings.cc @ 616]
00000000`0028b060 000007fe`edba1acf chrome_7feed420000!IPC::MessageT<DevToolsHostMsg_DispatchOnEmbedder_Meta,std::tuple<std::basic_string<char,std::char_traits<char>,std::allocator<char> > >,void>::Dispatch<content::DevToolsFrontendHostImpl,content::DevToolsFrontendHostImpl,void,void (__cdecl content::DevToolsFrontendHostImpl::*)(std::basic_string<char,std::char_traits<char>,std::allocator<char> > const & __ptr64) __ptr64>+0x154 [c:\b\c\b\win64_pgo\src\ipc\ipc_message_templates.h @ 121]
00000000`0028b180 000007fe`edb43b50 chrome_7feed420000!content::DevToolsFrontendHostImpl::OnMessageReceived+0xe7 [c:\b\c\b\win64_pgo\src\content\browser\devtools\devtools_frontend_host_impl.cc @ 74]
00000000`0028b280 000007fe`ed937fac chrome_7feed420000!content::WebContentsImpl::OnMessageReceived+0x80 [c:\b\c\b\win64_pgo\src\content\browser\web_contents\web_contents_impl.cc @ 795]
00000000`0028c370 000007fe`eda7e48a chrome_7feed420000!content::RenderFrameHostImpl::OnMessageReceived+0x118 [c:\b\c\b\win64_pgo\src\content\browser\frame_host\render_frame_host_impl.cc @ 787]
00000000`0028e5a0 000007fe`ee2df2c4 chrome_7feed420000!content::RenderProcessHostImpl::OnMessageReceived+0x55a [c:\b\c\b\win64_pgo\src\content\browser\renderer_host\render_process_host_impl.cc @ 2486]
00000000`0028e9f0 000007fe`edf98c80 chrome_7feed420000!IPC::ChannelProxy::Context::OnDispatchMessage+0x28 [c:\b\c\b\win64_pgo\src\ipc\ipc_channel_proxy.cc @ 330]

 
Components: Platform>DevTools
Several crashes in this area recently, including Issue 724113 and Issue 722760

Comment 2 by est...@chromium.org, Jun 13 2017

Mergedinto: 732504
Status: Duplicate (was: Unconfirmed)
Thanks for the report. Looks like we already have this crash stack on file.
Project Member

Comment 3 by sheriffbot@chromium.org, Sep 20 2017

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment