New issue
Advanced search Search tips

Issue 843845 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: May 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Android
Pri: 2
Type: Bug



Sign in to add a comment

Spellcheck crash in chrome://flags on Android

Project Member Reported by rlanday@chromium.org, May 17 2018

Issue description

Chrome Version: 68.0.3433.0 (Developer Build) unknown (32-bit)
OS: Android 8.1.0

What steps will reproduce the problem?
(1) Go to chrome://flags
(2) Tap the "Search flags" box
(3) Start typing

What is the expected result?

Should not crash

What happens instead?

Chrome usually crashes with the error:

[FATAL:spellcheck.mojom.cc(758)] Check failed: !connected. SpellCheckHost::RequestTextCheckCallback was destroyed without first either being run or its corresponding binding being closed. It is an error to drop response callbacks which still correspond to an open interface pipe.

Attaching a full stack trace.
 
spellcheck_trace_symbolized
38.3 KB View Download
RequestTextCheckCallback shouldn't be removed without being called, unless it's due to message pipe closing.

As SpellCheckerSessionBridge::DisconnectSession() is the only way to clear an uncalled callback without closing the pipe, we should send some dummy results before clearing it.
Project Member

Comment 2 by bugdroid1@chromium.org, May 21 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ea417ed7d1095989591fa9540549dbd27c23517d

commit ea417ed7d1095989591fa9540549dbd27c23517d
Author: Xiaocheng Hu <xiaochengh@chromium.org>
Date: Mon May 21 18:41:21 2018

[Spellchecker] Ensure that we don't remove uncalled RequestTextCheckCallback on Android

Mojo doesn't allow removing an uncalled mojo callback while the message pipe is
still open.

On Android, SpellCheckerSessionBridge::DisconnectSession() can discard pending
requests while the message pipe is still open, violating the requirement. This
patch fixes it by running the callbacks with empty result before removing them.

Bug:  843845 
Change-Id: I2ab4d51eeb43e63d9715eb42187d51656886fea5
Reviewed-on: https://chromium-review.googlesource.com/1065148
Reviewed-by: Rachel Blum <groby@chromium.org>
Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#560317}
[modify] https://crrev.com/ea417ed7d1095989591fa9540549dbd27c23517d/components/spellcheck/browser/spellchecker_session_bridge_android.cc

Status: Fixed (was: Assigned)
Verified in 68.0.3437.0 build

Sign in to add a comment