New issue
Advanced search Search tips

Issue 831573 link

Starred by 1 user

Issue metadata

Status: Unconfirmed
Owner: ----
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug



Sign in to add a comment

Crash in setup.exe prevents opening, uninstalling, and installing Chrome

Reported by cameron...@gmail.com, Apr 11 2018

Issue description

UserAgent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:30.0) Gecko/20100101 Firefox/30.0

Steps to reproduce the problem:
Attempting to uninstall Chrome, install the most recent standalone version, or even opening Chrome will result in setup.exe crashing.

What is the expected behavior?
Even if the updater is broken I should be able to uninstall Chrome and re-install the latest version. However, it seems the updater runs during both uninstallation and installation, causing the same crash.

What went wrong?
setup.exe crashes, causing uninstallation to fail, installation to fail, and Chrome not to open when started. Basically, I no longer have use of Chrome on my PC but can't reinstall it.

I've put a full minidump here (it's too large to attach): https://www.dropbox.com/s/xalsifnawv2udff/setup.7z?dl=1

The call stack is:

>	setup.exe!base::debug::BreakDebugger()  Line 21	C++
 	setup.exe!logging::LogMessage::~LogMessage()  Line 842 + 0x5 bytes	C++
 	setup.exe!logging::Win32ErrorLogMessage::~Win32ErrorLogMessage()  Line 963 + 0xc bytes	C++
 	setup.exe!crashpad::internal::ScopedKernelHANDLECloseTraits::Free()  Line 28 + 0x31 bytes	C++
 	setup.exe!base::ScopedGeneric<void *,crashpad::internal::ScopedKernelHANDLECloseTraits>::reset()  Line 103 + 0x12 bytes	C++
 	setup.exe!crashpad::ExceptionHandlerServer::Run()  Line 329 + 0x3e bytes	C++
 	setup.exe!crashpad::HandlerMain()  Line 799 + 0x15 bytes	C++
 	setup.exe!crash_reporter::RunAsCrashpadHandler()  Line 89 + 0xb bytes	C++
 	setup.exe!wWinMain()  Line 1287 + 0x2e bytes	C++
 	setup.exe!__scrt_common_main_seh()  Line 283 + 0x21 bytes	C++
 	kernel32.dll!000000007722652d() 	
 	[Frames below may be incorrect and/or missing, no symbols loaded for kernel32.dll]	
 	ntdll.dll!000000007735c521() 	

Did this work before? N/A 

Chrome version: 65.0.3325.181  Channel: stable
OS Version: 6.1 (Windows 7, Windows Server 2008 R2)
Flash Version: n/a
 
Local State
95.7 KB View Download
If there's anything I can do to help debug this, please let me know. I'm a programmer so I have windbg, etc. installed.
Cc: susan.boorgula@chromium.org
Labels: Needs-Feedback Triaged-ET Needs-Triage-M65
cameron314@ Thanks for the issue.

Tested this issue on Windows 10 and Mac OS 10.13.6 on the reported version 65.0.3325.181 and the latest Canary 67.0.3395.0 and unable to reproduce the issue.
Able to uninstall and Install Chrome without any issues and no crashes are observed.

Request you to provide the Crash ID from chrome://crashes which will help in further triaging of the issue.

Thanks..


I can't access chrome://crashes because I can't launch Chrome. I assumed it was just exiting after the updater (setup.exe) crashed, but digging a little deeper reveals that chrome.exe is also crashing, and generating minidumps in %LOCALAPPDATA%\Google\Chrome\User Data\Crashpad\reports. It looks like Chrome is crashing with a very similar callstack:

>	chrome.exe!base::debug::BreakDebugger()  Line 21	C++
 	chrome.exe!logging::LogMessage::~LogMessage()  Line 842 + 0x5 bytes	C++
 	chrome.exe!logging::Win32ErrorLogMessage::~Win32ErrorLogMessage()  Line 963 + 0xc bytes	C++
 	chrome.exe!crashpad::internal::ScopedKernelHANDLECloseTraits::Free()  Line 28 + 0x31 bytes	C++
 	chrome.exe!base::ScopedGeneric<void *,crashpad::internal::ScopedKernelHANDLECloseTraits>::reset()  Line 103 + 0x12 bytes	C++
 	chrome.exe!crashpad::ExceptionHandlerServer::Run()  Line 329 + 0x3e bytes	C++
 	chrome.exe!crashpad::HandlerMain()  Line 799 + 0x15 bytes	C++
 	chrome.exe!crash_reporter::RunAsCrashpadHandler()  Line 89 + 0xb bytes	C++
 	chrome.exe!wWinMain()  Line 205 + 0x1a bytes	C++
 	chrome.exe!__scrt_common_main_seh()  Line 283 + 0x21 bytes	C++

I've placed a copy of the most recent minidump here: https://www.dropbox.com/s/05zpdy0y83e0eu8/4177bb5d-2efc-491e-8194-52d0368b0148.dmp?dl=1 ('Attach a file' doesn't seem to work in the comment section in Firefox.)

I'm running Windows 7 64-bit.
Project Member

Comment 4 by sheriffbot@chromium.org, Apr 12 2018

Labels: -Needs-Feedback
Thank you for providing more feedback. Adding the requester to the cc list.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 5 by woxxom@gmail.com, Apr 12 2018

Maybe you can find the regression range yourself:
https://www.chromium.org/developers/bisect-builds-py

A debug log could be helpful too:
https://www.chromium.org/for-testers/enable-logging
Aha, there was an existing log in C:\Program Files (x86)\Google\Chrome\Application\debug.log:

    [0411/082512.165:FATAL:scoped_handle.cc(28)] : The handle is invalid. (0x6)
    [0411/082512.977:ERROR:registration_protocol_win.cc(56)] CreateFile: The system cannot find the file specified. (0x2)
    [0411/082613.723:ERROR:crashpad_client_win.cc(174)] crash server did not respond, self-terminating

This matches the callstack in the dumps, but doesn't explain why the handle was invalid.

Looking at the source code (https://github.com/electron/crashpad/blob/master/util/win/exception_handler_server.cc#L309) there's no way the handle could be invalid during the call to reset(), since it's a default-constructed handle object with the canonical default value for a kernel handle. Looks like stack corruption -- perhaps the latest builds with clang are to blame?

I'll try to bisect...

Bisecting went nowhere, unfortunately. Every build it downloaded launched successfully.

Logging with verbosity v=4 gives:

[4528:4608:0412/110820.777:ERROR:cache_util_win.cc(20)] Unable to move the cache: 5
[4528:4608:0412/110820.777:ERROR:cache_util.cc(134)] Unable to move cache folder C:\Users\Cameron\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache to C:\Users\Cameron\AppData\Local\Google\Chrome\User Data\ShaderCache\old_GPUCache_000
[4528:4608:0412/110820.780:ERROR:disk_cache.cc(169)] Unable to create cache
[4528:4608:0412/110820.780:ERROR:shader_disk_cache.cc(601)] Shader Cache Creation failed: -2
[5064:4984:0412/110821.110:ERROR:gl_surface_egl.cc(840)] eglInitialize D3D11 failed with error EGL_NOT_INITIALIZED, trying next display type

If I manually remove the cache folder, the first error goes away, and the log shows just:

[3004:4520:0412/111434.792:ERROR:gl_surface_egl.cc(840)] eglInitialize D3D11 failed with error EGL_NOT_INITIALIZED, trying next display type

I'm not sure these errors are related. The C:\Program Files (x86)\Google\Chrome\Application\debug.log file continues to accumulate entries like:

[0412/111433.968:FATAL:scoped_handle.cc(28)] : The handle is invalid. (0x6)
[0412/111434.206:ERROR:registration_protocol_win.cc(56)] CreateFile: The system cannot find the file specified. (0x2)
[0412/111534.445:ERROR:crashpad_client_win.cc(174)] crash server did not respond, self-terminating

which seem much more related to the crash in question.

Comment 8 by grt@chromium.org, Apr 16 2018

Cc: scottmg@chromium.org
Components: -Internals>Installer Internals>CrashReporting
Switching to the crash component so that the right folks see this. Is this happening at startup or shutdown? ERROR_INVALID_HANDLE would happen if something else in the process was closing the handle. Windows re-uses handle values aggressively, so there could be a double-free.
Thanks. It's happening immediately during startup, in both setup.exe and chrome.exe.
Labels: TE-NeedsTriageHelp
As Issue is not reproducible from TE end adding TE-NeedsTriageHelp lablel to remove this out of TE triaging bucket. Could someone from Internals>CrashReporting team please have a look at this issue.

Thanks!

Comment 11 by woxxom@gmail.com, Apr 26 2018

Since it crashes during ExceptionHandlerServer::Run() which creates named pipes, maybe it's similar to  bug 700615 .

Sign in to add a comment