New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 796152 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Dec 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: iOS
Pri: 1
Type: Bug-Regression



Sign in to add a comment

App crashes on closing incognito tabs

Project Member Reported by pmadalla@chromium.org, Dec 19 2017

Issue description

App Version: 65.0.3299.0 canary 
iOS Version:10.3.3, 11.0.1
Device : iPhone only

Precondition :
1- Enable flags:  TabSwitcher Presents BVC, Clean Toolbar, Enable the new FullscreenController

Steps to reproduce : 
1. Launch chrome.
2. Tap on Menu > New Incognito tab.
3. Tap on tabswithcer.
4. Tap on (X) to close the incognito tab.

Observed results:
App crashes.

Expected results:
App should not crash

Number of times you were able to reproduce: 5/5
Bug reproducible after clean install: Yes
Bug reproducible after clearing cache and cookies: Yes
Bug reproducible on Chrome Mobile on Android: NA
Bug reproducible on Dolphin/Safari/Firefox: Safari : NA
Bug reproducible on current stable build (App Version, iOS Version): No, New UI implementation in M65
Bug reproducible on the current beta channel build (App Version, iOS Version): No, New UI implementation in M65

Link to video :
https://drive.google.com/file/d/1tAs8XL2i9tl7GkYWgJWJkOXkFzk0d_9A/view?usp=sharing

Crash log:
https://crash.corp.google.com/browse?stbtiq=85a6a8342f9d6648&sql_dialect=googlesql

Stack Trace :
Thread 0 (id: 771) CRASHED [EXC_BAD_ACCESS / KERN_INVALID_ADDRESS @ 0x00000000 ] MAGIC SIGNATURE THREAD
Stack Quality54%Show frame trust levels
0x0000000100ccc0f8	(Chrome -legacy_toolbar_coordinator.mm:80 )	-[LegacyToolbarCoordinator stop]
0x0000000100ccc0f4	(Chrome -legacy_toolbar_coordinator.mm:78 )	-[LegacyToolbarCoordinator stop]
0x00000001010398c4	(Chrome -browser_view_controller.mm:2704 )	-[BrowserViewController shutdown]
0x0000000101185a6c	(Chrome -browser_view_wrangler.mm:111 )	-[BrowserViewWrangler setMainBVC:]
0x0000000101186858	(Chrome -browser_view_wrangler.mm:334 )	-[BrowserViewWrangler shutdown]
0x0000000100aa198c	(Chrome -main_controller.mm:909 )	-[MainController stopChromeMain]
0x0000000100c7b2ec	(Chrome -app_state.mm:417 )	-[AppState applicationWillTerminate:applicationNavigation:]
0x0000000100a9fc64	(Chrome -main_application_delegate.mm:146 )	-[MainApplicationDelegate applicationWillTerminate:]
0x000000018e39eee8	(UIKit + 0x00096ee8 )	
0x000000018e819960	(UIKit + 0x00511960 )	
0x000000018e585b38	(UIKit + 0x0027db38 )	
0x000000018e578eec	(UIKit + 0x00270eec )	
0x000000018e30a548	(UIKit + 0x00002548 )	
0x0000000184ddded8	(CoreFoundation + 0x000eded8 )	__CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__
0x0000000184ddb890	(CoreFoundation + 0x000eb890 )	__CFRunLoopDoObservers
0x0000000184ddbe4c	(CoreFoundation + 0x000ebe4c )	__CFRunLoopRun
0x0000000184cfbe54	(CoreFoundation + 0x0000be54 )	CFRunLoopRunSpecific
0x0000000186ba8f80	(GraphicsServices + 0x0000af80 )	GSEventRunModal
0x000000018e37b678	(UIKit + 0x00073678 )	
0x0000000100a9efec	(Chrome -chrome_exe_main.mm:55 )	main
0x0000000184818568	(libdyld.dylib + 0x00001568 )

 
Cc: linds...@chromium.org cma...@chromium.org
Labels: -Type-Bug -Pri-3 ReleaseBlock-Dev M-65 Pri-1 Type-Bug-Regression
The same crash is occurring sometimes when Pull to refresh is used.
Marking as RB-Dev for M65. Please assign.
Cc: gambard@chromium.org
Components: UI>Browser>FullScreen
Owner: kkhorimoto@chromium.org
Status: Assigned (was: Untriaged)
Triggered with the fullscreen flag alone.
Labels: Bijou-Fullscreen
Status: Started (was: Assigned)
This is occurring because we're trying to access the FullscreenController of the incognito browser state after it was deallocated.
Project Member

Comment 5 by bugdroid1@chromium.org, Dec 20 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/975327e6d7b2153095a1416c806e0090b4e676b8

commit 975327e6d7b2153095a1416c806e0090b4e676b8
Author: Kurt Horimoto <kkhorimoto@chromium.org>
Date: Wed Dec 20 01:38:06 2017

[iOS] Fix teardown steps for LegacyToolbarCoordinator

The coordinator should stop observing the FullscreenController when its
BrowserState is destroyed.

Bug:  796152 
Cq-Include-Trybots: master.tryserver.chromium.mac:ios-simulator-cronet;master.tryserver.chromium.mac:ios-simulator-full-configs
Change-Id: I4f24c4a0d9f99cc66f67b85af678eff3da4a18fa
Reviewed-on: https://chromium-review.googlesource.com/835430
Commit-Queue: Kurt Horimoto <kkhorimoto@chromium.org>
Reviewed-by: Sergio Collazos <sczs@chromium.org>
Reviewed-by: Kurt Horimoto <kkhorimoto@chromium.org>
Cr-Commit-Position: refs/heads/master@{#525218}
[modify] https://crrev.com/975327e6d7b2153095a1416c806e0090b4e676b8/ios/chrome/browser/ui/browser_view_controller.mm
[modify] https://crrev.com/975327e6d7b2153095a1416c806e0090b4e676b8/ios/chrome/browser/ui/toolbar/legacy_toolbar_coordinator.h
[modify] https://crrev.com/975327e6d7b2153095a1416c806e0090b4e676b8/ios/chrome/browser/ui/toolbar/legacy_toolbar_coordinator.mm

Status: Fixed (was: Started)
Cc: sczs@chromium.org kkhorimoto@chromium.org edchin@chromium.org
 Issue 793624  has been merged into this issue.

Comment 8 by cmasso@google.com, Jan 3 2018

Labels: End-of-January
Status: Verified (was: Fixed)
Verified in 65.0.3316.0 canary, iPhone 6 iOS 10.3.3, iPhone 7 iOS11,
App is not crashing.
Looks good

Sign in to add a comment