New issue
Advanced search Search tips

Issue 766264 link

Starred by 1 user

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 1
Type: Bug
Team-Security-UX



Sign in to add a comment

WebViewTest.InterstitialPageDetach crashing on Win7 Tests (dbg) 1

Project Member Reported by kelv...@chromium.org, Sep 18 2017

Issue description

Crash stack:
[ RUN      ] WebViewTests/WebViewTest.InterstitialPageDetach/1
[4860:6984:0918/104401.601:WARNING:chrome_browser_main_win.cc(610)] Command line too long for RegisterApplicationRestart:  --brave-new-test-launcher --cfi-diag=0 --gtest_also_run_disabled_tests --gtest_filter=WebViewTests/WebViewTest.InterstitialPageDetach/1 --single_process --test-launcher-bot-mode --test-launcher-summary-output="e:\b\s\w\ioeizalv\output.json" --user-data-dir="C:\Users\CHROME~2\AppData\Local\Temp\scoped_dir3988_4535\d3988_25742" --disable-offline-auto-reload --use-fake-device-for-media-stream --js-flags=--expose-gc --no-first-run --no-default-browser-check --enable-logging=stderr --safebrowsing-disable-auto-update --disable-default-apps --wm-window-animations-disabled --disable-component-update --test-type=browser --force-color-profile=srgb --disable-zero-browsers-open-for-tests --ipc-connection-timeout=45 --allow-file-access-from-files --dom-automation --log-gpu-control-list-decisions --disable-backgrounding-occluded-windows --disable-gl-drawing-for-tests --override-use-software-gl-for-tests --force-color-profile=srgb --enable-features=GuestViewCrossProcessFrames --disable-features=NetworkPrediction --flag-switches-begin --flag-switches-end --restore-last-session about:blank
[6912:2756:0918/104402.344:ERROR:direct_composition_surface_win.cc(1095)] Failing to detect HDR, couldn't retrieve D3D11 device from ANGLE.
[6912:2756:0918/104402.475:INFO:media_foundation_video_encode_accelerator_win.cc(335)] Windows versions earlier than 8 are not supported.
[4860:6984:0918/104409.851:INFO:CONSOLE(15)] "embedder.loadGuest: 56619", source: chrome-extension://jlblljenefjiiicbdgipagollefdljmi/embedder.js (15)
[4860:6984:0918/104409.854:INFO:CONSOLE(21)] "guestSrcHTTPS: https://localhost:56619/extensions/platform_apps/web_view/interstitial_teardown/https_page.html", source: chrome-extension://jlblljenefjiiicbdgipagollefdljmi/embedder.js (21)
Assertion failed: ptr_ != nullptr, file ../..\base/memory/ref_counted.h, line 547
[5308:5916:0918/104431.731:ERROR:render_process_impl.cc(179)] WebFrame LEAKED 1 TIMES
[4860:6984:0918/104431.586:FATAL:interstitial_page_impl.cc(560)] Check failed: !web_contents_.
Backtrace:
	base::debug::StackTrace::StackTrace [0x100AE797+55]
	base::debug::StackTrace::StackTrace [0x100AE431+17]
	logging::LogMessage::~LogMessage [0x100FFC9E+94]
	content::InterstitialPageImpl::RenderWidgetDeleted [0x156EA75D+109]
	content::RenderWidgetHostImpl::Destroy [0x15E50456+454]
	content::RenderWidgetHostImpl::ShutdownAndDestroyWidget [0x15E5B9AB+235]
	content::RenderViewHostImpl::ShutdownAndDestroy [0x15E34D97+135]
	content::FrameTree::ReleaseRenderViewHostRef [0x156C5E96+470]
	content::RenderFrameHostImpl::~RenderFrameHostImpl [0x1576F35D+877]
	content::RenderFrameHostImpl::`vector deleting destructor' [0x15776840+80]
	std::default_delete<content::RenderFrameHostImpl>::operator() [0x157B652A+42]
	std::unique_ptr<content::RenderFrameHostImpl,std::default_delete<content::RenderFrameHostImpl> >::~unique_ptr<content::RenderFrameHostImpl,std::default_delete<content::RenderFrameHostImpl> > [0x157B4C0B+43]
	content::RenderFrameHostManager::~RenderFrameHostManager [0x157B4DB2+130]
	content::FrameTreeNode::~FrameTreeNode [0x156D096C+428]
	content::FrameTreeNode::`scalar deleting destructor' [0x156C4A4F+15]
	content::FrameTree::~FrameTree [0x156C3788+40]
	content::FrameTree::`scalar deleting destructor' [0x156E833F+15]
	std::default_delete<content::FrameTree>::operator() [0x156E8125+37]
	std::unique_ptr<content::FrameTree,std::default_delete<content::FrameTree> >::reset [0x156EDA7A+58]
	content::InterstitialPageImpl::~InterstitialPageImpl [0x156E7452+82]
	content::InterstitialPageImpl::`vector deleting destructor' [0x156E8290+80]
	content::InterstitialPageImpl::Shutdown [0x156EB319+41]
	??$Invoke@V?$WeakPtr@VInterstitialPageImpl@content@@@base@@$$V@?$FunctorTraits@P8InterstitialPageImpl@content@@AEXXZX@internal@base@@SAXP8InterstitialPageImpl@content@@AEXXZ$$QAV?$WeakPtr@VInterstitialPageImpl@content@@@2@@Z [0x156E4363+19]
	??$MakeItSo@P8InterstitialPageImpl@content@@AEXXZV?$WeakPtr@VInterstitialPageImpl@content@@@base@@$$V@?$InvokeHelper@$00X@internal@base@@SAX$$QAP8InterstitialPageImpl@content@@AEXXZ$$QAV?$WeakPtr@VInterstitialPageImpl@content@@@2@@Z [0x156E4579+57]
	base::internal::Invoker<base::internal::BindState<void (__thiscall content::InterstitialPageImpl::*)(void),base::WeakPtr<content::InterstitialPageImpl> >,void __cdecl(void)>::RunImpl<void (__thiscall content::InterstitialPageImpl::*)(void),std::tuple<base [0x156E4681+129]
	base::internal::Invoker<base::internal::BindState<void (__thiscall content::InterstitialPageImpl::*)(void),base::WeakPtr<content::InterstitialPageImpl> >,void __cdecl(void)>::RunOnce [0x156EA7B6+54]
	base::OnceCallback<void __cdecl(void)>::Run [0x1004A185+53]
	base::debug::TaskAnnotator::RunTask [0x100B39BE+414]
	base::internal::IncomingTaskQueue::RunTask [0x1012A772+146]
	base::MessageLoop::RunTask [0x101342A0+512]
	base::MessageLoop::DeferOrRunPendingTask [0x101328F2+50]
	base::MessageLoop::DoWork [0x10132F66+278]
	base::MessagePumpForUI::HandleWorkMessage [0x1013B19B+59]
	base::MessagePumpForUI::MessageCallback [0x1013B3CB+43]
	base::internal::FunctorTraits<bool (__thiscall base::MessagePumpForUI::*)(unsigned int,unsigned int,long,long *),void>::Invoke<base::MessagePumpForUI *,unsigned int,unsigned int,long,long *> [0x101396B7+71]
	base::internal::InvokeHelper<0,bool>::MakeItSo<bool (__thiscall base::MessagePumpForUI::*const &)(unsigned int,unsigned int,long,long *),base::MessagePumpForUI *,unsigned int,unsigned int,long,long *> [0x10139888+88]
	base::internal::Invoker<base::internal::BindState<bool (__thiscall base::MessagePumpForUI::*)(unsigned int,unsigned int,long,long *),base::internal::UnretainedWrapper<base::MessagePumpForUI> >,bool __cdecl(unsigned int,unsigned int,long,long *)>::RunImpl< [0x1013996D+189]
	base::internal::Invoker<base::internal::BindState<bool (__thiscall base::MessagePumpForUI::*)(unsigned int,unsigned int,long,long *),base::internal::UnretainedWrapper<base::MessagePumpForUI> >,bool __cdecl(unsigned int,unsigned int,long,long *)>::Run [0x1013BD38+88]
	base::RepeatingCallback<bool __cdecl(unsigned int,unsigned int,long,long *)>::Run [0x10397364+84]
	base::win::MessageWindow::WindowProc [0x103974ED+349]
	base::win::WrappedWindowProc<&base::win::MessageWindow::WindowProc> [0x103967F6+86]
	gapfnScSendMessage [0x75C962FA+818]
	GetThreadDesktop [0x75C96D3A+215]
	CharPrevW [0x75C977D3+319]
	DispatchMessageW [0x75C9789A+15]
	DialogBoxIndirectParamW [0x75CBCE0D+522]
	DialogBoxIndirectParamAorW [0x75CBCF6C+264]
	SoftModalMessageBox [0x75CEF808+1879]
	SoftModalMessageBox [0x75CEFAE4+2611]
	MessageBoxTimeoutW [0x75CEFBE7+82]
	MessageBoxExW [0x75CEFDDD+27]
	MessageBoxW [0x75CEFE1F+24]
	set_app_type [0x718E7DC2+6482]
	setmbcp [0x718FB042+1474]
	setmbcp [0x718FAFE8+1384]
	setmbcp [0x718FB0C6+1606]
	setmbcp [0x718FBC30+4528]
	CrtSetReportHookW2 [0x718FC612+114]
	VCrtDbgReportW [0x718FDB86+2438]
	CrtDbgReportW [0x718FC564+52]
	_threadid [0x718E60CC+44]
	_threadid [0x718E6271+465]


Failure log URL:
https://luci-logdog.appspot.com/v/?s=chromium%2Fbb%2Fchromium.win%2FWin7_Tests__dbg__1_%2F63304%2F%2B%2Frecipes%2Fsteps%2Fbrowser_tests%2F0%2Flogs%2FWebViewTests__x2f_WebViewTest.InterstitialPageDetach__x2f_1%2F0



 
Hi lfg@, I assigned the bug to you as you are the author of the test from  https://chromium-review.googlesource.com/c/chromium/src/+/562856.  Feel free to assign to an appropriate owner if necessary.
Labels: Pri-1 Type-Bug
Did this just start happening? If so, have we done a bisect?
Cc: kenrb@chromium.org wjmaclean@chromium.org creis@chromium.org
Note: the first failure I could find for this test on the flakiness dashboard had the following range associated with it:

https://chromium.googlesource.com/chromium/src/+log/681f2330ee8c799b5a3eafc13ed9ebf8080a6841%5E..d9e7ed482c91044a6bce591b56fcdf876b590ef5?pretty=fuller&n=

This include enable PlzNavigate on trunk, in case that's relevant.
Labels: -Sheriff-Chromium
Removing this from sheriff queue.
I took a quick peek at this, but I don't have a Windows machine handy, so I can't observe the crash first-hand.

*** Short term solution - is it worth disable the failing check to avoid bot churn while we sort this out?

If we're hitting the check in InterstitialPageImpl::RenderWidgetDeleted() then it looks like InterstitialPageImpl::Hide() isn't getting called ...

But that's *weird* since the InterstitialPageImpl::ShutDown() is called via a PostNonNestabletask() from within Hide(), see:

https://cs.chromium.org/chromium/src/content/browser/frame_host/interstitial_page_impl.cc?rcl=edb2ce24a97f7624c4783977982a292efe33bb2b&l=291

and the only way that web_contents_ is non-null at the CHECK is if the non-nestable task is operating synchronously (which would mean we've deleted the InterstitialPageImpl* this while its Hide() function is still executing ...)?

Unless there's some sort of memory corruption going on.

Comment 8 by lfg@chromium.org, Sep 22 2017

So far I could not reproduce this on my win10 box. I wonder if there's any way we could get (mini)dumps from the bots.

We could try to speculatively move the posttask to after nulling the web_contents_ in Hide(), if James' theory is correct in c#7 this would fix the issue, but we should still try to understand why this is happening.


Comment 10 by lfg@chromium.org, Nov 3 2017

Cc: -wjmaclean@chromium.org lfg@chromium.org
Owner: wjmaclean@chromium.org
Labels: Hotlist-EnamelAndFriendsFixIt
Labels: -Hotlist-EnamelAndFriendsFixIt

Sign in to add a comment