New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 752834 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner: ----
Closed: Oct 2017
Cc:
EstimatedDays: ----
NextAction: ----
OS: Android
Pri: 2
Type: Bug



Sign in to add a comment

Render process crash when select multi file

Reported by huangxue...@xiaomi.com, Aug 7 2017

Issue description

Steps to reproduce the problem:
In MIUI 8.5
1. Open Chrome and type data:text/html,<input type="file" multiple="multiple"/> in omnibox
2. Click "Choose Files" in web page and click Gallery
3. Select a picture and click OK

What is the expected behavior?

What went wrong?
The web page display:
Aw, Snap!

Crashed report ID: 

How much crashed? Just one tab

Is it a problem with a plugin? No 

Did this work before? N/A 

Chrome version: 62.0.3176.0  Channel: stable
OS Version: 6.0
Flash Version:
 
Cc: ram...@chromium.org
Labels: triage-te
Labels: Needs-Feedback
Not able to Chrome canary 62.0.3178.0 on following devices;
Nexus 6P/N2G48E
Lenovo A6000/LRX22G
Samsung Galaxy S5/MMB29M

Steps;
1. Entered 'data:text/html,<input type="file" multiple="multiple"/>' in omnibox
2. Select the 'Choose file' button.
3. Selected 5 documents.
Says '5 Files'
No aw, snap was displayed.


Can you specify if this bug is still repro on latest Chrome 
Canary and what device was tested on?

Thanks.

Yes the latest Chrome Canary can reproduce this bug in RedMi 4.
I try submit a patch to fix this, https://chromium-review.googlesource.com/602098 Could you review it please?
Project Member

Comment 4 by sheriffbot@chromium.org, Aug 8 2017

Labels: -Needs-Feedback
Thank you for providing more feedback. Adding requester "ramine@chromium.org" to the cc list and removing "Needs-Feedback" label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 5 by peter@chromium.org, Aug 8 2017

Cc: peter@chromium.org finnur@chromium.org twelling...@chromium.org
crash.png
71.5 KB View Download

Comment 7 by peter@chromium.org, Aug 8 2017

The newest device I could find runs MIUI 8.1.6 (MBFMIDI), doesn't have updates available and doesn't reproduce the problem.

It seems to me like this is an issue in MIUI 8.5, so while I'm willing to accept the fix as it's trivial and has a test, please also make sure that we can remove it at some point in the future.
Issue 753434 has been merged into this issue.

Comment 9 Deleted

Bug is also repro with older Chrome Stable build '54.0.2840.85'

1. Entered 'data:text/html,<input type="file" multiple="multiple"/>' in omnibox
2. Select the 'Choose file' button.
3. Selected 4 photos from Gallery.
4. Refresh Chrome.
Aw, Snap will display.
Project Member

Comment 11 by bugdroid1@chromium.org, Aug 10 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/8d2062165cfe92c72e2b561dd7ebcb2f52b3bd85

commit 8d2062165cfe92c72e2b561dd7ebcb2f52b3bd85
Author: huangxueqing <huangxueqing@xiaomi.com>
Date: Thu Aug 10 14:08:24 2017

Multiple file selector should not pass file scheme uri to render process

In child_process_security_policy_impl.cc:HasPermissionsForFile return false
when file path was not absolute. Which will file bad message by:
RFH_CAN_ACCESS_FILES_OF_PAGE_STATE and Browser will destory render process
for security reason.
The third party App use clipData pass multiple files in Intent will
produce this bug.

R=peter@chromium.org

Bug:  752834 
Change-Id: If8bdda5d6786ba46423831c5df9bfe6c9e1fcf15
Reviewed-on: https://chromium-review.googlesource.com/602098
Reviewed-by: Peter Beverloo <peter@chromium.org>
Commit-Queue: Peter Beverloo <peter@chromium.org>
Cr-Commit-Position: refs/heads/master@{#493377}
[modify] https://crrev.com/8d2062165cfe92c72e2b561dd7ebcb2f52b3bd85/AUTHORS
[modify] https://crrev.com/8d2062165cfe92c72e2b561dd7ebcb2f52b3bd85/ui/android/java/src/org/chromium/ui/base/SelectFileDialog.java
[modify] https://crrev.com/8d2062165cfe92c72e2b561dd7ebcb2f52b3bd85/ui/android/junit/src/org/chromium/ui/base/SelectFileDialogTest.java

Status: Fixed (was: Unconfirmed)

Sign in to add a comment