Tested the issue in Android and able to reproduce the issue. 

Steps Followed:
1. Launch Chrome.
2. Navigate to any URL - https://codepen.io/anon/pen/BrEQbv 
3. Tap on “Choose File” button
4. Observed that “Unfortunately, Chrome Beta has stopped.” message.

Chrome versions tested:
66.0.3359.106(Beta), 67.0.3395.0(Canary)

OS:
Android 4.4.4

Android Devices:
Sony C6902

Using the per-revision bisect providing the bisect results,
Good Build - 66.0. 3336.0  (533409)
Bad Build - 66.0. 3338.0  (534242)

You are looking for a change made after 533411(GOOD), but before 533412(BAD).

CHANGELOG URL:
The script might not always return single CL as suspect as some perf builds might get missing due to failure.
https://chromium.googlesource.com/chromium/src/+/7ee6c14b661b0abdfb91f8f0c8a07c34f1d353bc

From the CL above, assigning the issue to the owner concerned.

@agrieve:  Could you please look into the issue, pardon me if it has nothing to do with your changes and if possible please assign it to owner concerned.

Please navigate to below link for log's--
go/chrome-androidlogs/831953

Note: 
1. This issue is not observed in Desktop.
2. Issue is not observed on Android 7.0 and above devices. Verified on Samsung J7 Android 7.0.0 and Pixel 2 XL Android 8.1.0

Thanks!

This issue is marked as a release blocker with no milestone associated. Please add an appropriate milestone.

All release blocking issues should have milestones associated to it, so that the issue can tracked and the fixes can be pushed promptly.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

	agrieve@ are you planning to fix this issue?

Sorry, yes. Fixed it last week but review is going slowly. Will TBR it today if I ping doesn't work:
https://chromium-review.googlesource.com/c/chromium/src/+/1011667

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9e4b4571b7836b0ddbfce77b1dd710fa5988fc7d

commit 9e4b4571b7836b0ddbfce77b1dd710fa5988fc7d
Author: Andrew Grieve <agrieve@chromium.org>
Date: Wed Apr 18 12:21:34 2018

Android: Fix crash when trying to select a photo from an <input>

Bug:  831953 
Change-Id: I9e3c697d25a0754fad18a45f7a0a19c721e54e9c
Reviewed-on: https://chromium-review.googlesource.com/1011667
Commit-Queue: agrieve <agrieve@chromium.org>
Reviewed-by: Peter Beverloo <peter@chromium.org>
Cr-Commit-Position: refs/heads/master@{#551640}
[modify] https://crrev.com/9e4b4571b7836b0ddbfce77b1dd710fa5988fc7d/chrome/android/java/src/org/chromium/chrome/browser/photo_picker/DecoderService.java

Requesting merge to 66 (where this was reported in). Did M66 ship already? This is a small change and <input> tags for images don't work at all without it.

This bug requires manual review: Request affecting a post-stable build
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), josafat@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

M66 is already out.

Oh well then, let's merge to M67?

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f248278a23c62358aff045ce221cc2370c39f95b

commit f248278a23c62358aff045ce221cc2370c39f95b
Author: Andrew Grieve <agrieve@chromium.org>
Date: Thu Apr 19 11:48:35 2018

Android: Fix crash when trying to select a photo from an <input>

TBR=agrieve@chromium.org

(cherry picked from commit 9e4b4571b7836b0ddbfce77b1dd710fa5988fc7d)

Bug:  831953 
Change-Id: I9e3c697d25a0754fad18a45f7a0a19c721e54e9c
Reviewed-on: https://chromium-review.googlesource.com/1011667
Commit-Queue: agrieve <agrieve@chromium.org>
Reviewed-by: Peter Beverloo <peter@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#551640}
Reviewed-on: https://chromium-review.googlesource.com/1018882
Reviewed-by: agrieve <agrieve@chromium.org>
Cr-Commit-Position: refs/branch-heads/3396@{#123}
Cr-Branched-From: 9ef2aa869bc7bc0c089e255d698cca6e47d6b038-refs/heads/master@{#550428}
[modify] https://crrev.com/f248278a23c62358aff045ce221cc2370c39f95b/chrome/android/java/src/org/chromium/chrome/browser/photo_picker/DecoderService.java

 Issue 834395  has been merged into this issue.

 Issue 836923  has been merged into this issue.

Let me reopen this and increase priority -

We're still getting many reports of users finding this in the wild, both on Twitter and through feedback from large partners directly.

https://twitter.com/JulZ_RulZ_NY/status/989701500359372800
https://mobile.twitter.com/Homan4Potusa/status/989574773544927232
https://twitter.com/GeekyAshLee/status/987546204547485697

Andrew, Estelle, since this completely blocks an important use-case—being able to upload photos—we need to consider to (a) either do a post-stable merge to M66, or (b) disable the photo picker altogether.

If there will be a re-spin then my preference would be to take that route, since the feature has been available for quite some milestones already. In either case it's important that we figure out how to prevent this from happening again in the future too.

I'd be in favour of a respin. Being able to use <input> to upload a file seems like pretty core functionality.

Same here. I think we should respin.

Here's the post-mortem on the issue...
https://docs.google.com/document/d/1T_sKQprG8dR8Zd2RIzpSP5CRDmJWsydFyEW7nvkFg0U/edit?ts=5ae33ba9
(Sorry, Googler's only)

+amineer

Able to repro this case per comment #16 reports.
Steps:
1. Launch Chrome, go to twitter.com 
2. Try uploading a picture 
3. "Unfortunately, Chrome has stopped." error is displayed.

Reproduced on Sasmung S3 /JZO54K - 66.0.3359.126
Verified that #13 fixed issue on - 67.0.3396.22

Just wanted to add that, while investigating  issue 836923 , I also verified the bug on 66 and that it is fixed in 67. To test, I used a Samsung Galaxy S4 GT-I9505, running Android 5.0.1.

Let's get the fix already in M66 while we still debate about the severity of this issue. Thanks!

I am stability sheriff this week and I cant seam to find an increase in crash rates because of this issue. It looks like the crash might not be reported. I tried to search on crash for reports like this but could not find any (could be an issue with proguard obfuscation in exception messages). I tried to repo the crash locally so that I can get a crash id but I am not able to report the crash. It fails to report and does not show up in chrome://crashes

Could this be because the crash happens in an isolated process (com.android.chrome:decoder_service)?

I got some crash numbers here https://listnrcrash.corp.google.com/product/282/crash/1000000000029047812?dateRange=30 I believe this is the android crash reporting. 5m crashes per day.

Merge is approved for 66, please merge, thanks.

Hello, it's good news that the fix is approved for 66. When is the date this patch is planned to be released?

 Issue 838801  has been merged into this issue.

 Issue 837980  has been merged into this issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7819759179877594bba5c08da0e99ddaddc7c621

commit 7819759179877594bba5c08da0e99ddaddc7c621
Author: Andrew Grieve <agrieve@chromium.org>
Date: Thu May 03 09:16:40 2018

Android: Fix crash when trying to select a photo from an <input>

Bug:  831953 
Change-Id: I9e3c697d25a0754fad18a45f7a0a19c721e54e9c
Reviewed-on: https://chromium-review.googlesource.com/1011667
Commit-Queue: agrieve <agrieve@chromium.org>
Reviewed-by: Peter Beverloo <peter@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#551640}(cherry picked from commit 9e4b4571b7836b0ddbfce77b1dd710fa5988fc7d)
Reviewed-on: https://chromium-review.googlesource.com/1041225
Reviewed-by: Bernhard Bauer <bauerb@chromium.org>
Cr-Commit-Position: refs/branch-heads/3359@{#793}
Cr-Branched-From: 66afc5e5d10127546cc4b98b9117aff588b5e66b-refs/heads/master@{#540276}
[modify] https://crrev.com/7819759179877594bba5c08da0e99ddaddc7c621/chrome/android/java/src/org/chromium/chrome/browser/photo_picker/DecoderService.java

+rbyers

I won't include the metrics cause this is a public bug, but if this was causing a crashing renderer bug, based on the magnitude, I'd call for a re-spin. This is more in the platform/compat issue at this stage though. I still *think* we should respin but adding Rick to speak to compat/platform risks

This is definitely very serious.

One public stat here: across all platforms, about one in every 300 page views results in someone opening the file upload chooser at least once: https://www.chromestatus.com/metrics/feature/timeline/popularity/2324

As I understand it, this makes a key platform feature (image upload) completely unavailable for users on M and below.  That's quite bad for key mobile web partners like Twitter and Facebook, as well as for users. So I also support a stable respin to fix this (assuming clank team is confident in the safety of the fix of course).

Andrew is away at the moment, but being familiar with the decoder service I have high confidence in Andrew's fix being low-risk. Any theoretical risk introduced would be contained within the decoder service and for M and below it is already crashing, so anything we do is likely to be an improvement...

For N and up there shouldn't be any impact.

Hey all,

Chiming in from the consumer ops side, we're seeing a lot of feedback reports about this issue on M66.

Here's a quick sample from today (May 3rd):
- https://listnr.corp.google.com/report/85393113545
- https://listnr.corp.google.com/report/85392763439
- https://listnr.corp.google.com/report/85392439766
- https://listnr.corp.google.com/report/85392314396
- https://listnr.corp.google.com/report/85392319865
- https://listnr.corp.google.com/report/85392277907
- https://listnr.corp.google.com/report/85392299118
- https://listnr.corp.google.com/report/85392165473
- https://listnr.corp.google.com/report/85392129274

Thanks!

There is going to be a respin next Monday 5/7

Verified that issue is fixed issue on - Sasmung S3 /JZO54K - 66.0.3359.158

Steps:
1. Launch Chrome, go to twitter.com 
2. Try uploading a picture 
3. "Unfortunately, Chrome has stopped." error is displayed.

Hi all!

This is Nico S. from Chrome-es support forum.

We have a lot of reports with this issue.

All in Android 6.0.1 with Chrome 66.0.3359.126, but seems random issue (Not all the user with Android 6.0.1 and chrome 66 have this issue).

Example post: https://productforums.google.com/d/msg/chrome-es/E7Bk3C03j2k/qZ7htNSHAwAJ

We will wait until the update to update again.

Thanks!

Issue 838148 has been merged into this issue.

Hi Nico, we are aware of the issue. Sorry for the trouble, but the fix is already checked in and should be starting to reach users soon (I was hoping today, but I don't have a good insight into where in the pipeline it stands).

Any ideas for a (temporary) work-around?

I've been getting lots of reports from users on my site (which includes a photo upload feature).

Thank you for fixing this in M66!

The fix landed in 66.0.3359.156.

The only easy temporary work-around I can think of is to also accept one (maybe obscure) type that is not an image type. Not ideal, but then the Android stock picker will be used instead of the photo picker.

Verified that issue is fixed issue on - Sasmung S3 /JZO54K - 68.0.3417.3 latest Chrome Dev channel as well, Can we close the bug if there is no pending work here?

Andrew is away. Thank you for verifying. We're monitoring on our side what the impact is. We can always reopen if need be.

Just FYI a new version of M66 is rolling out that corrects this bug, it's at 25% now and should reach 100% shortly. 

 Issue 841709  has been merged into this issue.

the issue is fixed for me now after May 7 update

Deleted: Screenshot_2018-05-12-06-03-18.png 64.2 KB

	Screenshot_2018-05-12-06-03-18.png 64.2 KB View Download

Thank you for the verification!