New issue
Advanced search Search tips

Issue 819607 link

Starred by 2 users

Issue metadata

Status: Duplicate
Owner:
Closed: Mar 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 2
Type: Bug



Sign in to add a comment

Browser gets crashed after navigating to 'youtube.com'.

Reported by db...@etouch.net, Mar 7 2018

Issue description

Chrome Version : 65.0.3325.124 (Official Build) beta (64-bit) Revision 42ae48183937849c27a047d09b789231a25e3fcf-refs/branch-heads/3325_122@{#3}
OS: Mac(10.12.6)

What steps will reproduce the problem?
(1) Launch chrome using QUIC protocol. 
(2) Navigate to youtube.com and observe.


Actual: Browser gets crashed.

Crash Id: 9aac30242fec8f23 (Local Crash ID: dcad21d7-36d4-4d7e-bc55-500a541d34c3)

Expected: Browser should not crash.

This is non-regression issue.

Note: 
1.Same behavior is observed on Mac OS using M-65 Stable(#65.0.3325.146) and issue is not observed in Windows OS. 
2.Please review and attached Log file.
 
Actual_Crash_Quic.mov
3.6 MB View Download
testuser.quic-chrome-net.log
3.0 MB View Download

Comment 1 by db...@etouch.net, Mar 7 2018

Note: Above crash is also seen on Mac OS using M-64 Stable (#64.0.3282.186)

Thank you.
Cc: pbomm...@chromium.org rtenneti@chromium.org
Status: Untriaged (was: Unconfirmed)
Stack trace for the crash id:
-----------------------------
Thread 0 (id: 125188) CRASHED [EXC_BAD_ACCESS / KERN_INVALID_ADDRESS @ 0x00000008 ] MAGIC SIGNATURE THREAD
Stack Quality84%Show frame trust levels
0x000000010da3fa0f	(Google Chrome Framework -repeated_field.h:1483 )	gcm::GCMKeyStore::DidLoadKeys(bool, std::__1::unique_ptr<std::__1::vector<gcm::EncryptionData, std::__1::allocator<gcm::EncryptionData> >, std::__1::default_delete<std::__1::vector<gcm::EncryptionData, std::__1::allocator<gcm::EncryptionData> > > >)
0x000000010da42d5a	(Google Chrome Framework -bind_internal.h:211 )	void base::internal::FunctorTraits<void (gcm::GCMKeyStore::*)(bool, std::__1::unique_ptr<std::__1::vector<gcm::EncryptionData, std::__1::allocator<gcm::EncryptionData> >, std::__1::default_delete<std::__1::vector<gcm::EncryptionData, std::__1::allocator<gcm::EncryptionData> > > >), void>::Invoke<base::WeakPtr<gcm::GCMKeyStore> const&, bool, std::__1::unique_ptr<std::__1::vector<gcm::EncryptionData, std::__1::allocator<gcm::EncryptionData> >, std::__1::default_delete<std::__1::vector<gcm::EncryptionData, std::__1::allocator<gcm::EncryptionData> > > > >(void (gcm::GCMKeyStore::*)(bool, std::__1::unique_ptr<std::__1::vector<gcm::EncryptionData, std::__1::allocator<gcm::EncryptionData> >, std::__1::default_delete<std::__1::vector<gcm::EncryptionData, std::__1::allocator<gcm::EncryptionData> > > >), base::WeakPtr<gcm::GCMKeyStore> const&&&, bool&&, std::__1::unique_ptr<std::__1::vector<gcm::EncryptionData, std::__1::allocator<gcm::EncryptionData> >, std::__1::default_delete<std::__1::vector<gcm::EncryptionData, std::__1::allocator<gcm::EncryptionData> > > >&&)
0x000000010da42cf1	(Google Chrome Framework -bind_internal.h:314 )	base::internal::Invoker<base::internal::BindState<void (gcm::GCMKeyStore::*)(bool, std::__1::unique_ptr<std::__1::vector<gcm::EncryptionData, std::__1::allocator<gcm::EncryptionData> >, std::__1::default_delete<std::__1::vector<gcm::EncryptionData, std::__1::allocator<gcm::EncryptionData> > > >), base::WeakPtr<gcm::GCMKeyStore> >, void (bool, std::__1::unique_ptr<std::__1::vector<gcm::EncryptionData, std::__1::allocator<gcm::EncryptionData> >, std::__1::default_delete<std::__1::vector<gcm::EncryptionData, std::__1::allocator<gcm::EncryptionData> > > >)>::Run(base::internal::BindStateBase*, bool, std::__1::unique_ptr<std::__1::vector<gcm::EncryptionData, std::__1::allocator<gcm::EncryptionData> >, std::__1::default_delete<std::__1::vector<gcm::EncryptionData, std::__1::allocator<gcm::EncryptionData> > > >&&)
0x000000010da4243e	(Google Chrome Framework -callback.h:65 )	void leveldb_proto::(anonymous namespace)::RunLoadCallback<gcm::EncryptionData>(leveldb_proto::ProtoDatabase<gcm::EncryptionData>::LoadCallback, bool*, std::__1::unique_ptr<std::__1::vector<gcm::EncryptionData, std::__1::allocator<gcm::EncryptionData> >, std::__1::default_delete<std::__1::vector<gcm::EncryptionData, std::__1::allocator<gcm::EncryptionData> > > >)
0x000000010da426c1	(Google Chrome Framework -bind_internal.h:166 )	base::internal::Invoker<base::internal::BindState<void (*)(base::OnceCallback<void (bool, std::__1::unique_ptr<std::__1::vector<gcm::EncryptionData, std::__1::allocator<gcm::EncryptionData> >, std::__1::default_delete<std::__1::vector<gcm::EncryptionData, std::__1::allocator<gcm::EncryptionData> > > >)>, bool*, std::__1::unique_ptr<std::__1::vector<gcm::EncryptionData, std::__1::allocator<gcm::EncryptionData> >, std::__1::default_delete<std::__1::vector<gcm::EncryptionData, std::__1::allocator<gcm::EncryptionData> > > >), base::OnceCallback<void (bool, std::__1::unique_ptr<std::__1::vector<gcm::EncryptionData, std::__1::allocator<gcm::EncryptionData> >, std::__1::default_delete<std::__1::vector<gcm::EncryptionData, std::__1::allocator<gcm::EncryptionData> > > >)>, base::internal::OwnedWrapper<bool>, base::internal::PassedWrapper<std::__1::unique_ptr<std::__1::vector<gcm::EncryptionData, std::__1::allocator<gcm::EncryptionData> >, std::__1::default_delete<std::__1::vector<gcm::EncryptionData, std::__1::allocator<gcm::EncryptionData> > > > > >, void ()>::RunOnce(base::internal::BindStateBase*)
0x000000010b6c1406	(Google Chrome Framework -callback.h:65 )	base::(anonymous namespace)::PostTaskAndReplyRelay::RunReplyAndSelfDestruct()
0x000000010b64a10b	(Google Chrome Framework -callback.h:65 )	base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*)
0x000000010b66ec53	(Google Chrome Framework -message_loop.cc:399 )	base::MessageLoop::RunTask(base::PendingTask*)
0x000000010b66f158	(Google Chrome Framework -message_loop.cc:411 )	base::MessageLoop::DoWork()
0x000000010b670f79	(Google Chrome Framework -message_pump_mac.mm:453 )	base::MessagePumpCFRunLoopBase::RunWork()
0x000000010b662a39	(Google Chrome Framework + 0x01dcaa39 )	base::mac::CallWithEHFrame(void () block_pointer)
0x000000010b67089e	(Google Chrome Framework -message_pump_mac.mm:429 )	base::MessagePumpCFRunLoopBase::RunWorkSource(void*)
0x00007fff8bca2320	(CoreFoundation + 0x000a7320 )	__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__
0x00007fff8bc8321c	(CoreFoundation + 0x0008821c )	__CFRunLoopDoSources0
0x00007fff8bc82715	(CoreFoundation + 0x00087715 )	__CFRunLoopRun
0x00007fff8bc82113	(CoreFoundation + 0x00087113 )	CFRunLoopRunSpecific
0x00007fff8b1e2ebb	(HIToolbox + 0x00030ebb )	RunCurrentEventLoopInMode
0x00007fff8b1e2cf0	(HIToolbox + 0x00030cf0 )	ReceiveNextEventCommon
0x00007fff8b1e2b25	(HIToolbox + 0x00030b25 )	_BlockUntilNextEventMatchingListInModeWithFilter
0x00007fff8977ba53	(AppKit + 0x00046a53 )	_DPSNextEvent
0x00007fff89ef77ed	(AppKit + 0x007c27ed )	-[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:]
0x000000010b2a60df	(Google Chrome Framework -chrome_browser_application_mac.mm:174 )	__71-[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:]_block_invoke
0x000000010b662a39	(Google Chrome Framework + 0x01dcaa39 )	base::mac::CallWithEHFrame(void () block_pointer)
0x000000010b2a6023	(Google Chrome Framework -chrome_browser_application_mac.mm:173 )	-[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:]
0x00007fff897703da	(AppKit + 0x0003b3da )	-[NSApplication run]
0x000000010b67183b	(Google Chrome Framework -message_pump_mac.mm:806 )	base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*)
0x000000010b6703bd	(Google Chrome Framework -message_pump_mac.mm:180 )	base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*)
0x000000010b694524	(Google Chrome Framework -run_loop.cc:130 )	<name omitted>
0x000000010b2abf17	(Google Chrome Framework -chrome_browser_main.cc:1973 )	ChromeBrowserMainParts::MainMessageLoopRun(int*)
0x000000010a01c323	(Google Chrome Framework -browser_main_loop.cc:1236 )	content::BrowserMainLoop::RunMainMessageLoopParts()
0x000000010a01ecf1	(Google Chrome Framework -browser_main_runner.cc:145 )	content::BrowserMainRunnerImpl::Run()
0x000000010a01891b	(Google Chrome Framework -browser_main.cc:46 )	content::BrowserMain(content::MainFunctionParams const&)
0x000000010b25ed3f	(Google Chrome Framework -content_main_runner.cc:717 )	content::ContentMainRunnerImpl::Run()
0x000000010cb74fba	(Google Chrome Framework -main.cc:456 )	service_manager::Main(service_manager::MainParams const&)
0x000000010b25e283	(Google Chrome Framework -content_main.cc:19 )	content::ContentMain(content::ContentMainParams const&)
0x000000010989be69	(Google Chrome Framework -chrome_main.cc:129 )	ChromeMain
0x0000000109830dd3	(Google Chrome -chrome_exe_main_mac.cc:165 )	main
0x00007fffa140a234	(libdyld.dylib + 0x00005234 )	start
0x00007fffa140a234	(libdyld.dylib + 0x00005234 )	start

Note: Issue available for this stack trace ref issue 818594
1) This is browser crash listed under beta build 65.0.3325.106 for Mac OS on 4 different client ID's.
2) Currently this crash is ranked as number #2 with 7 instances

Link to the list of builds:
---------------------------
https://crash.corp.google.com/browse?q=product.name%3D%27Chrome_Mac%27%20%20AND%20expanded_custom_data.ChromeCrashProto.ptype%3D%27browser%27%20AND%20expanded_custom_data.ChromeCrashProto.magic_signature_1.name%3D%27gcm%3A%3AGCMKeyStore%3A%3ADidLoadKeys%27#-samplereports,productversion:1000,-magicsignature:50,-magicsignature2:50,-stablesignature:50,-magicsignaturesorted:50

Making the status to Untriaged so that the issue would get addressed.

Thank You!
Cc: -rtenneti@chromium.org
Owner: rch@chromium.org
Status: Assigned (was: Untriaged)
dbote@ or  rbasuvula@ please let us know which script you are using(We need to know which GFE server it's pointing to)

Comment 4 by rch@chromium.org, Mar 7 2018

Cc: rch@chromium.org
Components: -Internals>Network>QUIC Services>CloudMessaging
Owner: pbomm...@chromium.org
Summary: Browser gets crashed after navigating to 'youtube.com'. (was: [QUIC] Browser gets crashed after navigating to 'youtube.com'.)
This crash appears to be in the gcm code not in QUIC so I don't think QUIC is to blame.  Adding the CloudMessaging component. Assigning back to  pbommana to triage. Please feel free to assign back to me if there's more evidence that it's QUIC.
Project Member

Comment 5 by sheriffbot@chromium.org, Mar 8 2018

Labels: FoundIn-M-65 Fracas
Users experienced this crash on the following builds:

Mac Beta 65.0.3325.106 -  0.20 CPM, 12 reports, 5 clients (signature gcm::GCMKeyStore::DidLoadKeys)

If this update was incorrect, please add "Fracas-Wrong" label to prevent future updates.

- Go/Fracas

Comment 6 by db...@etouch.net, Mar 8 2018

With respect to comment 3: 

Please find shared the QUIC script file (Mac) in a drive (https://drive.google.com/drive/folders/1eaQ_pO9hizuIh3BfRqQI3a9sqn3skQRf).

Rechecked above crash on Mac(10.12.6) OS using M-66 Dev build # 66.0.3359.15 & M-67 Canary build # 67.0.3365.0, and issue is not reproducing. 

Please review attached screen cast for the same.

Thank you.
Latest Dev behavior.mov
3.9 MB View Download
Mergedinto: 818594
Status: Duplicate (was: Assigned)

Sign in to add a comment