New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 832697 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: Jun 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Mac
Pri: 2
Type: Bug
Team-Security-UX



Sign in to add a comment

chrome.contentSettings.microphone.set('incognito_session_only') crashes the browser

Reported by cool...@gmail.com, Apr 13 2018

Issue description

UserAgent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0

Steps to reproduce the problem:
1. install the attached extension.
2. open the chrome browser in the incognito mode.
3. navigate to chrome-extension://EXTENSION_ID/coolcmd.html

What is the expected behavior?
You should see the 'OK' string in the F12 console.

What went wrong?
The browser was crashed.

Did this work before? N/A 

Does this work in other browsers? N/A

Chrome version: 66.0.3359.66 (Официальная сборка) beta (64 бит) (cohort: Beta)  Channel: beta
OS Version: 6.1 (Windows 7, Windows Server 2008 R2)
Flash Version: 

Tested in Chrome 49, 65, 66.
 
coolcmd.zip
895 bytes Download

Comment 1 by cool...@gmail.com, Apr 13 2018

I forgot one step: give the extension permission to run in incognito mode.
Components: Platform>Extensions

Comment 3 by cool...@gmail.com, Apr 14 2018

With this and 833061 issues, there is impossible to select audio output device in incognito mode.
Labels: Needs-Triage-M66
Cc: vamshi.kommuri@chromium.org
Labels: Triaged-ET Needs-Feedback
Thanks for filing the issue!

Checked the issue on reported chrome version 66.0.3359.66 using Windows 10 with the below mentioned steps.
1. Launched chrome
2. Installed the attached extension.
3. Allowed the extension to run in incognito mode.
3. Opened Incognito window.
4. Navigated to chrome-extension://EXTENSION_ID/coolcmd.html
We didn't observe any crash rather the extension was blocked. Attaching the screen shot of the same.

@Reporter: Could you please have a look at the screen shot and let us know if we have missed anything in the process. Any further inputs from your end may be helpful. 
832697.PNG
66.3 KB View Download

Comment 6 by cool...@gmail.com, Apr 16 2018

@vamshi, you should replace EXTENSION_ID with real extension ID. You can see this ID in chrome://extensions/.
Project Member

Comment 7 by sheriffbot@chromium.org, Apr 16 2018

Labels: -Needs-Feedback
Thank you for providing more feedback. Adding the requester to the cc list.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Cc: sindhu.chelamcherla@chromium.org
Components: UI>Browser>Incognito
Labels: M-68 FoundIn-68 Target-68 OS-Linux OS-Mac
Status: Untriaged (was: Unconfirmed)
Able to reproduce this issue on reported version 66.0.3359.66, on latest canary 68.0.3397.0 using Windows 10, Mac 10.13.3 and Ubuntu 14.04. i.e; Crash is seen on opening chrome-extension://EXTENSION_ID/coolcmd.html (replaced with real extension id) in Incognito mode 

This issue is seen from M-60. Hence considering this issue as Non-Regression and marking as Untriaged.


Thanks!
Cc: rhalavati@chromium.org
It looks like the crash is caused by ContentSettingsService being null in incognito mode:
https://cs.chromium.org/chromium/src/chrome/browser/extensions/api/content_settings/content_settings_api.cc?l=272&rcl=b891d95d59d0d2e98dc1d4683f91089eca2da408

If I add kServiceRedirectedInIncognito = true to ContentSettingsService, the crash disappears but I don't know if it would work correctly.
This issue seems to be indepentend of the one you mentionend in  https://crbug.com/833061#c4 . 

I don't think any of these issues are caused by the inheritance change but I guess before, you didn't have to worry about incognito permission if you set the regular mode permission.
Components: Privacy>Incognito
Owner: bauerb@chromium.org
Status: Assigned (was: Untriaged)
[Extensions Triage]: bauerb@: Can you help triage/own this?
Cc: bauerb@chromium.org
Components: Internals>Permissions
Owner: rhalavati@chromium.org
Can someone from the privacy team own this? I have not been on privacy in ~6 years :)

I probably wouldn't redirect ContentSettingsService in all cases, but just in this instance, as it is specific to split mode.

coolcmd@, sindhu.chelamcherla@, does either of you have a crash ID from chrome://crashes?

Comment 13 by cool...@gmail.com, May 14 2018

Идентификатор загруженного отчета о сбоях: bc9753c9d4f983c6. Локальный идентификатор сбоя: 3ec4b72f-5453-4713-bcdd-f2c959c9c7ce.
Thanks! Stack trace:
Thread 0 (id: 668) CRASHED [EXCEPTION_ACCESS_VIOLATION_READ @ 0x00000010 ] MAGIC SIGNATURE THREAD
0x000007feed4712d4	(chrome.dll -content_settings_api.cc:271 )	extensions::ContentSettingsContentSettingSetFunction::Run()
0x000007feebe5be57	(chrome.dll -extension_function.cc:451 )	ExtensionFunction::RunWithValidation()
0x000007feebe5d3c6	(chrome.dll -extension_function_dispatcher.cc:486 )	extensions::ExtensionFunctionDispatcher::DispatchWithCallbackInternal(ExtensionHostMsg_Request_Params const &,content::RenderFrameHost *,int,base::RepeatingCallback<void > const &)
0x000007feebe5cfc9	(chrome.dll -extension_function_dispatcher.cc:380 )	extensions::ExtensionFunctionDispatcher::Dispatch(ExtensionHostMsg_Request_Params const &,content::RenderFrameHost *,int)
0x000007feebe72a08	(chrome.dll -ipc_message_templates.h:146 )	IPC::MessageT<ExtensionHostMsg_Request_Meta,std::tuple<ExtensionHostMsg_Request_Params>,void>::Dispatch<extensions::ExtensionWebContentsObserver,extensions::ExtensionWebContentsObserver,content::RenderFrameHost,void (extensions::ExtensionWebContentsObserver::*)(content::RenderFrameHost *, const ExtensionHostMsg_Request_Params &)>
0x000007feeb598b77	(chrome.dll -extension_web_contents_observer.cc:225 )	extensions::ExtensionWebContentsObserver::OnMessageReceived(IPC::Message const &,content::RenderFrameHost *)
0x000007feeb598abe	(chrome.dll -chrome_extension_web_contents_observer.cc:106 )	extensions::ChromeExtensionWebContentsObserver::OnMessageReceived(IPC::Message const &,content::RenderFrameHost *)
0x000007feeb598118	(chrome.dll -web_contents_impl.cc:785 )	content::WebContentsImpl::OnMessageReceived(content::RenderFrameHostImpl *,IPC::Message const &)
0x000007feeb59701b	(chrome.dll -render_frame_host_impl.cc:923 )	content::RenderFrameHostImpl::OnMessageReceived(IPC::Message const &)
0x000007feeb596e6c	(chrome.dll -render_process_host_impl.cc:3072 )	content::RenderProcessHostImpl::OnMessageReceived(IPC::Message const &)
0x000007feeb596d52	(chrome.dll -ipc_channel_proxy.cc:320 )	IPC::ChannelProxy::Context::OnDispatchMessage(IPC::Message const &)
0x000007feeaf07334	(chrome.dll -task_annotator.cc:101 )	base::debug::TaskAnnotator::RunTask(char const *,base::PendingTask *)
[...]

Actually, I think this used to get the ContentSettingsStore from ExtensionPrefs, which redirected to the regular profile from incognito (see https://chromium.googlesource.com/chromium/src/+/d31e2484add25de2f07a69773d319ebc86210369^/extensions/browser/extension_prefs_factory.cc#58), so doing that for ContentSettingsService should be fine. Also +rockot, who wrote the CL to extract ContentSettingsService.
Status: Started (was: Assigned)
I take it.
Issue 842632 has been merged into this issue.
Cc: rdevlin....@chromium.org
bauerb@, redevlin.cronin@,

I checked the code and when in (1), ContentSettingsService is requested, the request finally reaches BrowserContextKeyedServiceFactory::GetBrowserContextToUse which returns nullptr for incognito profiles.

While the request is valid in this case (we are storing the content settings in incognito for incognito), do you have any comments on what is wrong? Would you suggest that I follow the path on why this service is not created and returned, or we should get the service somehow else?


(1) https://cs.chromium.org/chromium/src/chrome/browser/extensions/api/content_settings/content_settings_api.cc?rcl=b891d95d59d0d2e98dc1d4683f91089eca2da408&l=272


Right, originally the ContentSettingsStore was in ExtensionPrefs, which redirected to the regular profile when requested for an incognito profile. When the ContentSettingsService was extracted, it got the default behavior instead, which is not to have a service at all for an incognito profile. That is not what we want though, because the code in ContentSettingsContentSettingSetFunction already handles incognito profiles in the correct way, so replicating the behavior of ExtensionPrefs is the right thing to do.
Project Member

Comment 19 by bugdroid1@chromium.org, May 25 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/665ceb412fe9a28269c2fcb31115f27aee66ffd6

commit 665ceb412fe9a28269c2fcb31115f27aee66ffd6
Author: Ramin Halavati <rhalavati@chromium.org>
Date: Fri May 25 08:48:48 2018

Update ContentSettingsService access to incognito profile.

ContentSettingsService handles incognito mode requests internally, so
a flag is set to redirect incognito mode requests to the original
profile.
Also, in Set Content Settings API, incorrect use of include_incognito()
function instead of IsIncognitoEnabled() is corrected.
Two tests are added to check that all settings written in incognito
are applied and do not affect regular mode, and incognito settings
cannot be modified from regular mode.

Bug:  832697 
Bug:  845845 
Change-Id: I7fe259af6a6cbc030483ffac445bdef4b972c7cf
Reviewed-on: https://chromium-review.googlesource.com/1061853
Commit-Queue: Ramin Halavati <rhalavati@chromium.org>
Reviewed-by: Devlin <rdevlin.cronin@chromium.org>
Reviewed-by: Bernhard Bauer <bauerb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#561811}
[modify] https://crrev.com/665ceb412fe9a28269c2fcb31115f27aee66ffd6/chrome/browser/extensions/api/content_settings/content_settings_api.cc
[modify] https://crrev.com/665ceb412fe9a28269c2fcb31115f27aee66ffd6/chrome/browser/extensions/api/content_settings/content_settings_apitest.cc
[modify] https://crrev.com/665ceb412fe9a28269c2fcb31115f27aee66ffd6/chrome/browser/extensions/api/content_settings/content_settings_service.h
[add] https://crrev.com/665ceb412fe9a28269c2fcb31115f27aee66ffd6/chrome/test/data/extensions/api_test/content_settings/incognitoisolation/manifest.json
[add] https://crrev.com/665ceb412fe9a28269c2fcb31115f27aee66ffd6/chrome/test/data/extensions/api_test/content_settings/incognitoisolation/test.html
[add] https://crrev.com/665ceb412fe9a28269c2fcb31115f27aee66ffd6/chrome/test/data/extensions/api_test/content_settings/incognitoisolation/test.js

The above CL should fix the issue.
Project Member

Comment 21 by bugdroid1@chromium.org, May 25 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/05154177a10f28872ef365a0f8ae0a5630d1519e

commit 05154177a10f28872ef365a0f8ae0a5630d1519e
Author: Findit <findit-for-me@appspot.gserviceaccount.com>
Date: Fri May 25 11:18:47 2018

Revert "Update ContentSettingsService access to incognito profile."

This reverts commit 665ceb412fe9a28269c2fcb31115f27aee66ffd6.

Reason for revert:

Findit (https://goo.gl/kROfz5) identified CL at revision 561811 as the
culprit for failures in the build cycles as shown on:
https://findit-for-me.appspot.com/waterfall/culprit?key=ag9zfmZpbmRpdC1mb3ItbWVyRAsSDVdmU3VzcGVjdGVkQ0wiMWNocm9taXVtLzY2NWNlYjQxMmZlOWEyODI2OWMyZmNiMzExMTVmMjdhZWU2NmZmZDYM

Sample Failed Build: https://ci.chromium.org/buildbot/chromium.win/Win7%20Tests%20%28dbg%29%281%29/69248

Sample Failed Step: browser_tests

Original change's description:
> Update ContentSettingsService access to incognito profile.
> 
> ContentSettingsService handles incognito mode requests internally, so
> a flag is set to redirect incognito mode requests to the original
> profile.
> Also, in Set Content Settings API, incorrect use of include_incognito()
> function instead of IsIncognitoEnabled() is corrected.
> Two tests are added to check that all settings written in incognito
> are applied and do not affect regular mode, and incognito settings
> cannot be modified from regular mode.
> 
> Bug:  832697 
> Bug:  845845 
> Change-Id: I7fe259af6a6cbc030483ffac445bdef4b972c7cf
> Reviewed-on: https://chromium-review.googlesource.com/1061853
> Commit-Queue: Ramin Halavati <rhalavati@chromium.org>
> Reviewed-by: Devlin <rdevlin.cronin@chromium.org>
> Reviewed-by: Bernhard Bauer <bauerb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#561811}

Change-Id: Iaba120a3b8107c9dddbf2826b72e5e4567ee3a37
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug:  845845 
Reviewed-on: https://chromium-review.googlesource.com/1073088
Cr-Commit-Position: refs/heads/master@{#561826}
[modify] https://crrev.com/05154177a10f28872ef365a0f8ae0a5630d1519e/chrome/browser/extensions/api/content_settings/content_settings_api.cc
[modify] https://crrev.com/05154177a10f28872ef365a0f8ae0a5630d1519e/chrome/browser/extensions/api/content_settings/content_settings_apitest.cc
[modify] https://crrev.com/05154177a10f28872ef365a0f8ae0a5630d1519e/chrome/browser/extensions/api/content_settings/content_settings_service.h
[delete] https://crrev.com/5bc9ec5d869f9b6a1fa3bb99022216f9db850fe0/chrome/test/data/extensions/api_test/content_settings/incognitoisolation/manifest.json
[delete] https://crrev.com/5bc9ec5d869f9b6a1fa3bb99022216f9db850fe0/chrome/test/data/extensions/api_test/content_settings/incognitoisolation/test.html
[delete] https://crrev.com/5bc9ec5d869f9b6a1fa3bb99022216f9db850fe0/chrome/test/data/extensions/api_test/content_settings/incognitoisolation/test.js

Project Member

Comment 22 by bugdroid1@chromium.org, May 30 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d9732ad00f8dd2564a6283a67156697cfe85dbac

commit d9732ad00f8dd2564a6283a67156697cfe85dbac
Author: Ramin Halavati <rhalavati@chromium.org>
Date: Wed May 30 14:49:01 2018

Update ContentSettingsService access to incognito profile.

ContentSettingsService handles incognito mode requests internally, so
a flag is set to redirect incognito mode requests to the original
profile.
Also, in Set Content Settings API, incorrect use of include_incognito()
function instead of IsIncognitoEnabled() is corrected.
Two tests are added to check that all settings written in incognito
are applied and do not affect regular mode, and incognito settings
cannot be modified from regular mode.

Bug:  832697 
Bug:  845845 
Change-Id: I6d65f824e3e3ca2fbd218ed0bf5af1ddc15c87ef
Reviewed-on: https://chromium-review.googlesource.com/1061853
Commit-Queue: Ramin Halavati <rhalavati@chromium.org>
Reviewed-by: Devlin <rdevlin.cronin@chromium.org>
Reviewed-by: Bernhard Bauer <bauerb@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#561811}
Reviewed-on: https://chromium-review.googlesource.com/1074651
Cr-Commit-Position: refs/heads/master@{#562817}
[modify] https://crrev.com/d9732ad00f8dd2564a6283a67156697cfe85dbac/chrome/browser/extensions/api/content_settings/content_settings_api.cc
[modify] https://crrev.com/d9732ad00f8dd2564a6283a67156697cfe85dbac/chrome/browser/extensions/api/content_settings/content_settings_apitest.cc
[modify] https://crrev.com/d9732ad00f8dd2564a6283a67156697cfe85dbac/chrome/browser/extensions/api/content_settings/content_settings_service.h
[modify] https://crrev.com/d9732ad00f8dd2564a6283a67156697cfe85dbac/chrome/browser/extensions/extension_apitest.h
[add] https://crrev.com/d9732ad00f8dd2564a6283a67156697cfe85dbac/chrome/test/data/extensions/api_test/content_settings/incognitoisolation/manifest.json
[add] https://crrev.com/d9732ad00f8dd2564a6283a67156697cfe85dbac/chrome/test/data/extensions/api_test/content_settings/incognitoisolation/test.html
[add] https://crrev.com/d9732ad00f8dd2564a6283a67156697cfe85dbac/chrome/test/data/extensions/api_test/content_settings/incognitoisolation/test.js

Status: Fixed (was: Started)

Sign in to add a comment