Crash in subtle::PrefMemberBase::Internal::UpdateValue() |
||
Issue descriptionThis bug is created based on crbug.com/812855#c1 (which was not related to the description of issue 812855 ). Tested on 66.0.3349.0 Canary in iPhoneX(iOS 11.2.5) Followed steps in comment #0 crash happening on tapping the '2 step verification' button. Note: Not able to reproduce on M65 Link to video: https://drive.google.com/file/d/1zruGwjHQC8dcSy1-aRSBympnwBsI0s3y/view?usp=sharing Crash ID: https://crash.corp.google.com/browse?stbtiq=beda76ad0463c27b#0 Crash logs: Stack Quality84%Show frame trust levels 0x00000001853c96bc (libobjc.A.dylib + 0x000116bc ) lookUpImpOrForward 0x00000001853c96b0 (libobjc.A.dylib + 0x000116b0 ) lookUpImpOrForward 0x00000001853d4754 (libobjc.A.dylib + 0x0001c754 ) _objc_msgSend_uncached 0x00000001032637c0 (Chrome -pref_backed_boolean.mm:19 ) (anonymous namespace)::OnChange(id<ObservableBoolean>) 0x0000000103263958 (Chrome -bind_internal.h:166 ) void base::internal::Invoker<base::internal::BindState<void (*)(id<ObservableBoolean>), base::internal::UnretainedWrapper<PrefBackedBoolean> >, void ()>::RunImpl<void const(&)(id<ObservableBoolean>), std::__1::tuple<PrefBackedBoolean> const&, 0ul>(void const(&&&)(id<ObservableBoolean>), std::__1::tuple<PrefBackedBoolean> const&&&, void const(&)(id<ObservableBoolean>)::integer_sequence<unsigned long, 0ul>) 0x0000000103660b1c (Chrome -callback.h:65 ) base::ScopedClosureRunner::~ScopedClosureRunner() 0x0000000103ba0e88 (Chrome -pref_member.cc:121 ) subtle::PrefMemberBase::Internal::UpdateValue(base::Value*, bool, bool, base::OnceCallback<void ()>) const 0x0000000103ba0cb4 (Chrome -pref_member.cc:74 ) subtle::PrefMemberBase::UpdateValueFromPref(base::RepeatingCallback<void ()> const&) const 0x0000000103ba0d68 (Chrome -pref_member.cc:64 ) subtle::PrefMemberBase::OnPreferenceChanged(PrefService*, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) 0x0000000103ba1bb0 (Chrome -pref_notifier_impl.cc:111 ) PrefNotifierImpl::FireObservers(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) 0x0000000103ba6048 (Chrome -pref_value_store.cc:141 ) PrefValueStore::NotifyPrefChanged(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, PrefValueStore::PrefStoreType) 0x0000000103b9dd3c (Chrome -json_pref_store.cc:307 ) JsonPrefStore::ReportValueChanged(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, unsigned int) 0x0000000103b9d4d8 (Chrome -json_pref_store.cc:210 ) JsonPrefStore::SetValue(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::unique_ptr<base::Value, std::__1::default_delete<base::Value> >, unsigned int) 0x0000000103ba400c (Chrome -pref_service.cc:535 ) PrefService::SetUserPrefValue(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::unique_ptr<base::Value, std::__1::default_delete<base::Value> >) 0x0000000103ba3f7c (Chrome -pref_service.cc:395 ) PrefService::Set(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, base::Value const&) 0x0000000103fe44cc (Chrome -pref_model_associator.cc:132 ) sync_preferences::PrefModelAssociator::InitPrefAndAssociate(syncer::SyncData const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::vector<syncer::SyncChange, std::__1::allocator<syncer::SyncChange> >*) 0x0000000103fe4c14 (Chrome -pref_model_associator.cc:202 ) sync_preferences::PrefModelAssociator::MergeDataAndStartSyncing(syncer::ModelType, std::__1::vector<syncer::SyncData, std::__1::allocator<syncer::SyncData> > const&, std::__1::unique_ptr<syncer::SyncChangeProcessor, std::__1::default_delete<syncer::SyncChangeProcessor> >, std::__1::unique_ptr<syncer::SyncErrorFactory, std::__1::default_delete<syncer::SyncErrorFactory> >) 0x0000000103bdd3c0 (Chrome -shared_change_processor.cc:120 ) syncer::SharedChangeProcessor::StartAssociation(base::RepeatingCallback<void (syncer::DataTypeController::ConfigureResult, syncer::SyncMergeResult const&, syncer::SyncMergeResult const&)>, syncer::SyncClient*, syncer::GenericChangeProcessorFactory*, syncer::UserShare*, std::__1::unique_ptr<syncer::DataTypeErrorHandler, std::__1::default_delete<syncer::DataTypeErrorHandler> >) 0x0000000103bc6e74 (Chrome -bind_internal.h:211 ) void base::internal::FunctorTraits<void (syncer::SharedChangeProcessor::*)(base::RepeatingCallback<void (syncer::DataTypeController::ConfigureResult, syncer::SyncMergeResult const&, syncer::SyncMergeResult const&)>, syncer::SyncClient*, syncer::GenericChangeProcessorFactory*, syncer::UserShare*, std::__1::unique_ptr<syncer::DataTypeErrorHandler, std::__1::default_delete<syncer::DataTypeErrorHandler> >), void>::Invoke<scoped_refptr<syncer::SharedChangeProcessor> const&, base::RepeatingCallback<void (syncer::DataTypeController::ConfigureResult, syncer::SyncMergeResult const&, syncer::SyncMergeResult const&)> const&, syncer::SyncClient* const&, syncer::GenericChangeProcessorFactory* const&, syncer::UserShare* const&, std::__1::unique_ptr<syncer::DataTypeErrorHandler, std::__1::default_delete<syncer::DataTypeErrorHandler> > >(void (syncer::SharedChangeProcessor::*)(base::RepeatingCallback<void (syncer::DataTypeController::ConfigureResult, syncer::SyncMergeResult const&, syncer::SyncMergeResult const&)>, syncer::SyncClient*, syncer::GenericChangeProcessorFactory*, syncer::UserShare*, std::__1::unique_ptr<syncer::DataTypeErrorHandler, std::__1::default_delete<syncer::DataTypeErrorHandler> >), scoped_refptr<syncer::SharedChangeProcessor> const&&&, base::RepeatingCallback<void (syncer::DataTypeController::ConfigureResult, syncer::SyncMergeResult const&, syncer::SyncMergeResult const&)> const&&&, syncer::SyncClient* const&&&, syncer::GenericChangeProcessorFactory* const&&&, syncer::UserShare* const&&&, std::__1::unique_ptr<syncer::DataTypeErrorHandler, std::__1::default_delete<syncer::DataTypeErrorHandler> >&&) 0x0000000103bc6d94 (Chrome -bind_internal.h:368 ) void base::internal::Invoker<base::internal::BindState<void (syncer::SharedChangeProcessor::*)(base::RepeatingCallback<void (syncer::DataTypeController::ConfigureResult, syncer::SyncMergeResult const&, syncer::SyncMergeResult const&)>, syncer::SyncClient*, syncer::GenericChangeProcessorFactory*, syncer::UserShare*, std::__1::unique_ptr<syncer::DataTypeErrorHandler, std::__1::default_delete<syncer::DataTypeErrorHandler> >), scoped_refptr<syncer::SharedChangeProcessor>, base::RepeatingCallback<void (syncer::DataTypeController::ConfigureResult, syncer::SyncMergeResult const&, syncer::SyncMergeResult const&)>, syncer::SyncClient*, syncer::GenericChangeProcessorFactory*, syncer::UserShare*, base::internal::PassedWrapper<std::__1::unique_ptr<syncer::DataTypeErrorHandler, std::__1::default_delete<syncer::DataTypeErrorHandler> > > >, void ()>::RunImpl<void (syncer::SharedChangeProcessor::* const&)(base::RepeatingCallback<void (syncer::DataTypeController::ConfigureResult, syncer::SyncMergeResult const&, syncer::SyncMergeResult const&)>, syncer::SyncClient*, syncer::GenericChangeProcessorFactory*, syncer::UserShare*, std::__1::unique_ptr<syncer::DataTypeErrorHandler, std::__1::default_delete<syncer::DataTypeErrorHandler> >), std::__1::tuple<scoped_refptr<syncer::SharedChangeProcessor>, base::RepeatingCallback<void (syncer::DataTypeController::ConfigureResult, syncer::SyncMergeResult const&, syncer::SyncMergeResult const&)>, syncer::SyncClient*, syncer::GenericChangeProcessorFactory*, syncer::UserShare*, base::internal::PassedWrapper<std::__1::unique_ptr<syncer::DataTypeErrorHandler, std::__1::default_delete<syncer::DataTypeErrorHandler> > > > const&, 0ul, 1ul, 2ul, 3ul, 4ul, 5ul>(void (syncer::SharedChangeProcessor::* const&&&)(base::RepeatingCallback<void (syncer::DataTypeController::ConfigureResult, syncer::SyncMergeResult const&, syncer::SyncMergeResult const&)>, syncer::SyncClient*, syncer::GenericChangeProcessorFactory*, syncer::UserShare*, std::__1::unique_ptr<syncer::DataTypeErrorHandler, std::__1::default_delete<syncer::DataTypeErrorHandler> >), std::__1::tuple<scoped_refptr<syncer::SharedChangeProcessor>, base::RepeatingCallback<void (syncer::DataTypeController::ConfigureResult, syncer::SyncMergeResult const&, syncer::SyncMergeResult const&)>, syncer::SyncClient*, syncer::GenericChangeProcessorFactory*, syncer::UserShare*, base::internal::PassedWrapper<std::__1::unique_ptr<syncer::DataTypeErrorHandler, std::__1::default_delete<syncer::DataTypeErrorHandler> > > > const&&&, std::__1::integer_sequence<unsigned long, 0ul, 1ul, 2ul, 3ul, 4ul, 5ul>) 0x000000010366349c (Chrome -callback.h:65 ) base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) 0x000000010367ac44 (Chrome -message_loop.cc:395 ) base::MessageLoop::RunTask(base::PendingTask*) 0x000000010367b084 (Chrome -message_loop.cc:407 ) base::MessageLoop::DoWork() 0x00000001036cba70 (Chrome -message_pump_mac.mm:462 ) base::MessagePumpCFRunLoopBase::RunWork() 0x00000001036cb4f8 (Chrome -message_pump_mac.mm:438 ) base::MessagePumpCFRunLoopBase::RunWorkSource(void*) 0x000000018611f778 (CoreFoundation + 0x000eb778 ) 0x000000018611f6f8 (CoreFoundation + 0x000eb6f8 ) 0x000000018611efd4 (CoreFoundation + 0x000eafd4 ) 0x000000018611cb58 (CoreFoundation + 0x000e8b58 ) 0x000000018603cc54 (CoreFoundation + 0x00008c54 ) 0x0000000187ee8f80 (GraphicsServices + 0x0000af80 ) 0x000000018f7955c0 (UIKit + 0x000735c0 ) 0x0000000102f328d0 (Chrome -chrome_exe_main.mm:54 ) main 0x0000000185b5c568 (libdyld.dylib + 0x00001568 )
,
Mar 26 2018
jlebel: Is this sign in related?
,
Mar 27 2018
I can't reproduced with top of tree (M67). |
||
►
Sign in to add a comment |
||
Comment 1 by jlebel@chromium.org
, Mar 23 2018