Trying to find repro steps, however it doesnt happen every refresh.

Seems to also occur when I navigate to the site as well.


[133739:133739:0626/194015.028407:INFO:CONSOLE(6)] "SW registered", source: https://www.google.com/_/chrome/newtab?espv=2&ie=UTF-8 (6)
[133739:133768:0626/194016.516967:FATAL:http_cache.cc(599)] Check failed: trans. 
#0 0x7f53354a039b base::debug::StackTrace::StackTrace()
#1 0x7f533549f09c base::debug::StackTrace::StackTrace()
#2 0x7f5335513563 logging::LogMessage::~LogMessage()
#3 0x7f5332e38ca0 net::HttpCache::DoomEntry()
#4 0x7f5332e6800e net::HttpCache::Transaction::DoomPartialEntry()
#5 0x7f5332e6e2d4 net::HttpCache::Transaction::ResetPartialState()
#6 0x7f5332e6e13d net::HttpCache::Transaction::DoRestartPartialRequest()
#7 0x7f5332e67953 net::HttpCache::Transaction::ValidateEntryHeadersAndContinue()
#8 0x7f5332e60d70 net::HttpCache::Transaction::DoCacheQueryDataComplete()
#9 0x7f5332e5931d net::HttpCache::Transaction::DoLoop()
#10 0x7f5332e57f0b net::HttpCache::Transaction::OnIOComplete()
#11 0x7f5332d36c96 _ZN4base8internal13FunctorTraitsIMN10disk_cache11SimpleIndexEFviEvE6InvokeIRKNS_7WeakPtrIS3_EEJiEEEvS5_OT_DpOT0_
#12 0x7f5332e6ffcf _ZN4base8internal12InvokeHelperILb1EvE8MakeItSoIRKMN3net9HttpCache11TransactionEFviERKNS_7WeakPtrIS6_EEJiEEEvOT_OT0_DpOT1_
#13 0x7f5332e6ff47 _ZN4base8internal7InvokerINS0_9BindStateIMN3net9HttpCache11TransactionEFviEJNS_7WeakPtrIS5_EEEEEFviEE7RunImplIRKS7_RKSt5tupleIJS9_EEJLm0EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEEOi
#14 0x7f5332e6fe7c _ZN4base8internal7InvokerINS0_9BindStateIMN3net9HttpCache11TransactionEFviEJNS_7WeakPtrIS5_EEEEEFviEE3RunEPNS0_13BindStateBaseEOi
#15 0x7f5332ae9cb1 _ZNKR4base8CallbackIFviELNS_8internal8CopyModeE1ELNS2_10RepeatModeE1EE3RunEi
#16 0x7f5332d16dde _ZN4base8internal13FunctorTraitsINS_8CallbackIFviELNS0_8CopyModeE1ELNS0_10RepeatModeE1EEEvE6InvokeIRKS6_JRKiEEEvOT_DpOT0_
#17 0x7f5332d16ce2 _ZN4base8internal12InvokeHelperILb0EvE8MakeItSoIRKNS_8CallbackIFviELNS0_8CopyModeE1ELNS0_10RepeatModeE1EEEJRKiEEEvOT_DpOT0_
#18 0x7f5332d16ca2 _ZN4base8internal7InvokerINS0_9BindStateINS_8CallbackIFviELNS0_8CopyModeE1ELNS0_10RepeatModeE1EEEJiEEEFvvEE7RunImplIRKS7_RKSt5tupleIJiEEJLm0EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEE
#19 0x7f5332d16bec _ZN4base8internal7InvokerINS0_9BindStateINS_8CallbackIFviELNS0_8CopyModeE1ELNS0_10RepeatModeE1EEEJiEEEFvvEE3RunEPNS0_13BindStateBaseE
#20 0x7f533545b72e _ZNO4base8CallbackIFvvELNS_8internal8CopyModeE0ELNS2_10RepeatModeE0EE3RunEv
#21 0x7f53354a5ffe base::debug::TaskAnnotator::RunTask()
#22 0x7f533553ceed base::MessageLoop::RunTask()
#23 0x7f533553d177 base::MessageLoop::DeferOrRunPendingTask()
#24 0x7f533553d48f base::MessageLoop::DoWork()
#25 0x7f533555293e base::MessagePumpLibevent::Run()
#26 0x7f533553c8b8 base::MessageLoop::Run()
#27 0x7f53355e67cd base::RunLoop::Run()
#28 0x7f533569dc34 base::Thread::Run()
#29 0x7f532e4c6a66 content::BrowserThreadImpl::IOThreadRun()
#30 0x7f532e4c6d6b content::BrowserThreadImpl::Run()
#31 0x7f533569e49a base::Thread::ThreadMain()
#32 0x7f533567f83a base::(anonymous namespace)::ThreadFunc()
#33 0x7f533592d184 start_thread
#34 0x7f531b4e9bed clone

Received signal 6
#0 0x7f53354a039b base::debug::StackTrace::StackTrace()
#1 0x7f533549f09c base::debug::StackTrace::StackTrace()
#2 0x7f533549feaf base::debug::(anonymous namespace)::StackDumpSignalHandler()
#3 0x7f5335935330 <unknown>
#4 0x7f531b422c37 gsignal
#5 0x7f531b426028 abort
#6 0x7f533549d096 base::debug::(anonymous namespace)::DebugBreak()
#7 0x7f533549d078 base::debug::BreakDebugger()
#8 0x7f53355139e4 logging::LogMessage::~LogMessage()
#9 0x7f5332e38ca0 net::HttpCache::DoomEntry()
#10 0x7f5332e6800e net::HttpCache::Transaction::DoomPartialEntry()
#11 0x7f5332e6e2d4 net::HttpCache::Transaction::ResetPartialState()
#12 0x7f5332e6e13d net::HttpCache::Transaction::DoRestartPartialRequest()
#13 0x7f5332e67953 net::HttpCache::Transaction::ValidateEntryHeadersAndContinue()
#14 0x7f5332e60d70 net::HttpCache::Transaction::DoCacheQueryDataComplete()
#15 0x7f5332e5931d net::HttpCache::Transaction::DoLoop()
#16 0x7f5332e57f0b net::HttpCache::Transaction::OnIOComplete()
#17 0x7f5332d36c96 _ZN4base8internal13FunctorTraitsIMN10disk_cache11SimpleIndexEFviEvE6InvokeIRKNS_7WeakPtrIS3_EEJiEEEvS5_OT_DpOT0_
#18 0x7f5332e6ffcf _ZN4base8internal12InvokeHelperILb1EvE8MakeItSoIRKMN3net9HttpCache11TransactionEFviERKNS_7WeakPtrIS6_EEJiEEEvOT_OT0_DpOT1_
#19 0x7f5332e6ff47 _ZN4base8internal7InvokerINS0_9BindStateIMN3net9HttpCache11TransactionEFviEJNS_7WeakPtrIS5_EEEEEFviEE7RunImplIRKS7_RKSt5tupleIJS9_EEJLm0EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEEOi
#20 0x7f5332e6fe7c _ZN4base8internal7InvokerINS0_9BindStateIMN3net9HttpCache11TransactionEFviEJNS_7WeakPtrIS5_EEEEEFviEE3RunEPNS0_13BindStateBaseEOi
#21 0x7f5332ae9cb1 _ZNKR4base8CallbackIFviELNS_8internal8CopyModeE1ELNS2_10RepeatModeE1EE3RunEi
#22 0x7f5332d16dde _ZN4base8internal13FunctorTraitsINS_8CallbackIFviELNS0_8CopyModeE1ELNS0_10RepeatModeE1EEEvE6InvokeIRKS6_JRKiEEEvOT_DpOT0_
#23 0x7f5332d16ce2 _ZN4base8internal12InvokeHelperILb0EvE8MakeItSoIRKNS_8CallbackIFviELNS0_8CopyModeE1ELNS0_10RepeatModeE1EEEJRKiEEEvOT_DpOT0_
#24 0x7f5332d16ca2 _ZN4base8internal7InvokerINS0_9BindStateINS_8CallbackIFviELNS0_8CopyModeE1ELNS0_10RepeatModeE1EEEJiEEEFvvEE7RunImplIRKS7_RKSt5tupleIJiEEJLm0EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEE
#25 0x7f5332d16bec _ZN4base8internal7InvokerINS0_9BindStateINS_8CallbackIFviELNS0_8CopyModeE1ELNS0_10RepeatModeE1EEEJiEEEFvvEE3RunEPNS0_13BindStateBaseE
#26 0x7f533545b72e _ZNO4base8CallbackIFvvELNS_8internal8CopyModeE0ELNS2_10RepeatModeE0EE3RunEv
#27 0x7f53354a5ffe base::debug::TaskAnnotator::RunTask()
#28 0x7f533553ceed base::MessageLoop::RunTask()
#29 0x7f533553d177 base::MessageLoop::DeferOrRunPendingTask()
#30 0x7f533553d48f base::MessageLoop::DoWork()
#31 0x7f533555293e base::MessagePumpLibevent::Run()
#32 0x7f533553c8b8 base::MessageLoop::Run()
#33 0x7f53355e67cd base::RunLoop::Run()
#34 0x7f533569dc34 base::Thread::Run()
#35 0x7f532e4c6a66 content::BrowserThreadImpl::IOThreadRun()
#36 0x7f532e4c6d6b content::BrowserThreadImpl::Run()
#37 0x7f533569e49a base::Thread::ThreadMain()
#38 0x7f533567f83a base::(anonymous namespace)::ThreadFunc()
#39 0x7f533592d184 start_thread
#40 0x7f531b4e9bed clone
  r8: fffffffffffffed8  r9: fffffffffffffec8 r10: 0000000000000008 r11: 0000000000000202
 r12: 0000000000000000 r13: 0000000000000000 r14: 00007f5302dd19c0 r15: 00007f5302dd1700
  di: 0000000000020a6b  si: 0000000000020a88  bp: 00007f5302dc9f00  bx: 0000000000000000
  dx: 0000000000000006  ax: 0000000000000000  cx: 00007f531b422c37  sp: 00007f5302dc9dc8
  ip: 00007f531b422c37 efl: 0000000000000202 cgf: 0000000000000033 erf: 0000000000000000
 trp: 0000000000000000 msk: 0000000000000000 cr2: 00

Assigning to shivanisha@ as it's likely related to her recent work. Giving this a P1 as this is a CHECK failure.

I was not able to reproduce this crash but I am reasonably sure this is what is happening.
This is a scenario where a partial transaction needs to create a new entry and doom the existing one since it cannot validate itself against the new entry , due to, say , there are no strong validators.

Before parallel validation , the assumption was that since this is the only active transaction associated with the entry, the entry has to be non-doomed at this point.

After parallel validation, its possible that there is a writer and a headers transaction both associated with this entry and one of the writer transaction may have doomed this entry for some reason. 

here's a better explanation of the cause of the crash:
This is a scenario where a partial transaction needs to create a new entry and doom the existing one since it cannot validate itself against the new entry, due to, say, there are no strong validators.

The crash requires a specific race with another transaction for the same entry 
with LOAD_BYPASS_CACHE set due to which the second transaction straight away goes and dooms the entry (DoDoomEntry*) while the first one had opened the entry but not yet reached DoomPartialEntry.

This race is much more likely after the parallel validation CL 
(https://codereview.chromium.org/2721933002) because add to entry is always an 
async operation now.

CL in review: https://codereview.chromium.org/2970133002/

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2b6e7ee275a56e425ce1396a7288a92756872e1d

commit 2b6e7ee275a56e425ce1396a7288a92756872e1d
Author: shivanisha <shivanisha@chromium.org>
Date: Fri Jul 14 20:32:31 2017

DoomPartialEntry should not attempt to doom an already doomed entry.

I was not able to reproduce the crash reported but here is a speculative fix.

This is a scenario where a partial transaction needs to create a new entry and doom
the existing one since it cannot validate itself against the new entry, due to,
say, there are no strong validators.

The crash requires a specific race with another transaction for the same entry
with LOAD_BYPASS_CACHE set due to which the second transaction straight away goes
and dooms the entry (DoDoomEntry*) while the first one had opened the entry but
not yet reached DoomPartialEntry.

This race is much more likely after the parallel validation CL
(https://codereview.chromium.org/2721933002) because add to entry is always an
async operation now.

This CL adds a check that the entry is not already doomed before calling
cache_->DoomEntry in DoomPartialEntry and in one other calling location in
DoSuccessfulSendRequest as it may happen there as well.

BUG= 736993 

Review-Url: https://codereview.chromium.org/2970133002
Cr-Commit-Position: refs/heads/master@{#486869}

[modify] https://crrev.com/2b6e7ee275a56e425ce1396a7288a92756872e1d/net/http/http_cache.h
[modify] https://crrev.com/2b6e7ee275a56e425ce1396a7288a92756872e1d/net/http/http_cache_transaction.cc
[modify] https://crrev.com/2b6e7ee275a56e425ce1396a7288a92756872e1d/net/http/http_cache_unittest.cc
[modify] https://crrev.com/2b6e7ee275a56e425ce1396a7288a92756872e1d/net/http/mock_http_cache.cc
[modify] https://crrev.com/2b6e7ee275a56e425ce1396a7288a92756872e1d/net/http/mock_http_cache.h

Marking this as fixed as per the speculative fix.