The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/32778ae41b20ac2a151319d333cca660016be53d

commit 32778ae41b20ac2a151319d333cca660016be53d
Author: Bin Zhao <zhaobin@chromium.org>
Date: Thu Mar 01 19:12:27 2018

[DIAL] Added a DialURLFetcher to handle Dial related HTTP requests

DeviceDescriptionFetcher and DialAppInfoFetcher have some common code.
Create a DialURLFetcher class to get rid of some duplications.

The common URLFetcher class can also be used to launch and stop Dial
apps when we implement DIAL launch at browser side.

Bug:  816628 
Change-Id: I26bdfbbf7e2d59a68e3bf5aeaba8b6e3664bf430
Reviewed-on: https://chromium-review.googlesource.com/938158
Reviewed-by: Ramin Halavati <rhalavati@chromium.org>
Reviewed-by: Derek Cheng <imcheng@chromium.org>
Reviewed-by: mark a. foltz <mfoltz@chromium.org>
Commit-Queue: Bin Zhao <zhaobin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#540242}
[modify] https://crrev.com/32778ae41b20ac2a151319d333cca660016be53d/chrome/browser/media/router/discovery/BUILD.gn
[modify] https://crrev.com/32778ae41b20ac2a151319d333cca660016be53d/chrome/browser/media/router/discovery/dial/device_description_fetcher.cc
[modify] https://crrev.com/32778ae41b20ac2a151319d333cca660016be53d/chrome/browser/media/router/discovery/dial/device_description_fetcher.h
[modify] https://crrev.com/32778ae41b20ac2a151319d333cca660016be53d/chrome/browser/media/router/discovery/dial/device_description_fetcher_unittest.cc
[modify] https://crrev.com/32778ae41b20ac2a151319d333cca660016be53d/chrome/browser/media/router/discovery/dial/dial_app_discovery_service.cc
[modify] https://crrev.com/32778ae41b20ac2a151319d333cca660016be53d/chrome/browser/media/router/discovery/dial/dial_app_discovery_service.h
[modify] https://crrev.com/32778ae41b20ac2a151319d333cca660016be53d/chrome/browser/media/router/discovery/dial/dial_app_discovery_service_unittest.cc
[delete] https://crrev.com/42e81a6acef8011976f19ad45bc554f805c24825/chrome/browser/media/router/discovery/dial/dial_app_info_fetcher.h
[rename] https://crrev.com/32778ae41b20ac2a151319d333cca660016be53d/chrome/browser/media/router/discovery/dial/dial_url_fetcher.cc
[add] https://crrev.com/32778ae41b20ac2a151319d333cca660016be53d/chrome/browser/media/router/discovery/dial/dial_url_fetcher.h
[rename] https://crrev.com/32778ae41b20ac2a151319d333cca660016be53d/chrome/browser/media/router/discovery/dial/dial_url_fetcher_unittest.cc
[modify] https://crrev.com/32778ae41b20ac2a151319d333cca660016be53d/chrome/browser/media/router/test/test_helper.cc
[modify] https://crrev.com/32778ae41b20ac2a151319d333cca660016be53d/chrome/browser/media/router/test/test_helper.h
[modify] https://crrev.com/32778ae41b20ac2a151319d333cca660016be53d/chrome/test/BUILD.gn
[modify] https://crrev.com/32778ae41b20ac2a151319d333cca660016be53d/tools/traffic_annotation/summary/annotations.xml

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f14dd9d2665d98d49337a60fbfb97134d6e73b77

commit f14dd9d2665d98d49337a60fbfb97134d6e73b77
Author: mark a. foltz <mfoltz@chromium.org>
Date: Fri Mar 02 00:16:46 2018

Revert "[DIAL] Added a DialURLFetcher to handle Dial related HTTP requests"

This reverts commit 32778ae41b20ac2a151319d333cca660016be53d.

Reason for revert: Likely culprit for ASAN crash.

Original change's description:
> [DIAL] Added a DialURLFetcher to handle Dial related HTTP requests
> 
> DeviceDescriptionFetcher and DialAppInfoFetcher have some common code.
> Create a DialURLFetcher class to get rid of some duplications.
> 
> The common URLFetcher class can also be used to launch and stop Dial
> apps when we implement DIAL launch at browser side.
> 
> Bug:  816628 
> Change-Id: I26bdfbbf7e2d59a68e3bf5aeaba8b6e3664bf430
> Reviewed-on: https://chromium-review.googlesource.com/938158
> Reviewed-by: Ramin Halavati <rhalavati@chromium.org>
> Reviewed-by: Derek Cheng <imcheng@chromium.org>
> Reviewed-by: mark a. foltz <mfoltz@chromium.org>
> Commit-Queue: Bin Zhao <zhaobin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#540242}

TBR=mfoltz@chromium.org,imcheng@chromium.org,rhalavati@chromium.org,zhaobin@chromium.org

Change-Id: Ibfc4a97935f88ac4520383e6b26cd2ebca9ecb2e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug:  816628 
Reviewed-on: https://chromium-review.googlesource.com/944728
Reviewed-by: mark a. foltz <mfoltz@chromium.org>
Commit-Queue: mark a. foltz <mfoltz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#540363}
[modify] https://crrev.com/f14dd9d2665d98d49337a60fbfb97134d6e73b77/chrome/browser/media/router/discovery/BUILD.gn
[modify] https://crrev.com/f14dd9d2665d98d49337a60fbfb97134d6e73b77/chrome/browser/media/router/discovery/dial/device_description_fetcher.cc
[modify] https://crrev.com/f14dd9d2665d98d49337a60fbfb97134d6e73b77/chrome/browser/media/router/discovery/dial/device_description_fetcher.h
[modify] https://crrev.com/f14dd9d2665d98d49337a60fbfb97134d6e73b77/chrome/browser/media/router/discovery/dial/device_description_fetcher_unittest.cc
[modify] https://crrev.com/f14dd9d2665d98d49337a60fbfb97134d6e73b77/chrome/browser/media/router/discovery/dial/dial_app_discovery_service.cc
[modify] https://crrev.com/f14dd9d2665d98d49337a60fbfb97134d6e73b77/chrome/browser/media/router/discovery/dial/dial_app_discovery_service.h
[modify] https://crrev.com/f14dd9d2665d98d49337a60fbfb97134d6e73b77/chrome/browser/media/router/discovery/dial/dial_app_discovery_service_unittest.cc
[rename] https://crrev.com/f14dd9d2665d98d49337a60fbfb97134d6e73b77/chrome/browser/media/router/discovery/dial/dial_app_info_fetcher.cc
[add] https://crrev.com/f14dd9d2665d98d49337a60fbfb97134d6e73b77/chrome/browser/media/router/discovery/dial/dial_app_info_fetcher.h
[rename] https://crrev.com/f14dd9d2665d98d49337a60fbfb97134d6e73b77/chrome/browser/media/router/discovery/dial/dial_app_info_fetcher_unittest.cc
[delete] https://crrev.com/ec8466b7e28de9ebfb40ab1392e8736bdb370f05/chrome/browser/media/router/discovery/dial/dial_url_fetcher.h
[modify] https://crrev.com/f14dd9d2665d98d49337a60fbfb97134d6e73b77/chrome/browser/media/router/test/test_helper.cc
[modify] https://crrev.com/f14dd9d2665d98d49337a60fbfb97134d6e73b77/chrome/browser/media/router/test/test_helper.h
[modify] https://crrev.com/f14dd9d2665d98d49337a60fbfb97134d6e73b77/chrome/test/BUILD.gn
[modify] https://crrev.com/f14dd9d2665d98d49337a60fbfb97134d6e73b77/tools/traffic_annotation/summary/annotations.xml

Issue 818168 has been merged into this issue.

M66 is branching today and ~90% of the browser is crashing due to this bug.

Mark, would you mind reverting the patch in 3359 branch?

This bug requires manual review: Reverts referenced in bugdroid comments after merge request.
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), josafat@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

I can do that but I need some sort of approval it looks like.

branch: 3359

Done.

Users experienced this crash on the following builds:

Win Canary 66.0.3359.0 -  7.01 CPM, 74 reports, 64 clients (signature network::ResourceResponseInfo::~ResourceResponseInfo)
Win Canary 66.0.3359.0 -  405.23 CPM, 4305 reports, 2981 clients (signature net::HttpResponseHeaders::~HttpResponseHeaders)
Win Canary 66.0.3359.0 -  24.38 CPM, 259 reports, 154 clients (signature media_router::DialURLFetcher::ProcessResponse)
Win Canary 66.0.3359.0 -  19.48 CPM, 207 reports, 187 clients (signature media_router::DialURLFetcher::~DialURLFetcher)
Win Canary 66.0.3359.0 -  100.24 CPM, 1065 reports, 629 clients (signature media_router::DeviceDescriptionFetcher::ProcessResponse)
Mac Canary 66.0.3359.0 -  1.18 CPM, 4 reports, 3 clients (signature media_router::DeviceDescriptionFetcher::ProcessResponse)

If this update was incorrect, please add "Fracas-Wrong" label to prevent future updates.

- Go/Fracas

Pls merge your change to M66 branch 3359 ASAP so we can pick it up for next M66 Dev release. Thank you.

Pls merge your change to M66 branch 3359 ASAP so we can pick it up for next M66 Dev release. Thank you.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/bf4e08c760243ffb70ba96918a559a00d9108122

commit bf4e08c760243ffb70ba96918a559a00d9108122
Author: Bin Zhao <zhaobin@chromium.org>
Date: Mon Mar 05 19:30:50 2018

Manually reland issue 938158 [DIAL] Added a DialURLFetcher to handle Dial related HTTP requests

Manually reland https://chromium-review.googlesource.com/c/chromium/src/+/938158

Original patch causes crashes when Dial devices are present. Because in
device_description_fetcher.cc line 82 and line 88, we reset url fetcher after calling |success_cb_|
or |error_cb_|. Those callbacks destroy the device_description_fetcher object, causing following
fetcher_.reset() references deleted memory.

Fix it by removing fetcher_.reset(). |fetcher_| will be destroyed with the
device_description_fetcher object in |success_cb_| or |error_cb_| callbacks.

Bug:  816628 
Change-Id: I2765b5cb777e3be6783dd235a377bdc8865ce66f
Reviewed-on: https://chromium-review.googlesource.com/947584
Commit-Queue: Bin Zhao <zhaobin@chromium.org>
Reviewed-by: Derek Cheng <imcheng@chromium.org>
Reviewed-by: Ramin Halavati <rhalavati@chromium.org>
Reviewed-by: mark a. foltz <mfoltz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#540896}
[modify] https://crrev.com/bf4e08c760243ffb70ba96918a559a00d9108122/chrome/browser/media/router/discovery/BUILD.gn
[modify] https://crrev.com/bf4e08c760243ffb70ba96918a559a00d9108122/chrome/browser/media/router/discovery/dial/device_description_fetcher.cc
[modify] https://crrev.com/bf4e08c760243ffb70ba96918a559a00d9108122/chrome/browser/media/router/discovery/dial/device_description_fetcher.h
[modify] https://crrev.com/bf4e08c760243ffb70ba96918a559a00d9108122/chrome/browser/media/router/discovery/dial/device_description_fetcher_unittest.cc
[modify] https://crrev.com/bf4e08c760243ffb70ba96918a559a00d9108122/chrome/browser/media/router/discovery/dial/dial_app_discovery_service.cc
[modify] https://crrev.com/bf4e08c760243ffb70ba96918a559a00d9108122/chrome/browser/media/router/discovery/dial/dial_app_discovery_service.h
[modify] https://crrev.com/bf4e08c760243ffb70ba96918a559a00d9108122/chrome/browser/media/router/discovery/dial/dial_app_discovery_service_unittest.cc
[delete] https://crrev.com/4b95aac35e23927dcd8c342aa31d9a7175141c0c/chrome/browser/media/router/discovery/dial/dial_app_info_fetcher.h
[rename] https://crrev.com/bf4e08c760243ffb70ba96918a559a00d9108122/chrome/browser/media/router/discovery/dial/dial_url_fetcher.cc
[add] https://crrev.com/bf4e08c760243ffb70ba96918a559a00d9108122/chrome/browser/media/router/discovery/dial/dial_url_fetcher.h
[rename] https://crrev.com/bf4e08c760243ffb70ba96918a559a00d9108122/chrome/browser/media/router/discovery/dial/dial_url_fetcher_unittest.cc
[modify] https://crrev.com/bf4e08c760243ffb70ba96918a559a00d9108122/chrome/browser/media/router/test/test_helper.cc
[modify] https://crrev.com/bf4e08c760243ffb70ba96918a559a00d9108122/chrome/browser/media/router/test/test_helper.h
[modify] https://crrev.com/bf4e08c760243ffb70ba96918a559a00d9108122/chrome/test/BUILD.gn
[modify] https://crrev.com/bf4e08c760243ffb70ba96918a559a00d9108122/tools/traffic_annotation/summary/annotations.xml

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Mark has merged the revert into M66 (3359) on Mar 02. The bug is somehow not updated. https://chromium-review.googlesource.com/c/chromium/src/+/944728

Removed the Merge-Approved labels.

Initiated a new request to merge the reland patch (comment #15) into M66.

This bug requires manual review: Reverts referenced in bugdroid comments after merge request.
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), josafat@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Before we approve merge to M66, could you pls confirm followings?


Is the change listed at #15 well baked/verified in Canary, having enough automation tests coverage and safe to merge?
Any other imp details to justify the merge.

We will drop the Merge request for #15.

We plan to merge patchset 903419 into M66, and thought it depends on the reland. Seems not the case any more, and drop the merge request.

We updated unit test to cover the crash case, and will monitor Canary for change list in #15.

If not merge is needed to M66, pls remove "Merge-Review-66" label. Thank you.

zhaobin@, seems like we could have considered the change in c#15 for M66 branch:3359? This is top#1 browser crash (>90% of total crashes) on latest Dev#66.0.3359.22.

Ref Link: https://goto.google.com/rmxnq

zhaobin@, another cl got merged to M66 today related to Media Router https://bugs.chromium.org/p/chromium/issues/detail?id=687380#c21. Could you pls make sure that it safe to merge to M66? If not, pls revert it from M66 branch 3359. Thank you.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2552f9e0a8515cd8d49612318441d21be96438d1

commit 2552f9e0a8515cd8d49612318441d21be96438d1
Author: mark a. foltz <mfoltz@chromium.org>
Date: Sat Mar 10 00:59:50 2018

Revert "[DIAL] Added a DialURLFetcher to handle Dial related HTTP requests"

This reverts commit 32778ae41b20ac2a151319d333cca660016be53d.

Reason for revert: Likely culprit for ASAN crash.

Original change's description:
> [DIAL] Added a DialURLFetcher to handle Dial related HTTP requests
> 
> DeviceDescriptionFetcher and DialAppInfoFetcher have some common code.
> Create a DialURLFetcher class to get rid of some duplications.
> 
> The common URLFetcher class can also be used to launch and stop Dial
> apps when we implement DIAL launch at browser side.
> 
> Bug:  816628 
> Change-Id: I26bdfbbf7e2d59a68e3bf5aeaba8b6e3664bf430
> Reviewed-on: https://chromium-review.googlesource.com/938158
> Reviewed-by: Ramin Halavati <rhalavati@chromium.org>
> Reviewed-by: Derek Cheng <imcheng@chromium.org>
> Reviewed-by: mark a. foltz <mfoltz@chromium.org>
> Commit-Queue: Bin Zhao <zhaobin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#540242}

TBR=mfoltz@chromium.org,imcheng@chromium.org,rhalavati@chromium.org,zhaobin@chromium.org

Change-Id: Ibfc4a97935f88ac4520383e6b26cd2ebca9ecb2e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug:  816628 
Reviewed-on: https://chromium-review.googlesource.com/944728
Reviewed-by: mark a. foltz <mfoltz@chromium.org>
Commit-Queue: mark a. foltz <mfoltz@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#540363}(cherry picked from commit f14dd9d2665d98d49337a60fbfb97134d6e73b77)
Reviewed-on: https://chromium-review.googlesource.com/958002
Reviewed-by: Bin Zhao <zhaobin@chromium.org>
Cr-Commit-Position: refs/branch-heads/3359@{#141}
Cr-Branched-From: 66afc5e5d10127546cc4b98b9117aff588b5e66b-refs/heads/master@{#540276}
[modify] https://crrev.com/2552f9e0a8515cd8d49612318441d21be96438d1/chrome/browser/media/router/discovery/BUILD.gn
[modify] https://crrev.com/2552f9e0a8515cd8d49612318441d21be96438d1/chrome/browser/media/router/discovery/dial/device_description_fetcher.cc
[modify] https://crrev.com/2552f9e0a8515cd8d49612318441d21be96438d1/chrome/browser/media/router/discovery/dial/device_description_fetcher.h
[modify] https://crrev.com/2552f9e0a8515cd8d49612318441d21be96438d1/chrome/browser/media/router/discovery/dial/device_description_fetcher_unittest.cc
[modify] https://crrev.com/2552f9e0a8515cd8d49612318441d21be96438d1/chrome/browser/media/router/discovery/dial/dial_app_discovery_service.cc
[modify] https://crrev.com/2552f9e0a8515cd8d49612318441d21be96438d1/chrome/browser/media/router/discovery/dial/dial_app_discovery_service.h
[modify] https://crrev.com/2552f9e0a8515cd8d49612318441d21be96438d1/chrome/browser/media/router/discovery/dial/dial_app_discovery_service_unittest.cc
[rename] https://crrev.com/2552f9e0a8515cd8d49612318441d21be96438d1/chrome/browser/media/router/discovery/dial/dial_app_info_fetcher.cc
[add] https://crrev.com/2552f9e0a8515cd8d49612318441d21be96438d1/chrome/browser/media/router/discovery/dial/dial_app_info_fetcher.h
[rename] https://crrev.com/2552f9e0a8515cd8d49612318441d21be96438d1/chrome/browser/media/router/discovery/dial/dial_app_info_fetcher_unittest.cc
[delete] https://crrev.com/317e0e7b3afeffa6da6ab896cd5584f301dc095a/chrome/browser/media/router/discovery/dial/dial_url_fetcher.h
[modify] https://crrev.com/2552f9e0a8515cd8d49612318441d21be96438d1/chrome/browser/media/router/test/test_helper.cc
[modify] https://crrev.com/2552f9e0a8515cd8d49612318441d21be96438d1/chrome/browser/media/router/test/test_helper.h
[modify] https://crrev.com/2552f9e0a8515cd8d49612318441d21be96438d1/chrome/test/BUILD.gn
[modify] https://crrev.com/2552f9e0a8515cd8d49612318441d21be96438d1/tools/traffic_annotation/summary/annotations.xml

 Issue 820569  has been merged into this issue.

Per comment #11 & #17, revert was merged to M66 branch 3359 but actually it didn't. Also ReleaseBlock-Dev label was removed at #17. 

M66 #66.0.3359.22 went out today without this revert and we're seeing top#1 browser crash (>90% of total crashes) on latest Dev#66.0.3359.22 per comment #23 by manoranjanr@.

Thank you for merging the revert to M66 branch 3359 at comment #25. Pls do make sure that it is a correct revert merge. Next time, pls request a merge and wait for approval before merging.

Requesting a postmortem for this so we can prevent this type of failure in future, lease see go/chrome-postmortems for the process to follow. 

Dumb question but when this happens and the merge doesn't actually take place and then goes back in can you just confirm which exact build will contain this critical fix just so I can ensure we avoid any of the handful of builds in-between?  Thx!

 Issue 820751  has been merged into this issue.

 Issue 820748  has been merged into this issue.

 Issue 820710  has been merged into this issue.

 Issue 820722  has been merged into this issue.

May be valuable for debugging the implementation: for me, Chrome would continuously work, until some event sets in motion a crashing chain that cannot be interrupted but does so randomly.

An event that caused Chrome to start having this crash, was my Internet connection having stability issues (due to bad wifi). Once my network had limited or no connectivity, the crash would spontaneously and immediately occur. Because this implementation is related to HTTP requests, this may be relevant. Atleast i'm not one of those users who is 100% unable to launch the build, it happens and persists in crashing at given moments.
Low chance, but it may also be that Chrome, due to these changes, was stressing my network usage by HTTP leading to the interruption of connectivity to begin with, but I dont think so because my environment has a history of connectivity problems lately, even before this build aired.

 Issue 820799  has been merged into this issue.

Issue 820813 has been merged into this issue.

Issue 820796 has been merged into this issue.

 Issue 820755  has been merged into this issue.

Issue 820747 has been merged into this issue.

Tried to launch the latest chrome dev version:66.0.3359.22 manually on Windows-10. I was unable to encounter the crash on startup launching the chrome with compatibility mode on/off as per the reported duped  Issue 820799 , Issue 820813. Unable to verify the revert manually.


However, suspected CL that has caused this crash is reverted from 3359 branch in C#25. Upcoming Dev should contain the fix and this crash should be resolved. Will verify the revert once the build with the fix is pushed to production.


Thank you! 


 

Issue 820941 has been merged into this issue.

So what DEV build # now contains this fix and won't crash???

Dev release #66.0.3359.26 and higher includes this fix. Pls update to this version and verify the fix. Thank you.

Ok so when the browser insists on still auto-updating my working build to 3359.23 which crashes and basically leaves me without a working Chrome browser, is there a URL to skip that and actually get the build you're referring me to (66.0.3359.26)?

Please go to chrome://settings/help and it should be able to let you update Chrome dev to 66.0.3359.26.

I reported this bug as #820755 (now duped into this one). Crash no longer occurs with Chrome 66.0.3359.26 (Official Build) dev (64-bit). Thanks! :)

No!!!! It friggin does NOT skip this crashing version I cannot believe you just instructed me to go to help/about to do the same auto-update I just told you still upgrades DEV channel to .23 (the BAD version).

This is LUDICROUS that after all these years there is still not a simple friggin URL to go get any Chrome build, since after all there are not limitations to what build the public runs.

So to ask again for me and all the other Chrome users that were just handed a bad browser build that crashes - how do we directly skip the bad build of 66.0.3359.23 if we are on the DEV channel, and instead upgrade from the working build of 66.0.3355.x directly to 66.0.3359.26?

TIA!

Because to again clarify, you CANNOT simply update twice since once you upgrade from 66.0.3355 to 66.0.3359.23, the browser will NO LONGER EVEN OPEN so cannot perform another update.

So I'm very curious how the last poster upgraded to .26 if he could share it would be much appreciated.

Confirmed that 66.0.3359.26 x64 is working on my Win10 machine.

I was able to update by setting the Chrome Dev shortcut's compatibility mode to Win8, run it and let it do its update, then let it restart.  This was mentioned as a workaround in the reddit topic on this crash.

Thanks for the quick fix; but please do a post-mortem on how this bug made it into the dev channel.

livefort...@gmail.com: since the crash occurs when accessing SSDP/DIAL devices, I just made sure there are none on the network (in my case, by turning wifi off on my TV). 

No, this crash is well known now (hence the DOZEN other merged issues) as not allowing the browser to open - period.  I support many PCs some of which are on DEV branch and NONE of them even unplugged from the net open here is just one of many open issues showing it fast-closes before the darn window is even drawn and the ONLY option is to downgrade.

So, where is the setup/binaries for 66.0.3359.26 (or later) than one (even a new install) can install PAST the bad build that then is a dead-end since you can't open Chrome once 66.0.3359.23 is installed?

Sorry here are a couple showing you CANNOT open Chrome no matter what once 66.0.3359.23 is installed:

https://bugs.chromium.org/p/chromium/issues/detail?id=820569
https://bugs.chromium.org/p/chromium/issues/detail?id=820799

UPDATE 03-12-2018_03:31PM:

Just started seeing 66.0.3359.26 now being pushed after rollback to 66.0.3355 and re-updating so for others the trick is roll back clear all remnants of 66.0.3359.23, reboot and now that it's showing in the update channel it <should> update past .23 to the fixed .26!

@livefort - You should just be able to set .22/.23 to compatibility mode to Windows 7 or 8 to allow you to trigger the update to .26

I just did it that way on two devices. No issues now.

Confirmed that 66.0.3359.26 x64 is working on my Windows 10.0.16299 computer.

Thanks.

Adding the verified label based on the recent comments and as the crashes seems to have disappeared on the latest Dev: 66.0.3359.26 of Windows and Mac.

 Issue 820720  has been merged into this issue.

seems like this issue has been fixed in M66. Zhaobin@ can you please confirm, and if yes mark it as fixed?

Reopening this bug, removing crash related labels. Also changing to a Feature request, which was the original purpose of this bug. I will be taking over the work to finish the implementation.

Some points of discussion for the implementation and TODOs beyond the initial implementation:
- Simplify the use of route ID to simply the presentation ID
- Support timeouts for app launch / stop requests
- Metrics
- Investigate the use of PresentationConnection so that the DialMediaRouteProvider can communicate directly with the SDK client in the web page. This is a larger change that affects other MRPs that use the Presentation API.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a581664af3a44053be4512ea9d4d3be0ac12f45e

commit a581664af3a44053be4512ea9d4d3be0ac12f45e
Author: Derek Cheng <imcheng@chromium.org>
Date: Wed Apr 18 22:25:47 2018

[Dial MRP] Refactor DialAppDiscoveryService.

Custom DIAL launch patch part 1 of many.

DialAppDiscoveryService now takes a callback in FetchDialAppInfo()
instead of constructor. This allows classes other than
DialMediaSinkServiceImpl to make calls to it, and is required as part
of custom DIAL launch workflow to get the latest app status.

Bug:  816628 
Change-Id: Ib2bae532614921330123db3e02fcfcac2c78d8b4
Reviewed-on: https://chromium-review.googlesource.com/1012744
Commit-Queue: Derek Cheng <imcheng@chromium.org>
Reviewed-by: mark a. foltz <mfoltz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#551853}
[modify] https://crrev.com/a581664af3a44053be4512ea9d4d3be0ac12f45e/chrome/browser/media/router/discovery/dial/device_description_fetcher.cc
[modify] https://crrev.com/a581664af3a44053be4512ea9d4d3be0ac12f45e/chrome/browser/media/router/discovery/dial/device_description_fetcher_unittest.cc
[modify] https://crrev.com/a581664af3a44053be4512ea9d4d3be0ac12f45e/chrome/browser/media/router/discovery/dial/dial_app_discovery_service.cc
[modify] https://crrev.com/a581664af3a44053be4512ea9d4d3be0ac12f45e/chrome/browser/media/router/discovery/dial/dial_app_discovery_service.h
[modify] https://crrev.com/a581664af3a44053be4512ea9d4d3be0ac12f45e/chrome/browser/media/router/discovery/dial/dial_app_discovery_service_unittest.cc
[modify] https://crrev.com/a581664af3a44053be4512ea9d4d3be0ac12f45e/chrome/browser/media/router/discovery/dial/dial_media_sink_service_impl.cc
[modify] https://crrev.com/a581664af3a44053be4512ea9d4d3be0ac12f45e/chrome/browser/media/router/discovery/dial/dial_media_sink_service_impl.h
[modify] https://crrev.com/a581664af3a44053be4512ea9d4d3be0ac12f45e/chrome/browser/media/router/discovery/dial/dial_media_sink_service_impl_unittest.cc
[modify] https://crrev.com/a581664af3a44053be4512ea9d4d3be0ac12f45e/chrome/browser/media/router/discovery/dial/dial_url_fetcher.cc
[modify] https://crrev.com/a581664af3a44053be4512ea9d4d3be0ac12f45e/chrome/browser/media/router/discovery/dial/dial_url_fetcher.h
[modify] https://crrev.com/a581664af3a44053be4512ea9d4d3be0ac12f45e/chrome/browser/media/router/discovery/dial/dial_url_fetcher_unittest.cc
[modify] https://crrev.com/a581664af3a44053be4512ea9d4d3be0ac12f45e/chrome/browser/media/router/discovery/dial/parsed_dial_app_info.cc
[modify] https://crrev.com/a581664af3a44053be4512ea9d4d3be0ac12f45e/chrome/browser/media/router/discovery/dial/parsed_dial_app_info.h
[modify] https://crrev.com/a581664af3a44053be4512ea9d4d3be0ac12f45e/chrome/browser/media/router/test/test_helper.cc
[modify] https://crrev.com/a581664af3a44053be4512ea9d4d3be0ac12f45e/chrome/browser/media/router/test/test_helper.h

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/edfd09dcc0523af76615b39f0bf071a6c3cb1f85

commit edfd09dcc0523af76615b39f0bf071a6c3cb1f85
Author: Derek Cheng <imcheng@chromium.org>
Date: Thu Apr 26 23:54:16 2018

[Dial MRP] Run Dial MRP on IO thread.

Custom DIAL patch part 2. (diffbase = 1012744)


Running Dial MRP on IO thread allows it to access DMSSImpl directly
without the need for additional layer of caching and trampolining,
greatly simplifying the interaction between the two objects. To do this,
DMSSImpl* is temporarily exposed from DualMSS. This won't be needed
once we no longer need to provide DIAL sinks to the extension.

Also, renamed the feature name to DialMediaRouteProvider to be
consistent with Cast.


Bug:  816628 
Change-Id: I29b7c7751072e4bd60c72f2ae7c5738f4c3df323
Reviewed-on: https://chromium-review.googlesource.com/1014722
Commit-Queue: Derek Cheng <imcheng@chromium.org>
Reviewed-by: mark a. foltz <mfoltz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#554195}
[modify] https://crrev.com/edfd09dcc0523af76615b39f0bf071a6c3cb1f85/chrome/browser/media/router/discovery/dial/dial_media_sink_service.cc
[modify] https://crrev.com/edfd09dcc0523af76615b39f0bf071a6c3cb1f85/chrome/browser/media/router/discovery/dial/dial_media_sink_service.h
[modify] https://crrev.com/edfd09dcc0523af76615b39f0bf071a6c3cb1f85/chrome/browser/media/router/discovery/dial/dial_media_sink_service_impl.cc
[modify] https://crrev.com/edfd09dcc0523af76615b39f0bf071a6c3cb1f85/chrome/browser/media/router/discovery/dial/dial_media_sink_service_impl.h
[modify] https://crrev.com/edfd09dcc0523af76615b39f0bf071a6c3cb1f85/chrome/browser/media/router/discovery/dial/dial_media_sink_service_impl_unittest.cc
[delete] https://crrev.com/8473a3c1f0b3afb9382015c800a9215de3b9194e/chrome/browser/media/router/discovery/dial/dial_media_sink_service_unittest.cc
[modify] https://crrev.com/edfd09dcc0523af76615b39f0bf071a6c3cb1f85/chrome/browser/media/router/media_router_feature.cc
[modify] https://crrev.com/edfd09dcc0523af76615b39f0bf071a6c3cb1f85/chrome/browser/media/router/media_router_feature.h
[modify] https://crrev.com/edfd09dcc0523af76615b39f0bf071a6c3cb1f85/chrome/browser/media/router/mojo/media_router_desktop.cc
[modify] https://crrev.com/edfd09dcc0523af76615b39f0bf071a6c3cb1f85/chrome/browser/media/router/mojo/media_router_desktop.h
[modify] https://crrev.com/edfd09dcc0523af76615b39f0bf071a6c3cb1f85/chrome/browser/media/router/providers/cast/dual_media_sink_service.cc
[modify] https://crrev.com/edfd09dcc0523af76615b39f0bf071a6c3cb1f85/chrome/browser/media/router/providers/cast/dual_media_sink_service.h
[modify] https://crrev.com/edfd09dcc0523af76615b39f0bf071a6c3cb1f85/chrome/browser/media/router/providers/dial/dial_media_route_provider.cc
[modify] https://crrev.com/edfd09dcc0523af76615b39f0bf071a6c3cb1f85/chrome/browser/media/router/providers/dial/dial_media_route_provider.h
[modify] https://crrev.com/edfd09dcc0523af76615b39f0bf071a6c3cb1f85/chrome/browser/media/router/providers/dial/dial_media_route_provider_unittest.cc
[modify] https://crrev.com/edfd09dcc0523af76615b39f0bf071a6c3cb1f85/chrome/browser/media/router/test/test_helper.h
[modify] https://crrev.com/edfd09dcc0523af76615b39f0bf071a6c3cb1f85/chrome/common/media_router/discovery/media_sink_service_base.h
[modify] https://crrev.com/edfd09dcc0523af76615b39f0bf071a6c3cb1f85/chrome/test/BUILD.gn

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/cacba2dcb8948be212d1339ed65f2b8df5db1ba7

commit cacba2dcb8948be212d1339ed65f2b8df5db1ba7
Author: Derek Cheng <imcheng@chromium.org>
Date: Mon Apr 30 21:05:03 2018

[DIAL MRP] DialActivityManager and DialInternalMessageUtil.

Part 3 of Custom DIAL launch patches. (Diffbase = 1014722)

Added the following classes:

DialActivityManager - handles custom DIAL launch session management
DialInternalMessageUtil - utility functions for generating/parsing
different types of Cast messages for Custom DIAL launch for
communicating with Cast SDK.

Bug:  816628 
Change-Id: Id9eb4fdd393677771c9a278d78584e88339d21fa
Reviewed-on: https://chromium-review.googlesource.com/1018281
Commit-Queue: Derek Cheng <imcheng@chromium.org>
Reviewed-by: Brandon Tolsch <btolsch@chromium.org>
Cr-Commit-Position: refs/heads/master@{#554871}
[modify] https://crrev.com/cacba2dcb8948be212d1339ed65f2b8df5db1ba7/chrome/browser/media/router/BUILD.gn
[add] https://crrev.com/cacba2dcb8948be212d1339ed65f2b8df5db1ba7/chrome/browser/media/router/providers/dial/dial_activity_manager.cc
[add] https://crrev.com/cacba2dcb8948be212d1339ed65f2b8df5db1ba7/chrome/browser/media/router/providers/dial/dial_activity_manager.h
[add] https://crrev.com/cacba2dcb8948be212d1339ed65f2b8df5db1ba7/chrome/browser/media/router/providers/dial/dial_activity_manager_unittest.cc
[add] https://crrev.com/cacba2dcb8948be212d1339ed65f2b8df5db1ba7/chrome/browser/media/router/providers/dial/dial_internal_message_util.cc
[add] https://crrev.com/cacba2dcb8948be212d1339ed65f2b8df5db1ba7/chrome/browser/media/router/providers/dial/dial_internal_message_util.h
[add] https://crrev.com/cacba2dcb8948be212d1339ed65f2b8df5db1ba7/chrome/browser/media/router/providers/dial/dial_internal_message_util_unittest.cc
[modify] https://crrev.com/cacba2dcb8948be212d1339ed65f2b8df5db1ba7/chrome/browser/media/router/test/test_helper.cc
[modify] https://crrev.com/cacba2dcb8948be212d1339ed65f2b8df5db1ba7/chrome/browser/media/router/test/test_helper.h
[modify] https://crrev.com/cacba2dcb8948be212d1339ed65f2b8df5db1ba7/chrome/test/BUILD.gn

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/064e46a24a66dc285b5118d84d4b228754b0500a

commit 064e46a24a66dc285b5118d84d4b228754b0500a
Author: Derek Cheng <imcheng@chromium.org>
Date: Thu May 03 20:16:56 2018

[Media Router] Clean up MediaSinkServiceBase.

MediaSinkServiceBase changes:

- Move the Observer interface currently in CMSSImpl to
MediaSinkServiceBase and generalizes it so it can be used for other
MediaSinkServiceBase implementations.
- Standardizes add/update/remove/get sink operations in
MediaSinkServiceBase.
Both of these make the code using MediaSinkServiceBase more testable as
additional code in MRP depend on them.

Also cleaned up logic related to the discovery timer by combining
Start/RestartTimer().

-----

DialMediaSinkSevice changes:
- DMSSImpl now pools sinks discovered in the latest round and is used
to merge with the |MSSBase::sinks_| when the discovery timer fires.
Before this patch, the current set is removed on the start of a discovery
round (because unlike Cast, there is no active connection to a device to
tell that it is still alive or gone), which makes the sink list unstable.
With this patch, the current set is only modified at the end of a discovery
round.
- TODOs in future patches:
-- move app discovery service out of DMSSImpl, similar to Cast.
-- get rid of DMSS and move UI thread dependencies (if any) into part
   of DMSSImpl. Then rename DMSSImpl -> DMSS.

-----

CastMediaSinkService changes;
- No longer keep track of sinks by ip endpoint. Instead uses
|MSSBase::sinks_| to maintain sink list.
- CastAppDiscoveryService no longer need to maintain its own map of
sinks, and instead uses |MSSBase::GetSinks()/GetSinkById()|.
- The callback used for dual disovery is converted to use
MediaSinkServiceBase::Observer.
- TODOs in future patches:
-- get rid of CMSS and move UI thread dependencies into CMSSImpl.
Rename CMSSImpl -> CMSS.
-----

Notes:
- The MediaRouteDesktop ProvideSinks callback is not converted to use
Observers. This is because the callback is expected to be temporary (until
we can turn off the extension MRPs), so we treat it as a special case.

Bug:  816628 , 698940 
Change-Id: I11fd13f7ebf743d78c9499ad24f98cf72f571ee5
Reviewed-on: https://chromium-review.googlesource.com/1033727
Commit-Queue: Derek Cheng <imcheng@chromium.org>
Reviewed-by: Brandon Tolsch <btolsch@chromium.org>
Cr-Commit-Position: refs/heads/master@{#555854}
[modify] https://crrev.com/064e46a24a66dc285b5118d84d4b228754b0500a/chrome/browser/media/router/discovery/dial/dial_media_sink_service.cc
[modify] https://crrev.com/064e46a24a66dc285b5118d84d4b228754b0500a/chrome/browser/media/router/discovery/dial/dial_media_sink_service.h
[modify] https://crrev.com/064e46a24a66dc285b5118d84d4b228754b0500a/chrome/browser/media/router/discovery/dial/dial_media_sink_service_impl.cc
[modify] https://crrev.com/064e46a24a66dc285b5118d84d4b228754b0500a/chrome/browser/media/router/discovery/dial/dial_media_sink_service_impl.h
[modify] https://crrev.com/064e46a24a66dc285b5118d84d4b228754b0500a/chrome/browser/media/router/discovery/dial/dial_media_sink_service_impl_unittest.cc
[modify] https://crrev.com/064e46a24a66dc285b5118d84d4b228754b0500a/chrome/browser/media/router/discovery/mdns/cast_media_sink_service.cc
[modify] https://crrev.com/064e46a24a66dc285b5118d84d4b228754b0500a/chrome/browser/media/router/discovery/mdns/cast_media_sink_service.h
[modify] https://crrev.com/064e46a24a66dc285b5118d84d4b228754b0500a/chrome/browser/media/router/discovery/mdns/cast_media_sink_service_impl.cc
[modify] https://crrev.com/064e46a24a66dc285b5118d84d4b228754b0500a/chrome/browser/media/router/discovery/mdns/cast_media_sink_service_impl.h
[modify] https://crrev.com/064e46a24a66dc285b5118d84d4b228754b0500a/chrome/browser/media/router/discovery/mdns/cast_media_sink_service_impl_unittest.cc
[modify] https://crrev.com/064e46a24a66dc285b5118d84d4b228754b0500a/chrome/browser/media/router/discovery/mdns/cast_media_sink_service_unittest.cc
[modify] https://crrev.com/064e46a24a66dc285b5118d84d4b228754b0500a/chrome/browser/media/router/providers/cast/cast_app_discovery_service.cc
[modify] https://crrev.com/064e46a24a66dc285b5118d84d4b228754b0500a/chrome/browser/media/router/providers/cast/cast_app_discovery_service.h
[modify] https://crrev.com/064e46a24a66dc285b5118d84d4b228754b0500a/chrome/browser/media/router/providers/cast/cast_app_discovery_service_unittest.cc
[modify] https://crrev.com/064e46a24a66dc285b5118d84d4b228754b0500a/chrome/browser/media/router/providers/cast/dual_media_sink_service.cc
[modify] https://crrev.com/064e46a24a66dc285b5118d84d4b228754b0500a/chrome/browser/media/router/providers/cast/dual_media_sink_service.h
[modify] https://crrev.com/064e46a24a66dc285b5118d84d4b228754b0500a/chrome/browser/media/router/providers/cast/dual_media_sink_service_unittest.cc
[modify] https://crrev.com/064e46a24a66dc285b5118d84d4b228754b0500a/chrome/browser/media/router/providers/dial/dial_media_route_provider.cc
[modify] https://crrev.com/064e46a24a66dc285b5118d84d4b228754b0500a/chrome/browser/media/router/providers/dial/dial_media_route_provider_unittest.cc
[modify] https://crrev.com/064e46a24a66dc285b5118d84d4b228754b0500a/chrome/browser/media/router/test/test_helper.h
[modify] https://crrev.com/064e46a24a66dc285b5118d84d4b228754b0500a/chrome/common/media_router/BUILD.gn
[modify] https://crrev.com/064e46a24a66dc285b5118d84d4b228754b0500a/chrome/common/media_router/discovery/media_sink_service_base.cc
[modify] https://crrev.com/064e46a24a66dc285b5118d84d4b228754b0500a/chrome/common/media_router/discovery/media_sink_service_base.h
[modify] https://crrev.com/064e46a24a66dc285b5118d84d4b228754b0500a/chrome/common/media_router/discovery/media_sink_service_base_unittest.cc
[add] https://crrev.com/064e46a24a66dc285b5118d84d4b228754b0500a/chrome/common/media_router/test/test_helper.cc
[add] https://crrev.com/064e46a24a66dc285b5118d84d4b228754b0500a/chrome/common/media_router/test/test_helper.h
[modify] https://crrev.com/064e46a24a66dc285b5118d84d4b228754b0500a/chrome/test/BUILD.gn

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/c9390761ba322c8437244637992a796022c7a3f8

commit c9390761ba322c8437244637992a796022c7a3f8
Author: Derek Cheng <imcheng@chromium.org>
Date: Wed May 16 20:07:12 2018

[MediaRouter] Add ROUTE_ALREADY_EXISTS result code.

This will be used for in-browser DIAL MRP
(https://chromium-review.googlesource.com/c/chromium/src/+/1036611) and
other future MRP implementations to indicate a MediaRoute already
exists when trying to CreateRoute.

Bug:  816628 
Change-Id: Id43d91be7318362043cc33a3c0500cc9463f5a5d
Reviewed-on: https://chromium-review.googlesource.com/1062145
Reviewed-by: Adam Parker <amp@chromium.org>
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Commit-Queue: Derek Cheng <imcheng@chromium.org>
Cr-Commit-Position: refs/heads/master@{#559249}
[modify] https://crrev.com/c9390761ba322c8437244637992a796022c7a3f8/chrome/common/media_router/mojo/media_router.mojom
[modify] https://crrev.com/c9390761ba322c8437244637992a796022c7a3f8/chrome/common/media_router/mojo/media_router_struct_traits.h
[modify] https://crrev.com/c9390761ba322c8437244637992a796022c7a3f8/chrome/common/media_router/route_request_result.h
[modify] https://crrev.com/c9390761ba322c8437244637992a796022c7a3f8/tools/metrics/histograms/enums.xml

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7da156e934b73148050a034be28029baaaaf3834

commit 7da156e934b73148050a034be28029baaaaf3834
Author: Derek Cheng <imcheng@chromium.org>
Date: Fri May 18 20:49:57 2018

[DIAL MRP] Final part of Custom DIAL launch.

This patch hooks up DialMediaRouteProvider to DialActivityManager to implement
the following:
- Handling of CreateRoute requests and the sequence of message exchanges that
follow to finish the app launch.
- Management of MediaRoutes (owned by DialActivityManager) and handling of
TerminateRoute requests to stop a launched app.

We currently use a buffered message sender to handle messaging to/from the
webpage, due to the way PresentationConnections are set up in MediaRouter. This
is a temporary solution that will be replaced when plumb PresentationConnection
Mojo message pipes to MediaRouteProvider to communiate with the page directly.

Bug:  816628 
Change-Id: Ib517a3e239a55e1f07b539d8889f8805eb7f3e02
Reviewed-on: https://chromium-review.googlesource.com/1036611
Commit-Queue: Derek Cheng <imcheng@chromium.org>
Reviewed-by: Adam Parker <amp@chromium.org>
Reviewed-by: Takumi Fujimoto <takumif@chromium.org>
Cr-Commit-Position: refs/heads/master@{#560019}
[modify] https://crrev.com/7da156e934b73148050a034be28029baaaaf3834/chrome/browser/media/router/BUILD.gn
[modify] https://crrev.com/7da156e934b73148050a034be28029baaaaf3834/chrome/browser/media/router/discovery/dial/dial_media_sink_service_impl.cc
[modify] https://crrev.com/7da156e934b73148050a034be28029baaaaf3834/chrome/browser/media/router/discovery/dial/dial_media_sink_service_impl.h
[modify] https://crrev.com/7da156e934b73148050a034be28029baaaaf3834/chrome/browser/media/router/mojo/media_router_mojo_impl.cc
[add] https://crrev.com/7da156e934b73148050a034be28029baaaaf3834/chrome/browser/media/router/providers/common/buffered_message_sender.cc
[add] https://crrev.com/7da156e934b73148050a034be28029baaaaf3834/chrome/browser/media/router/providers/common/buffered_message_sender.h
[modify] https://crrev.com/7da156e934b73148050a034be28029baaaaf3834/chrome/browser/media/router/providers/dial/dial_activity_manager.cc
[modify] https://crrev.com/7da156e934b73148050a034be28029baaaaf3834/chrome/browser/media/router/providers/dial/dial_media_route_provider.cc
[modify] https://crrev.com/7da156e934b73148050a034be28029baaaaf3834/chrome/browser/media/router/providers/dial/dial_media_route_provider.h
[modify] https://crrev.com/7da156e934b73148050a034be28029baaaaf3834/chrome/browser/media/router/providers/dial/dial_media_route_provider_unittest.cc