New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 746638 link

Starred by 1 user

Issue metadata

Status: Assigned
Owner:
Out until 24 Jan
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 3
Type: Bug



Sign in to add a comment

PlzNavigate: At DidFinishNavigation time NavigationHandle says net::Error::OK but has no GetRenderFrameHost

Project Member Reported by lukasza@chromium.org, Jul 19 2017

Issue description

nasko@ says that when navigation finishes NavigationHandle should either 1) be in an errored-out or aborted or cancelled state or 2) have an associated target RenderFrameHost.  This assertion is violated in the callstack below:

[22546:22546:0719/133042.337131:FATAL:navigation_handle_impl.cc(306)] Check
failed: state_ >= WILL_PROCESS_RESPONSE (1 vs. 6)This accessor should onl
y be called after a response has been delivered for processing.
...
#7 0x7f1c2824de87 content::WebContentsImpl::DidFinishNavigation()
- At this point navigation_handle->GetNetErrorCode() was returning net::Error::OK
- So - the expectation was that it is safe to call navigation_handle->GetRenderFrameHost()

#8 0x7f1c27f284a2 content::NavigationHandleImpl::~NavigationHandleImpl()
#9 0x7f1c27f28b69 content::NavigationHandleImpl::~NavigationHandleImpl()
#10 0x7f1c27f2ee23 content::NavigationRequest::~NavigationRequest()
#11 0x7f1c27f2ef89 content::NavigationRequest::~NavigationRequest()
#12 0x7f1c27f12c95 content::FrameTreeNode::~FrameTreeNode()
#13 0x7f1c27f1324e content::FrameTreeNode::RemoveChild()
#14 0x7f1c27f10e3a content::FrameTree::RemoveFrame()
...
#16 0x7f1c27f399d4 content::RenderFrameHostImpl::OnMessageReceived()
...
#26 0x000001db866b content::MessageLoopRunner::Run()
#27 0x000001d84ae0 content::RunTaskAndWaitForInterstitialDetach()
#28 0x000001d849ef content::WaitForInterstitialDetach()
#29 0x000001231826
safe_browsing::SafeBrowsingBlockingPageBrowserTest_SecurityStateGoBackOnSubresourceInterstitial_Test::RunTestOnMainThread()
 
Owner: nasko@chromium.org
nasko@, could you please triage (and assign appropriate components - I've had trouble finding a component associated with PlzNavigate)

FWIW, I only could repro this issue with PlzNavigate, but maybe the issue is somewhere else (e.g. in NavigationHandle handling [simulating!?] code in interstitials?).

Comment 2 by creis@chromium.org, Jul 20 2017

Cc: clamy@chromium.org jam@chromium.org creis@chromium.org arthurso...@chromium.org
Components: UI>Browser>Interstitials
Labels: Proj-PlzNavigate OS-All

Comment 3 by clamy@chromium.org, Jul 21 2017

The issue is that the destructor of FrameTreeNode only resets the pointer to the NavigationRequests, which doesn't update the NavigationHandle inside the NavigationRequest. We should either set the error code in the NavigationHandle at that point, or call NavigatorImpl::CancelNavigation. Though this seems to be happening with something involving an interstitial so I'm not sure we do have a NavigatorImpl.
Components: -UI>Browser>Interstitials
Maybe related to issue 766169 ?

Comment 6 by clamy@chromium.org, Dec 4 2017

Maybe though I'm not sure about it. Does your issue involve an interstitial? In any case, I'm planning a big cleanup of NavigationRequest & NavigationHandle once we can drop the support of the old navigation codepath (normally in ~2 weeks), so this should help solve this.
Status: Assigned (was: Untriaged)

Sign in to add a comment