New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 777802 link

Starred by 3 users
Status: Fixed
Owner:
caseq@chromium.org
Closed: Nov 2017
Cc:
█ krajshree@chromium.org
ajha@chromium.org
█ brajkumar@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Regression



Sign in to add a comment

Regression: Tab crashes when clicked on layers in devtools

Project Member Reported by divya.pa...@techmahindra.com, Oct 24 2017 
Chrome Version: 63.0.3238.0
OS: Ubuntu 14.04

What steps will reproduce the problem?
(1)Launch Chrome
(1)Log into Gmail
(2)Press F12 to Open Dev tools, then click on three dot menu>> go to More tools and click on Layers

Crash ID: 4973661418141fc0

What is the expected result?
Should open the Layers without tab crash

What happens instead?
Tab crashes

NOTE: 
1. Issue is reproducible on latest chrome version 64.0.3248.0
2. As this is inconsistent issue, we are unable to provide the bisect info
3. Issue is not reproducible on Win 7, Win 10 and Mac 10.12.6
Actual_Tab crash.ogv
2.6 MB View Download
Expected_Layers .ogv
2.8 MB View Download

Comment 1 by divya.pa...@techmahindra.com, Oct 24 2017

Status: Untriaged (was: Unconfirmed)

Comment 2 by divya.pa...@techmahindra.com, Oct 24 2017

Description: Show this description
Project Member

Comment 3 by sheriffbot@chromium.org, Oct 26 2017

Labels: FoundIn-M-63 Fracas
Users experienced this crash on the following builds:

Linux Dev 63.0.3239.18 -  22.65 CPM, 6 reports, 1 clients (signature blink::InspectorLayerTreeAgent::BuildLayerIdToNodeIdMap)

If this update was incorrect, please add "Fracas-Wrong" label to prevent future updates.

- Go/Fracas

Comment 4 by ajha@chromium.org, Oct 27 2017

Owner: dgozman@chromium.org
Status: Assigned (was: Untriaged)
Stack trace of the crash id 4973661418141fc0:

Thread 0 (id: 28952) CRASHED [SIGSEGV @ 0x00000098 ] MAGIC SIGNATURE THREAD
Stack Quality85%Show frame trust levels
0x000055eda1cc47b0	(chrome + 0x05a367b0 )	<name omitted>
0x000055eda1f3fa63	(chrome -InspectorLayerTreeAgent.cpp:336 )	blink::InspectorLayerTreeAgent::BuildLayerIdToNodeIdMap(blink::PaintLayer*, WTF::HashMap<int, int, WTF::IntHash<unsigned int>, WTF::HashTraits<int>, WTF::HashTraits<int>, WTF::PartitionAllocator>&)
0x000055eda1f3fa0d	(chrome -InspectorLayerTreeAgent.cpp:331 )	blink::InspectorLayerTreeAgent::BuildLayerIdToNodeIdMap(blink::PaintLayer*, WTF::HashMap<int, int, WTF::IntHash<unsigned int>, WTF::HashTraits<int>, WTF::HashTraits<int>, WTF::PartitionAllocator>&)
0x000055eda1f3fa0d	(chrome -InspectorLayerTreeAgent.cpp:331 )	blink::InspectorLayerTreeAgent::BuildLayerIdToNodeIdMap(blink::PaintLayer*, WTF::HashMap<int, int, WTF::IntHash<unsigned int>, WTF::HashTraits<int>, WTF::HashTraits<int>, WTF::PartitionAllocator>&)
0x000055eda1f3fa8b	(chrome -InspectorLayerTreeAgent.cpp:340 )	blink::InspectorLayerTreeAgent::BuildLayerIdToNodeIdMap(blink::PaintLayer*, WTF::HashMap<int, int, WTF::IntHash<unsigned int>, WTF::HashTraits<int>, WTF::HashTraits<int>, WTF::PartitionAllocator>&)
0x000055eda1f3fa0d	(chrome -InspectorLayerTreeAgent.cpp:331 )	blink::InspectorLayerTreeAgent::BuildLayerIdToNodeIdMap(blink::PaintLayer*, WTF::HashMap<int, int, WTF::IntHash<unsigned int>, WTF::HashTraits<int>, WTF::HashTraits<int>, WTF::PartitionAllocator>&)
0x000055eda1f3fa0d	(chrome -InspectorLayerTreeAgent.cpp:331 )	blink::InspectorLayerTreeAgent::BuildLayerIdToNodeIdMap(blink::PaintLayer*, WTF::HashMap<int, int, WTF::IntHash<unsigned int>, WTF::HashTraits<int>, WTF::HashTraits<int>, WTF::PartitionAllocator>&)
0x000055eda1f3fa8b	(chrome -InspectorLayerTreeAgent.cpp:340 )	blink::InspectorLayerTreeAgent::BuildLayerIdToNodeIdMap(blink::PaintLayer*, WTF::HashMap<int, int, WTF::IntHash<unsigned int>, WTF::HashTraits<int>, WTF::HashTraits<int>, WTF::PartitionAllocator>&)
0x000055eda1f3fa0d	(chrome -InspectorLayerTreeAgent.cpp:331 )	blink::InspectorLayerTreeAgent::BuildLayerIdToNodeIdMap(blink::PaintLayer*, WTF::HashMap<int, int, WTF::IntHash<unsigned int>, WTF::HashTraits<int>, WTF::HashTraits<int>, WTF::PartitionAllocator>&)
0x000055eda1f3fa0d	(chrome -InspectorLayerTreeAgent.cpp:331 )	blink::InspectorLayerTreeAgent::BuildLayerIdToNodeIdMap(blink::PaintLayer*, WTF::HashMap<int, int, WTF::IntHash<unsigned int>, WTF::HashTraits<int>, WTF::HashTraits<int>, WTF::PartitionAllocator>&)
0x000055eda1f3fa0d	(chrome -InspectorLayerTreeAgent.cpp:331 )	blink::InspectorLayerTreeAgent::BuildLayerIdToNodeIdMap(blink::PaintLayer*, WTF::HashMap<int, int, WTF::IntHash<unsigned int>, WTF::HashTraits<int>, WTF::HashTraits<int>, WTF::PartitionAllocator>&)
0x000055eda1f3f6e2	(chrome -InspectorLayerTreeAgent.cpp:301 )	blink::InspectorLayerTreeAgent::BuildLayerTree()
0x000055eda1f3f3fe	(chrome -InspectorLayerTreeAgent.cpp:270 )	blink::InspectorLayerTreeAgent::LayerTreeDidChange()
0x000055eda1f3f56d	(chrome -InspectorLayerTreeAgent.cpp:259 )	non-virtual thunk to blink::InspectorLayerTreeAgent::enable()
0x000055ed9e832584	(chrome -LayerTree.cpp:439 )	blink::protocol::LayerTree::DispatcherImpl::enable(int, std::__1::unique_ptr<blink::protocol::DictionaryValue, std::__1::default_delete<blink::protocol::DictionaryValue> >, blink::protocol::ErrorSupport*)
0x000055ed9e7f7c1a	(chrome -Accessibility.cpp:478 )	blink::protocol::Accessibility::DispatcherImpl::dispatch(int, WTF::String const&, std::__1::unique_ptr<blink::protocol::DictionaryValue, std::__1::default_delete<blink::protocol::DictionaryValue> >)
0x000055ed9e855be9	(chrome -Protocol.cpp:839 )	blink::protocol::UberDispatcher::dispatch(std::__1::unique_ptr<blink::protocol::Value, std::__1::default_delete<blink::protocol::Value> >, int*, WTF::String*)
0x000055eda1f67953	(chrome -InspectorSession.cpp:84 )	blink::InspectorSession::DispatchProtocolMessage(WTF::String const&, WTF::String const&)
0x000055eda1c7025a	(chrome -WebDevToolsAgentImpl.cpp:523 )	blink::WebDevToolsAgentImpl::DispatchMessageFromFrontend(int, WTF::String const&, WTF::String const&)
0x000055eda1c70075	(chrome -WebDevToolsAgentImpl.cpp:510 )	blink::WebDevToolsAgentImpl::DispatchOnInspectorBackend(int, int, blink::WebString const&, blink::WebString const&)
0x000055eda2547a28	(chrome -devtools_agent.cc:268 )	content::DevToolsAgent::OnDispatchOnInspectorBackend(int, int, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&)
0x000055eda25477f0	(chrome -tuple.h:52 )	bool IPC::MessageT<DevToolsAgentMsg_DispatchOnInspectorBackend_Meta, std::__1::tuple<int, int, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, void>::Dispatch<content::DevToolsAgent, content::DevToolsAgent, void, void (content::DevToolsAgent::*)(int, int, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&)>(IPC::Message const*, content::DevToolsAgent*, content::DevToolsAgent*, void*, void (content::DevToolsAgent::*)(int, int, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&))
0x000055eda2546e74	(chrome -devtools_agent.cc:109 )	content::DevToolsAgent::OnMessageReceived(IPC::Message const&)
0x000055eda2503a12	(chrome -render_frame_impl.cc:1610 )	content::RenderFrameImpl::OnMessageReceived(IPC::Message const&)
0x000055ed9f538e08	(chrome -ipc_channel_proxy.cc:320 )	IPC::ChannelProxy::Context::OnDispatchMessage(IPC::Message const&)
0x000055ed9f316cc6	(chrome -callback.h:64 )	base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*)
0x000055ed9ef5c7c4	(chrome -task_queue_manager.cc:530 )	blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue(blink::scheduler::internal::WorkQueue*, bool, blink::scheduler::LazyNow, base::TimeTicks*)
0x000055ed9ef5a7a8	(chrome -task_queue_manager.cc:321 )	blink::scheduler::TaskQueueManager::DoWork(bool)
0x000055ed9f316cc6	(chrome -callback.h:64 )	base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*)
0x000055ed9f32f538	(chrome -message_loop.cc:392 )	base::MessageLoop::RunTask(base::PendingTask*)
0x000055ed9f32fb51	(chrome -message_loop.cc:404 )	base::MessageLoop::DoWork()
0x000055ed9f331d94	(chrome -message_pump_default.cc:37 )	base::MessagePumpDefault::Run(base::MessagePump::Delegate*)
0x000055ed9f350bb4	(chrome -run_loop.cc:118 )	<name omitted>
0x000055eda2a25b15	(chrome -renderer_main.cc:220 )	content::RendererMain(content::MainFunctionParams const&)
0x000055ed9f046b49	(chrome -content_main_runner.cc:357 )	content::RunZygote(content::MainFunctionParams const&, content::ContentMainDelegate*)
0x000055ed9f047e51	(chrome -content_main_runner.cc:707 )	content::ContentMainRunnerImpl::Run()
0x000055ed9f051121	(chrome -main.cc:456 )	service_manager::Main(service_manager::MainParams const&)
0x000055ed9f046811	(chrome -content_main.cc:19 )	content::ContentMain(content::ContentMainParams const&)
0x000055ed9da43a73	(chrome -chrome_main.cc:123 )	ChromeMain
0x00007fd33d60df44	(libc-2.19.so + 0x00021f44 )	
0x000055ed9da439cf	(chrome + 0x017b59cf )	
0x000055ed9d937fff	(chrome + 0x016a9fff )	
0x00007fd3438f93c2	(ld-2.19.so + 0x000103c2 )	
0x000055ed9d937fff	(chrome + 0x016a9fff )	
0x000055ed9d938028	(chrome + 0x016aa028 )	_start
0x00007ffdbed42b57		

Assigning to dgozman@(chromium//src/third_party/WebKit/Source/core/inspector/OWNERS) for further investigation as per the stack trace as the repro seems to be inconsistent.

Comment 5 by dgozman@chromium.org, Oct 27 2017

Owner: alph@chromium.org
Alph, mind taking a look?

Comment 6 by alph@chromium.org, Oct 27 2017

Owner: caseq@chromium.org
Andrey wants to take a look.
Project Member

Comment 7 by bugdroid1@chromium.org, Nov 29 2017 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/bfc6e318151d73f189a4f853d63d82556a2e2f76

commit bfc6e318151d73f189a4f853d63d82556a2e2f76
Author: Andrey Kosyakov <caseq@chromium.org>
Date: Wed Nov 29 02:21:14 2017

DevTools: only traverse local frame hierarchy in layers agent

... when mapping layers to node ids. Other frames are supposed to
be covered by other agents.

Bug:  777802 
Change-Id: I39ef86166c4d8be4f0d2f972291f005b2d0e5a7a
Reviewed-on: https://chromium-review.googlesource.com/792335
Reviewed-by: Alexei Filippov <alph@chromium.org>
Commit-Queue: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#519972}
[add] https://crrev.com/bfc6e318151d73f189a4f853d63d82556a2e2f76/third_party/WebKit/LayoutTests/http/tests/devtools/layers/layer-oopif-expected.txt
[add] https://crrev.com/bfc6e318151d73f189a4f853d63d82556a2e2f76/third_party/WebKit/LayoutTests/http/tests/devtools/layers/layer-oopif.js
[modify] https://crrev.com/bfc6e318151d73f189a4f853d63d82556a2e2f76/third_party/WebKit/Source/core/inspector/InspectorLayerTreeAgent.cpp

Comment 8 by caseq@chromium.org, Nov 29 2017

Status: Fixed (was: Assigned)
►

Sign in to add a comment