Please provide a stack trace for the crash and relevant logs.

Here are (what I hope are) relevant logs. The problem appears to be intermittent-- sometimes I can type my password without issue. I'll try to get a stack trace next time it happens.

Deleted: logs.txt 8.7 KB

logs.txt 8.7 KB View Download

melandory: I believe this crash is caused by your recent changes to password_autofill_manager.cc.

Program received signal SIGSEGV, Segmentation fault.
0x00005ad48374397e in password_manager::PasswordAutofillManager::OnShowManualFallbackSuggestion (this=0x133df0960ca0, 
    text_direction=base::i18n::UNKNOWN_DIRECTION, bounds=...) at components/password_manager/core/browser/password_autofill_manager.cc:315
315       autofill_client_->ShowAutofillPopup(bounds, text_direction, suggestions,
(gdb) bt
#0  0x00005ad48374397e in password_manager::PasswordAutofillManager::OnShowManualFallbackSuggestion (this=0x133df0960ca0, text_direction=base::i18n::UNKNOWN_DIRECTION, bounds=...) at components/password_manager/core/browser/password_autofill_manager.cc:315
#1  0x00005ad47f84c4b4 in password_manager::ContentPasswordManagerDriver::ShowManualFallbackSuggestion (this=0x133df0960c60, text_direction=base::i18n::UNKNOWN_DIRECTION, bounds=...) at components/password_manager/content/browser/content_password_manager_driver.cc:312
#2  0x00005ad47577011a in autofill::mojom::PasswordManagerDriverStubDispatch::Accept (impl=0x133df0960c70, message=0x7ffedfa1d0e8) at gen/components/autofill/content/common/autofill_driver.mojom.cc:1980
#3  0x00005ad47f84ce53 in autofill::mojom::PasswordManagerDriverStub<mojo::RawPtrImplRefTraits<autofill::mojom::PasswordManagerDriver> >::Accept ( this=0x133df0960da8, message=0x7ffedfa1d0e8) at gen/components/autofill/content/common/autofill_driver.mojom.h:389
#4  0x00005ad478cacc12 in mojo::InterfaceEndpointClient::HandleValidatedMessage (this=0x133df2fd9520, message=0x7ffedfa1d0e8) at mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:413
#5  0x00005ad478cac561 in mojo::InterfaceEndpointClient::HandleIncomingMessageThunk::Accept (this=0x133df2fd9550, message=0x7ffedfa1d0e8) at mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:132
#6  0x00005ad478cf04f5 in mojo::FilterChain::Accept (this=0x133df2fd9560, message=0x7ffedfa1d0e8) at mojo/public/cpp/bindings/lib/filter_chain.cc:40 #7  0x00005ad478cae761 in mojo::InterfaceEndpointClient::HandleIncomingMessage (this=0x133df2fd9520, message=0x7ffedfa1d0e8) at ../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:300
#8  0x00005ad478cc26ca in mojo::internal::MultiplexRouter::ProcessIncomingMessage (this=0x133df2c9b020, message=0x7ffedfa1d0e8, client_call_behavior=mojo::internal::MultiplexRouter::ALLOW_DIRECT_CLIENT_CALLS, current_task_runner=0x133def2d4ec0) at mojo/public/cpp/bindings/lib/multiplex_router.cc:884
#9  0x00005ad478cc1ec5 in mojo::internal::MultiplexRouter::Accept (this=0x133df2c9b020, message=0x7ffedfa1d0e8) at mojo/public/cpp/bindings/lib/multiplex_router.cc:614
#10 0x00005ad478cf04f5 in mojo::FilterChain::Accept (this=0x133df2c9b058, message=0x7ffedfa1d0e8) at mojo/public/cpp/bindings/lib/filter_chain.cc:40
#11 0x00005ad478ca9214 in mojo::Connector::ReadSingleMessage (this=0x133df2c9b0a0, read_result=0x7ffedfa1d4f4) at mojo/public/cpp/bindings/lib/connector.cc:440
#12 0x00005ad478caa18a in mojo::Connector::ReadAllAvailableMessages (this=0x133df2c9b0a0) at mojo/public/cpp/bindings/lib/connector.cc:469
#13 0x00005ad478ca9f4e in mojo::Connector::OnHandleReadyInternal (this=0x133df2c9b0a0, result=0) at mojo/public/cpp/bindings/lib/connector.cc:374
#14 0x00005ad478ca9e2b in mojo::Connector::OnWatcherHandleReady (this=0x133df2c9b0a0, result=0) at mojo/public/cpp/bindings/lib/connector.cc:351
#15 0x00005ad4724d0fa4 in base::internal::FunctorTraits<void (ui::DrmThread::*)(int), void>::Invoke<ui::DrmThread*, int const&>(void (ui::DrmThread::*)(int), ui::DrmThread*&&, int const&) (method=(void (ui::DrmThread::*)(ui::DrmThread * const, int)) 0x5ad478ca9e10 <mojo::Connector::OnWatcherHandleReady(unsigned int)>, receiver_ptr=<unknown type in /mnt/ssd2/alemate/src/chromium/src/out_eve/Debug/chrome, CU 0x0, DIE 0x3fbed>, args=@0x7ffedfa1dcf4: 0) at base/bind_internal.h:196
#16 0x00005ad4724d0e96 in base::internal::InvokeHelper<false, void>::MakeItSo<void (ui::DrmThread::* const&)(int), ui::DrmThread*, int const&>(void (ui::DrmThread::* const&)(int), ui::DrmThread*&&, int const&) (functor=@0x133df46e85f0: (void (ui::DrmThread::*)(ui::DrmThread * const, int)) 0x5ad478ca9e10 <mojo::Connector::OnWatcherHandleReady(unsigned int)>, args=@0x7ffedfa1dcf4: 0, args=@0x7ffedfa1dcf4: 0) at base/bind_internal.h:265
#17 0x00005ad478cab964 in base::internal::Invoker<base::internal::BindState<void (mojo::Connector::*)(unsigned int), base::internal::UnretainedWrapper<mojo::Connector> >, void (unsigned int)>::RunImpl<void (mojo::Connector::* const&)(unsigned int), std::tuple<base::internal::UnretainedWrapper<mojo::Connector> > const&, 0ul>(void (mojo::Connector::* const&)(unsigned int), std::tuple<base::internal::UnretainedWrapper<mojo::Connector> > const&, base::IndexSequence<0ul>, unsigned int&&) (functor=@0x133df46e85f0: (void (mojo::Connector::*)(mojo::Connector * const, unsigned int)) 0x5ad478ca9e10 <mojo::Connector::OnWatcherHandleReady(unsigned int)>, bound=std::tuple containing = {...}, unbound_args=<unknown type in /mnt/ssd2/alemate/src/chromium/src/out_eve/Debug/chrome, CU 0x0, DIE 0x12f46>) at base/bind_internal.h:340
#18 0x00005ad478cab88c in base::internal::Invoker<base::internal::BindState<void (mojo::Connector::*)(unsigned int), base::internal::UnretainedWrapper<mojo::Connector> >, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int&&) (base=0x133df46e85d0, unbound_args=<unknown type in /mnt/ssd2/alemate/src/chromium/src/out_eve/Debug/chrome, CU 0x0, DIE 0x12ed4>) at base/bind_internal.h:319
#19 0x00005ad47233c4fb in base::Callback<void (int), (base::internal::CopyMode)1, (base::internal::RepeatMode)1>::Run(int) const & (this=0x133df40de908, args=0) at base/callback.h:80
#20 0x00005ad47336ebff in mojo::SimpleWatcher::DiscardReadyState(base::Callback<void (unsigned int), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, unsigned int, mojo::HandleSignalsState const&) (callback=..., result=0, state=...) at mojo/public/cpp/system/simple_watcher.h:193
#21 0x00005ad47336eed4 in base::internal::FunctorTraits<void (*)(base::Callback<void (unsigned int), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, unsigned int, mojo::HandleSignalsState const&), void>::Invoke<base::Callback<void (unsigned int), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, unsigned int, mojo::HandleSignalsState const&>(void (*)(base::Callback<void (unsigned int), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, unsigned int, mojo::HandleSignalsState const&), base::Callback<void (unsigned int), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, unsigned int&&, mojo::HandleSignalsState const&) (function=0x5ad47336ebe0 <mojo::SimpleWatcher::DiscardReadyState(base::Callback<void (unsigned int), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, unsigned int, mojo::HandleSignalsState const&)>, args=..., args=..., args=...) at base/bind_internal.h:151
#22 0x00005ad47336ee52 in base::internal::InvokeHelper<false, void>::MakeItSo<void (* const&)(base::Callback<void (unsigned int), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, unsigned int, mojo::HandleSignalsState const&), base::Callback<void (unsigned int), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, unsigned int, mojo::HandleSignalsState const&>(void (* const&)(base::Callback<void (unsigned int), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, unsigned int, mojo::HandleSignalsState const&), base::Callback<void (unsigned int), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, unsigned int&&, mojo::HandleSignalsState const&) (functor=@0x133df40de900: 0x5ad47336ebe0 <mojo::SimpleWatcher::DiscardReadyState(base::Callback<void (unsigned int), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, unsigned int, mojo::HandleSignalsState const&)>, args=..., args=..., args=...) at base/bind_internal.h:265
#23 0x00005ad47336eddc in base::internal::Invoker<base::internal::BindState<void (*)(base::Callback<void (unsigned int), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, unsigned int, mojo::HandleSignalsState const&), base::Callback<void (unsigned int), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> >, void (unsigned int, mojo::HandleSignalsState const&)>::RunImpl<void (* const&)(base::Callback<void (unsigned int), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, unsigned int, mojo::HandleSignalsState const&), std::tuple<base::Callback<void (unsigned int), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> > const&, 0ul>(void (* const&)(base::Callback<void (unsigned int), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, unsigned int, mojo::HandleSignalsState const&), std::tuple<base::Callback<void (unsigned int), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> > const&, base::IndexSequence<0ul>, unsigned int&&, mojo::HandleSignalsState const&) (functor=@0x133df40de900: 0x5ad47336ebe0 <mojo::SimpleWatcher::DiscardReadyState(base::Callback<void (unsigned int), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, unsigned int, mojo::HandleSignalsState const&)>, bound=std::tuple containing = {...}, unbound_args=..., unbound_args=...) at base/bind_internal.h:340
#24 0x00005ad47336ecfe in base::internal::Invoker<base::internal::BindState<void (*)(base::Callback<void (unsigned int), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, unsigned int, mojo::HandleSignalsState const&), base::Callback<void (unsigned int), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> >, void (unsigned int, mojo::HandleSignalsState const&)>::Run(base::internal::BindStateBase*, unsigned int&&, mojo::HandleSignalsState const&) (base=0x133df40de8e0, unbound_args=..., unbound_args=...) at base/bind_internal.h:319
#25 0x00005ad47232ca40 in base::Callback<void (google_apis::DriveApiErrorCode, std::string const&), (base::internal::CopyMode)1, (base::internal::RepeatMode)1>::Run(google_apis::DriveApiErrorCode, std::string const&) const & (this=0x7ffedfa1df38, args=<error reading variable: Cannot access memory at address 0x16fffffffb>, args=<error reading variable: Cannot access memory at address 0x16fffffffb>) at base/callback.h:80
#26 0x00005ad478cfa345 in mojo::SimpleWatcher::OnHandleReady (this=0x133defac0620, watch_id=1, result=0, state=...) at mojo/public/cpp/system/simple_watcher.cc:276
#27 0x00005ad47269a1e1 in base::internal::FunctorTraits<void (media::DecryptingAudioDecoder::*)(int, media::Decryptor::Status, std::__debug::list<scoped_refptr<media::AudioBuffer>, std::allocator<scoped_refptr<media::AudioBuffer> > > const&), void>::Invoke<base::WeakPtr<media::DecryptingAudioDecoder> const&, int const&, media::Decryptor::Status, std::__debug::list<scoped_refptr<media::AudioBuffer>, std::allocator<scoped_refptr<media::AudioBuffer> > > const&>(void (media::DecryptingAudioDecoder::*)(int, media::Decryptor::Status, std::__debug::list<scoped_refptr<media::AudioBuffer>, std::allocator<scoped_refptr<media::AudioBuffer> > > const&), base::WeakPtr<media::DecryptingAudioDecoder> const&, int const&, media::Decryptor::Status&&, std::__debug::list<scoped_refptr<media::AudioBuffer>, std::allocator<scoped_refptr<media::AudioBuffer> > > const&) (method=(void (media::DecryptingAudioDecoder::*)(media::DecryptingAudioDecoder * const, int, media::Decryptor::Status, const std::__debug::list<scoped_refptr<media::AudioBuffer>, std::allocator<scoped_refptr<media::AudioBuffer> > > &)) 0x5ad478cfa180 <mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&)>, receiver_ptr=..., args=std::__debug::list<error reading variable: Cannot access memory at address 0x1700000013>, args=std::__debug::list<error reading variable: Cannot access memory at address 0x1700000013>, args=std::__debug::list<error reading variable: Cannot access memory at address 0x1700000013>) at base/bind_internal.h:196
#28 0x00005ad478cfb029 in base::internal::InvokeHelper<true, void>::MakeItSo<void (mojo::SimpleWatcher::* const&)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher> const&, int const&, unsigned int const&, mojo::HandleSignalsState const&> (functor=@0x133df75730d0: (void (mojo::SimpleWatcher::*)(mojo::SimpleWatcher * const, int, unsigned int, const mojo::HandleSignalsState &)) 0x5ad478cfa180 <mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&)>, weak_ptr=..., args=..., args=..., args=...) at base/bind_internal.h:285
#29 0x00005ad478cfaf75 in base::internal::Invoker<base::internal::BindState<void (mojo::SimpleWatcher::*)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState>, void ()>::RunImpl<void (mojo::SimpleWatcher::* const&)(int, unsigned int, mojo::HandleSignalsState const&), std::tuple<base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState> const&, 0ul, 1ul, 2ul, 3ul>(void (mojo::SimpleWatcher::* const&)(int, unsigned int, mojo::HandleSignalsState const&), std::tuple<base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState> const&, base::IndexSequence<0ul, 1ul, 2ul, 3ul>) (functor=@0x133df75730d0: (void (mojo::SimpleWatcher::*)(mojo::SimpleWatcher * const, int, unsigned int, const mojo::HandleSignalsState &)) 0x5ad478cfa180 <mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&)>, bound=std::tuple containing = {...}) at base/bind_internal.h:340
#30 0x00005ad478cfae0c in base::internal::Invoker<base::internal::BindState<void (mojo::SimpleWatcher::*)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState>, void ()>::Run(base::internal::BindStateBase*) (base=0x133df75730b0) at base/bind_internal.h:319
#31 0x00005ad4723f56a9 in base::Callback<void (), (base::internal::CopyMode)0, (base::internal::RepeatMode)0>::Run() && (this=0x7ffedfa1e8a8) at base/callback.h:91
#32 0x00005ad4789edc42 in base::debug::TaskAnnotator::RunTask (this=0x133def2daed0, queue_function=0x5ad4862018d1 "MessageLoop::PostTask", pending_task=0x7ffedfa1e890) at base/debug/task_annotator.cc:59
#33 0x00005ad478a5bb03 in base::MessageLoop::RunTask (this=0x133def2dac20, pending_task=0x7ffedfa1e890) at base/message_loop/message_loop.cc:410
#34 0x00005ad478a5bd97 in base::MessageLoop::DeferOrRunPendingTask (this=0x133def2dac20, pending_task=...) at base/message_loop/message_loop.cc:421
#35 0x00005ad478a5c0ce in base::MessageLoop::DoWork (this=0x133def2dac20) at base/message_loop/message_loop.cc:528
#36 0x00005ad478a6c40e in base::MessagePumpLibevent::Run (this=0x133def3dfe90, delegate=0x133def2dac20) at base/message_loop/message_pump_libevent.cc:220
#37 0x00005ad478a5b2f8 in base::MessageLoop::Run (this=0x133def2dac20) at base/message_loop/message_loop.cc:350
#38 0x00005ad478af211d in base::RunLoop::Run (this=0x7ffedfa1f0a8) at base/run_loop.cc:123
#39 0x00005ad477cd600d in ChromeBrowserMainParts::MainMessageLoopRun (this=0x133def352da0, result_code=0x133def380c38) at chrome/browser/chrome_browser_main.cc:1916
#40 0x00005ad473c68d68 in content::BrowserMainLoop::RunMainMessageLoopParts (this=0x133def380c20) at content/browser/browser_main_loop.cc:1168
#41 0x00005ad473c76106 in content::BrowserMainRunnerImpl::Run (this=0x133def42b8c0) at content/browser/browser_main_runner.cc:146
#42 0x00005ad473c62282 in content::BrowserMain (parameters=...) at content/browser/browser_main.cc:46
#43 0x00005ad477c123d6 in content::RunNamedProcessTypeMain (process_type="", main_function_params=..., delegate=0x7ffedfa20348) at content/app/content_main_runner.cc:408
#44 0x00005ad477c148e8 in content::ContentMainRunnerImpl::Run (this=0x133def2d4260) at content/app/content_main_runner.cc:690
#45 0x00005ad477c111aa in content::ContentServiceManagerMainDelegate::RunEmbedderProcess (this=0x7ffedfa202c0) at content/app/content_service_manager_main_delegate.cc:51
#46 0x00005ad477cc0f7c in service_manager::Main (params=...) at services/service_manager/embedder/main.cc:469
#47 0x00005ad477c11e0f in content::ContentMain (params=...) at content/app/content_main.cc:19
#48 0x00005ad4720e4e0b in ChromeMain (argc=32, argv=0x7ffedfa204f8) at chrome/app/chrome_main.cc:122
#49 0x00005ad4720e4cc2 in main (argc=32, argv=0x7ffedfa204f8) at chrome/app/chrome_exe_main_aura.cc:17
(gdb) 

melandory@chromium.org, are you actively working on a fix for this? This issue has been disruptive to my workflow, so please revert if you're not working on a fix - thank you! :)

I attached the same stack trace as a file.

Deleted: stacktrace.txt 16.1 KB

stacktrace.txt 16.1 KB View Download

ChromeOS signin UI is using Signin prfoile, which is not a real user profile.
This may be the reason the password manager is crashing.
I believe it should be disabled for ephemeral profiles (i.e. for guest). Otherwise you can check for signin profile specifically.

This is P0 as it breaks all Chrome OS team workflow.

melandory@ is OOO right now. Seems like we should revert these 3 CLs on her behalf:

https://chromium-review.googlesource.com/c/595587
https://chromium-review.googlesource.com/c/598231
https://chromium-review.googlesource.com/c/605187

Let me try this locally first.

I was able to reach melandory@ over chat, and she suggested just switching this flag to disabled by default:

https://cs.chromium.org/chromium/src/components/password_manager/core/common/password_manager_features.cc?l=23-26

https://chromium-review.googlesource.com/c/611381 works locally for me.

Let's land it!

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0e29fac6b8debe413834ce98c44b1336e800c205

commit 0e29fac6b8debe413834ce98c44b1336e800c205
Author: Kyle Horimoto <khorimoto@google.com>
Date: Fri Aug 11 01:26:05 2017

Disable kEnableManualFallbacksFilling feature by default.

When this flag was enabled, it caused crashes on the login screen due to
a recent change to password_autofill_manager.cc.

Bug:  754326 
Change-Id: I27f9becead3231c298a2db4abbd29be281f01e15
TBR=melandory@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: I27f9becead3231c298a2db4abbd29be281f01e15
Reviewed-on: https://chromium-review.googlesource.com/611381
Commit-Queue: Kyle Horimoto <khorimoto@chromium.org>
Reviewed-by: Alexander Alekseev <alemate@chromium.org>
Cr-Commit-Position: refs/heads/master@{#493633}
[modify] https://crrev.com/0e29fac6b8debe413834ce98c44b1336e800c205/components/password_manager/core/common/password_manager_features.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ce9412c7f3092fad31ac060a00e52656c2cf66d6

commit ce9412c7f3092fad31ac060a00e52656c2cf66d6
Author: Tatiana Gornak <melandory@chromium.org>
Date: Wed Aug 16 12:54:55 2017

Enable Autofill manual fallbacks for all platforms except CrOs.

BUG= 754326 ,  739343 

Change-Id: Idd7239e4c6b22e4cde958911c1e9b16d3d4f6cb2
Reviewed-on: https://chromium-review.googlesource.com/616760
Reviewed-by: Maxim Kolosovskiy <kolos@chromium.org>
Commit-Queue: Tatiana Gornak <melandory@chromium.org>
Cr-Commit-Position: refs/heads/master@{#494754}
[modify] https://crrev.com/ce9412c7f3092fad31ac060a00e52656c2cf66d6/components/password_manager/core/common/password_manager_features.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/4e9f39bf1866840726bc16045427fdcb5964a1dc

commit 4e9f39bf1866840726bc16045427fdcb5964a1dc
Author: Vasilii Sukhanov <vasilii@chromium.org>
Date: Thu Aug 17 16:20:43 2017

Reenable "Show all passwords" on CrOS.

The CL fixes the crash caused by NULL pointer dereferencing.

Bug:  754326 , 739343 
Change-Id: Ib448b501f00fe1f6b060f5e51ef77e99d7b9e3f0
Reviewed-on: https://chromium-review.googlesource.com/618327
Reviewed-by: Tatiana Gornak <melandory@chromium.org>
Commit-Queue: Vasilii Sukhanov <vasilii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#495187}
[modify] https://crrev.com/4e9f39bf1866840726bc16045427fdcb5964a1dc/components/password_manager/core/browser/password_autofill_manager.cc
[modify] https://crrev.com/4e9f39bf1866840726bc16045427fdcb5964a1dc/components/password_manager/core/browser/password_autofill_manager_unittest.cc
[modify] https://crrev.com/4e9f39bf1866840726bc16045427fdcb5964a1dc/components/password_manager/core/common/password_manager_features.cc