New issue
Advanced search Search tips

Issue 846406 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: May 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 1
Type: Bug



Sign in to add a comment

Crash inside TemplateURLService::UpdateProviderFavicons

Project Member Reported by tommycli@chromium.org, May 24 2018

Issue description

Reported by pbos:

Running locally (and using Refresh) I'm seeing this browser crash. I think updates are being made that might invalidate a container that's being iterated over. MSVC callstack below.

This could perhaps due to RemoveFromMaps(existing_turl); inside TemplateURLService::RemoveFromMaps from ::Update being called while iterating over the set inside TemplateURLService::UpdateProviderFavicons. You probably have better guesses than I do, but I see no updates made to this file for 13 days so my branch should still be up to date.

Hope that helps, let me know if I can grab something else. Feel free to turn all of this email into a bug report or let me know if you want me to file one.

Best,
- Peter

>	base.dll!`anonymous namespace'::InvalidParameter(const wchar_t * expression, const wchar_t * function, const wchar_t * file, unsigned int line, unsigned __int64 reserved) Line 21	C++	Symbols loaded.
 	[External Code]		Annotated Frame
 	chrome.dll!std::_Vector_const_iterator<std::_Vector_val<std::_Simple_types<TemplateURL *> > >::operator++() Line 95	C++	Symbols loaded.
 	chrome.dll!TemplateURLService::UpdateProviderFavicons(const GURL & potential_search_url, const GURL & favicon_url) Line 598	C++	Symbols loaded.
 	chrome.dll!SearchEngineTabHelper::OnFaviconUpdated(favicon::FaviconDriver * driver, favicon::FaviconDriverObserver::NotificationIconType notification_icon_type, const GURL & icon_url, bool icon_url_changed, const gfx::Image & image) Line 167	C++	Symbols loaded.
 	chrome.dll!favicon::FaviconDriver::NotifyFaviconUpdatedObservers(favicon::FaviconDriverObserver::NotificationIconType notification_icon_type, const GURL & icon_url, bool icon_url_changed, const gfx::Image & image) Line 28	C++	Symbols loaded.
 	chrome.dll!favicon::ContentFaviconDriver::OnFaviconUpdated(const GURL & page_url, favicon::FaviconDriverObserver::NotificationIconType notification_icon_type, const GURL & icon_url, bool icon_url_changed, const gfx::Image & image) Line 163	C++	Symbols loaded.
 	chrome.dll!favicon::FaviconHandler::NotifyFaviconUpdated(const GURL & icon_url, favicon_base::IconType icon_type, const gfx::Image & image) Line 306	C++	Symbols loaded.
 	chrome.dll!favicon::FaviconHandler::SetFavicon(const GURL & icon_url, const gfx::Image & image, favicon_base::IconType icon_type) Line 256	C++	Symbols loaded.
 	chrome.dll!favicon::FaviconHandler::OnDidDownloadFavicon(favicon_base::IconType icon_type, int id, int http_status_code, const GURL & image_url, const std::vector<SkBitmap,std::allocator<SkBitmap> > & bitmaps, const std::vector<gfx::Size,std::allocator<gfx::Size> > & original_bitmap_sizes) Line 547	C++	Symbols loaded.
 	chrome.dll!base::internal::FunctorTraits<void (favicon::FaviconHandler::*)(favicon_base::IconType, int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &),void>::Invoke<void (favicon::FaviconHandler::*)(favicon_base::IconType, int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &),favicon::FaviconHandler *,favicon_base::IconType,int,int,const GURL &,const std::vector<SkBitmap,std::allocator<SkBitmap> > &,const std::vector<gfx::Size,std::allocator<gfx::Size> > &>(void(favicon::FaviconHandler::*)(favicon_base::IconType, int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &) method, favicon::FaviconHandler * && receiver_ptr, favicon_base::IconType && args, int && args, int && args, const GURL & args, const std::vector<SkBitmap,std::allocator<SkBitmap> > & args, const std::vector<gfx::Size,std::allocator<gfx::Size> > & args) Line 447	C++	Symbols loaded.
 	chrome.dll!base::internal::InvokeHelper<0,void>::MakeItSo<void (favicon::FaviconHandler::*)(favicon_base::IconType, int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &),favicon::FaviconHandler *,favicon_base::IconType,int,int,const GURL &,const std::vector<SkBitmap,std::allocator<SkBitmap> > &,const std::vector<gfx::Size,std::allocator<gfx::Size> > &>(void(favicon::FaviconHandler::*)(favicon_base::IconType, int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &) && functor, favicon::FaviconHandler * && args, favicon_base::IconType && args, int && args, int && args, const GURL & args, const std::vector<SkBitmap,std::allocator<SkBitmap> > & args, const std::vector<gfx::Size,std::allocator<gfx::Size> > & args) Line 547	C++	Symbols loaded.
 	chrome.dll!base::internal::Invoker<base::internal::BindState<void (favicon::FaviconHandler::*)(favicon_base::IconType, int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &),base::internal::UnretainedWrapper<favicon::FaviconHandler>,favicon_base::IconType>,void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)>::RunImpl<void (favicon::FaviconHandler::*)(favicon_base::IconType, int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &),std::tuple<base::internal::UnretainedWrapper<favicon::FaviconHandler>,favicon_base::IconType>,0,1>(void(favicon::FaviconHandler::*)(favicon_base::IconType, int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &) && functor, std::tuple<base::internal::UnretainedWrapper<favicon::FaviconHandler>,favicon_base::IconType> && bound, std::integer_sequence<unsigned long long,0,1>, int && unbound_args, int && unbound_args, const GURL & unbound_args, const std::vector<SkBitmap,std::allocator<SkBitmap> > & unbound_args, const std::vector<gfx::Size,std::allocator<gfx::Size> > & unbound_args) Line 621	C++	Symbols loaded.
 	chrome.dll!base::internal::Invoker<base::internal::BindState<void (favicon::FaviconHandler::*)(favicon_base::IconType, int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &),base::internal::UnretainedWrapper<favicon::FaviconHandler>,favicon_base::IconType>,void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)>::RunOnce(base::internal::BindStateBase * base, int unbound_args, int unbound_args, const GURL & unbound_args, const std::vector<SkBitmap,std::allocator<SkBitmap> > & unbound_args, const std::vector<gfx::Size,std::allocator<gfx::Size> > & unbound_args) Line 589	C++	Symbols loaded.
 	chrome.dll!base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)>::Run(int args, int args, const GURL & args, const std::vector<SkBitmap,std::allocator<SkBitmap> > & args, const std::vector<gfx::Size,std::allocator<gfx::Size> > & args) Line 97	C++	Symbols loaded.
 	chrome.dll!base::internal::CancelableCallbackImpl<base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)> >::ForwardOnce<int,int,const GURL &,const std::vector<SkBitmap,std::allocator<SkBitmap> > &,const std::vector<gfx::Size,std::allocator<gfx::Size> > &>(int args, int args, const GURL & args, const std::vector<SkBitmap,std::allocator<SkBitmap> > & args, const std::vector<gfx::Size,std::allocator<gfx::Size> > & args) Line 126	C++	Symbols loaded.
 	chrome.dll!base::internal::FunctorTraits<void (base::internal::CancelableCallbackImpl<base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)> >::*)(int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &),void>::Invoke<void (base::internal::CancelableCallbackImpl<base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)> >::*)(int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &),base::WeakPtr<base::internal::CancelableCallbackImpl<base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)> > >,int,int,const GURL &,const std::vector<SkBitmap,std::allocator<SkBitmap> > &,const std::vector<gfx::Size,std::allocator<gfx::Size> > &>(void(base::internal::CancelableCallbackImpl<base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)> >::*)(int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &) method, base::WeakPtr<base::internal::CancelableCallbackImpl<base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)> > > && receiver_ptr, int && args, int && args, const GURL & args, const std::vector<SkBitmap,std::allocator<SkBitmap> > & args, const std::vector<gfx::Size,std::allocator<gfx::Size> > & args) Line 447	C++	Symbols loaded.
 	chrome.dll!base::internal::InvokeHelper<1,void>::MakeItSo<void (base::internal::CancelableCallbackImpl<base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)> >::*)(int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &),base::WeakPtr<base::internal::CancelableCallbackImpl<base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)> > >,int,int,const GURL &,const std::vector<SkBitmap,std::allocator<SkBitmap> > &,const std::vector<gfx::Size,std::allocator<gfx::Size> > &>(void(base::internal::CancelableCallbackImpl<base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)> >::*)(int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &) && functor, base::WeakPtr<base::internal::CancelableCallbackImpl<base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)> > > && weak_ptr, int && args, int && args, const GURL & args, const std::vector<SkBitmap,std::allocator<SkBitmap> > & args, const std::vector<gfx::Size,std::allocator<gfx::Size> > & args) Line 570	C++	Symbols loaded.
 	chrome.dll!base::internal::Invoker<base::internal::BindState<void (base::internal::CancelableCallbackImpl<base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)> >::*)(int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &),base::WeakPtr<base::internal::CancelableCallbackImpl<base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)> > > >,void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)>::RunImpl<void (base::internal::CancelableCallbackImpl<base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)> >::*)(int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &),std::tuple<base::WeakPtr<base::internal::CancelableCallbackImpl<base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)> > > >,0>(void(base::internal::CancelableCallbackImpl<base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)> >::*)(int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &) && functor, std::tuple<base::WeakPtr<base::internal::CancelableCallbackImpl<base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)> > > > && bound, std::integer_sequence<unsigned long long,0>, int && unbound_args, int && unbound_args, const GURL & unbound_args, const std::vector<SkBitmap,std::allocator<SkBitmap> > & unbound_args, const std::vector<gfx::Size,std::allocator<gfx::Size> > & unbound_args) Line 621	C++	Symbols loaded.
 	chrome.dll!base::internal::Invoker<base::internal::BindState<void (base::internal::CancelableCallbackImpl<base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)> >::*)(int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &),base::WeakPtr<base::internal::CancelableCallbackImpl<base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)> > > >,void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)>::RunOnce(base::internal::BindStateBase * base, int unbound_args, int unbound_args, const GURL & unbound_args, const std::vector<SkBitmap,std::allocator<SkBitmap> > & unbound_args, const std::vector<gfx::Size,std::allocator<gfx::Size> > & unbound_args) Line 589	C++	Symbols loaded.
 	content.dll!base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)>::Run(int args, int args, const GURL & args, const std::vector<SkBitmap,std::allocator<SkBitmap> > & args, const std::vector<gfx::Size,std::allocator<gfx::Size> > & args) Line 97	C++	Symbols loaded.
 	content.dll!content::WebContentsImpl::OnDidDownloadImage(base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)> callback, int id, const GURL & image_url, int http_status_code, const std::vector<SkBitmap,std::allocator<SkBitmap> > & images, const std::vector<gfx::Size,std::allocator<gfx::Size> > & original_image_sizes) Line 5888	C++	Symbols loaded.
 	content.dll!base::internal::FunctorTraits<void (content::WebContentsImpl::*)(base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)>, int, const GURL &, int, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &),void>::Invoke<void (content::WebContentsImpl::*)(base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)>, int, const GURL &, int, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &),base::WeakPtr<content::WebContentsImpl>,base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)>,int,GURL,int,const std::vector<SkBitmap,std::allocator<SkBitmap> > &,const std::vector<gfx::Size,std::allocator<gfx::Size> > &>(void(content::WebContentsImpl::*)(base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)>, int, const GURL &, int, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &) method, base::WeakPtr<content::WebContentsImpl> && receiver_ptr, base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)> && args, int && args, GURL && args, int && args, const std::vector<SkBitmap,std::allocator<SkBitmap> > & args, const std::vector<gfx::Size,std::allocator<gfx::Size> > & args) Line 447	C++	Symbols loaded.
 	content.dll!base::internal::InvokeHelper<1,void>::MakeItSo<void (content::WebContentsImpl::*)(base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)>, int, const GURL &, int, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &),base::WeakPtr<content::WebContentsImpl>,base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)>,int,GURL,int,const std::vector<SkBitmap,std::allocator<SkBitmap> > &,const std::vector<gfx::Size,std::allocator<gfx::Size> > &>(void(content::WebContentsImpl::*)(base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)>, int, const GURL &, int, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &) && functor, base::WeakPtr<content::WebContentsImpl> && weak_ptr, base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)> && args, int && args, GURL && args, int && args, const std::vector<SkBitmap,std::allocator<SkBitmap> > & args, const std::vector<gfx::Size,std::allocator<gfx::Size> > & args) Line 570	C++	Symbols loaded.
 	content.dll!base::internal::Invoker<base::internal::BindState<void (content::WebContentsImpl::*)(base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)>, int, const GURL &, int, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &),base::WeakPtr<content::WebContentsImpl>,base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)>,int,GURL>,void (int, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)>::RunImpl<void (content::WebContentsImpl::*)(base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)>, int, const GURL &, int, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &),std::tuple<base::WeakPtr<content::WebContentsImpl>,base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)>,int,GURL>,0,1,2,3>(void(content::WebContentsImpl::*)(base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)>, int, const GURL &, int, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &) && functor, std::tuple<base::WeakPtr<content::WebContentsImpl>,base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)>,int,GURL> && bound, std::integer_sequence<unsigned long long,0,1,2,3>, int && unbound_args, const std::vector<SkBitmap,std::allocator<SkBitmap> > & unbound_args, const std::vector<gfx::Size,std::allocator<gfx::Size> > & unbound_args) Line 621	C++	Symbols loaded.
 	content.dll!base::internal::Invoker<base::internal::BindState<void (content::WebContentsImpl::*)(base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)>, int, const GURL &, int, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &),base::WeakPtr<content::WebContentsImpl>,base::OnceCallback<void (int, int, const GURL &, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)>,int,GURL>,void (int, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)>::RunOnce(base::internal::BindStateBase * base, int unbound_args, const std::vector<SkBitmap,std::allocator<SkBitmap> > & unbound_args, const std::vector<gfx::Size,std::allocator<gfx::Size> > & unbound_args) Line 589	C++	Symbols loaded.
 	content.dll!base::OnceCallback<void (int, const std::vector<SkBitmap,std::allocator<SkBitmap> > &, const std::vector<gfx::Size,std::allocator<gfx::Size> > &)>::Run(int args, const std::vector<SkBitmap,std::allocator<SkBitmap> > & args, const std::vector<gfx::Size,std::allocator<gfx::Size> > & args) Line 97	C++	Symbols loaded.
 	content.dll!content::mojom::ImageDownloader_DownloadImage_ForwardToCallback::Accept(mojo::Message * message) Line 194	C++	Symbols loaded.
 	bindings.dll!mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message * message) Line 414	C++	Symbols loaded.
 	bindings.dll!mojo::InterfaceEndpointClient::HandleIncomingMessageThunk::Accept(mojo::Message * message) Line 133	C++	Symbols loaded.
 	bindings.dll!mojo::FilterChain::Accept(mojo::Message * message) Line 40	C++	Symbols loaded.
 	bindings.dll!mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message * message) Line 306	C++	Symbols loaded.
 	bindings.dll!mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper * message_wrapper, mojo::internal::MultiplexRouter::ClientCallBehavior client_call_behavior, base::SequencedTaskRunner * current_task_runner) Line 864	C++	Symbols loaded.
 	bindings.dll!mojo::internal::MultiplexRouter::Accept(mojo::Message * message) Line 589	C++	Symbols loaded.
 	bindings.dll!mojo::FilterChain::Accept(mojo::Message * message) Line 40	C++	Symbols loaded.
 	bindings.dll!mojo::Connector::ReadSingleMessage(unsigned int * read_result) Line 442	C++	Symbols loaded.
 	bindings.dll!mojo::Connector::ReadAllAvailableMessages() Line 472	C++	Symbols loaded.
 	bindings.dll!mojo::Connector::OnHandleReadyInternal(unsigned int result) Line 375	C++	Symbols loaded.
 	bindings.dll!mojo::Connector::OnWatcherHandleReady(unsigned int result) Line 351	C++	Symbols loaded.
 	bindings.dll!base::internal::FunctorTraits<void (mojo::Connector::*)(unsigned int),void>::Invoke<void (mojo::Connector::*)(unsigned int),mojo::Connector *,unsigned int>(void(mojo::Connector::*)(unsigned int) method, mojo::Connector * && receiver_ptr, unsigned int && args) Line 447	C++	Symbols loaded.
 	bindings.dll!base::internal::InvokeHelper<0,void>::MakeItSo<void (mojo::Connector::*const &)(unsigned int),mojo::Connector *,unsigned int>(void(mojo::Connector::*)(unsigned int) & functor, mojo::Connector * && args, unsigned int && args) Line 547	C++	Symbols loaded.
 	bindings.dll!base::internal::Invoker<base::internal::BindState<void (mojo::Connector::*)(unsigned int),base::internal::UnretainedWrapper<mojo::Connector> >,void (unsigned int)>::RunImpl<void (mojo::Connector::*const &)(unsigned int),const std::tuple<base::internal::UnretainedWrapper<mojo::Connector> > &,0>(void(mojo::Connector::*)(unsigned int) & functor, const std::tuple<base::internal::UnretainedWrapper<mojo::Connector> > & bound, std::integer_sequence<unsigned long long,0>, unsigned int && unbound_args) Line 621	C++	Symbols loaded.
 	bindings.dll!base::internal::Invoker<base::internal::BindState<void (mojo::Connector::*)(unsigned int),base::internal::UnretainedWrapper<mojo::Connector> >,void (unsigned int)>::Run(base::internal::BindStateBase * base, unsigned int unbound_args) Line 603	C++	Symbols loaded.
 	mojo_public_system_cpp.dll!base::RepeatingCallback<void (unsigned int)>::Run(unsigned int args) Line 125	C++	Symbols loaded.
 	mojo_public_system_cpp.dll!mojo::SimpleWatcher::DiscardReadyState(const base::RepeatingCallback<void (unsigned int)> & callback, unsigned int result, const mojo::HandleSignalsState & state) Line 195	C++	Symbols loaded.
 	mojo_public_system_cpp.dll!base::internal::FunctorTraits<void (*)(const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &),void>::Invoke<void (*const &)(const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &),const base::RepeatingCallback<void (unsigned int)> &,unsigned int,const mojo::HandleSignalsState &>(void(*)(const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &) & function, const base::RepeatingCallback<void (unsigned int)> & args, unsigned int && args, const mojo::HandleSignalsState & args) Line 402	C++	Symbols loaded.
 	mojo_public_system_cpp.dll!base::internal::InvokeHelper<0,void>::MakeItSo<void (*const &)(const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &),const base::RepeatingCallback<void (unsigned int)> &,unsigned int,const mojo::HandleSignalsState &>(void(*)(const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &) & functor, const base::RepeatingCallback<void (unsigned int)> & args, unsigned int && args, const mojo::HandleSignalsState & args) Line 547	C++	Symbols loaded.
 	mojo_public_system_cpp.dll!base::internal::Invoker<base::internal::BindState<void (*)(const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &),base::RepeatingCallback<void (unsigned int)> >,void (unsigned int, const mojo::HandleSignalsState &)>::RunImpl<void (*const &)(const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &),const std::tuple<base::RepeatingCallback<void (unsigned int)> > &,0>(void(*)(const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &) & functor, const std::tuple<base::RepeatingCallback<void (unsigned int)> > & bound, std::integer_sequence<unsigned long long,0>, unsigned int && unbound_args, const mojo::HandleSignalsState & unbound_args) Line 621	C++	Symbols loaded.
 	mojo_public_system_cpp.dll!base::internal::Invoker<base::internal::BindState<void (*)(const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &),base::RepeatingCallback<void (unsigned int)> >,void (unsigned int, const mojo::HandleSignalsState &)>::Run(base::internal::BindStateBase * base, unsigned int unbound_args, const mojo::HandleSignalsState & unbound_args) Line 603	C++	Symbols loaded.
 	mojo_public_system_cpp.dll!base::RepeatingCallback<void (unsigned int, const mojo::HandleSignalsState &)>::Run(unsigned int args, const mojo::HandleSignalsState & args) Line 125	C++	Symbols loaded.
 	mojo_public_system_cpp.dll!mojo::SimpleWatcher::OnHandleReady(int watch_id, unsigned int result, const mojo::HandleSignalsState & state) Line 275	C++	Symbols loaded.
 	mojo_public_system_cpp.dll!base::internal::FunctorTraits<void (mojo::SimpleWatcher::*)(int, unsigned int, const mojo::HandleSignalsState &),void>::Invoke<void (mojo::SimpleWatcher::*)(int, unsigned int, const mojo::HandleSignalsState &),const base::WeakPtr<mojo::SimpleWatcher> &,const int &,const unsigned int &,const mojo::HandleSignalsState &>(void(mojo::SimpleWatcher::*)(int, unsigned int, const mojo::HandleSignalsState &) method, const base::WeakPtr<mojo::SimpleWatcher> & receiver_ptr, const int & args, const unsigned int & args, const mojo::HandleSignalsState & args) Line 447	C++	Symbols loaded.
 	mojo_public_system_cpp.dll!base::internal::InvokeHelper<1,void>::MakeItSo<void (mojo::SimpleWatcher::*const &)(int, unsigned int, const mojo::HandleSignalsState &),const base::WeakPtr<mojo::SimpleWatcher> &,const int &,const unsigned int &,const mojo::HandleSignalsState &>(void(mojo::SimpleWatcher::*)(int, unsigned int, const mojo::HandleSignalsState &) & functor, const base::WeakPtr<mojo::SimpleWatcher> & weak_ptr, const int & args, const unsigned int & args, const mojo::HandleSignalsState & args) Line 570	C++	Symbols loaded.
 	mojo_public_system_cpp.dll!base::internal::Invoker<base::internal::BindState<void (mojo::SimpleWatcher::*)(int, unsigned int, const mojo::HandleSignalsState &),base::WeakPtr<mojo::SimpleWatcher>,int,unsigned int,mojo::HandleSignalsState>,void ()>::RunImpl<void (mojo::SimpleWatcher::*const &)(int, unsigned int, const mojo::HandleSignalsState &),const std::tuple<base::WeakPtr<mojo::SimpleWatcher>,int,unsigned int,mojo::HandleSignalsState> &,0,1,2,3>(void(mojo::SimpleWatcher::*)(int, unsigned int, const mojo::HandleSignalsState &) & functor, const std::tuple<base::WeakPtr<mojo::SimpleWatcher>,int,unsigned int,mojo::HandleSignalsState> & bound, std::integer_sequence<unsigned long long,0,1,2,3>) Line 621	C++	Symbols loaded.
 	mojo_public_system_cpp.dll!base::internal::Invoker<base::internal::BindState<void (mojo::SimpleWatcher::*)(int, unsigned int, const mojo::HandleSignalsState &),base::WeakPtr<mojo::SimpleWatcher>,int,unsigned int,mojo::HandleSignalsState>,void ()>::Run(base::internal::BindStateBase * base) Line 603	C++	Symbols loaded.
 	base.dll!base::OnceCallback<void ()>::Run() Line 97	C++	Symbols loaded.
 	base.dll!base::debug::TaskAnnotator::RunTask(const char * queue_function, base::PendingTask * pending_task) Line 103	C++	Symbols loaded.
 	base.dll!base::internal::IncomingTaskQueue::RunTask(base::PendingTask * pending_task) Line 124	C++	Symbols loaded.
 	base.dll!base::MessageLoop::RunTask(base::PendingTask * pending_task) Line 320	C++	Symbols loaded.
 	base.dll!base::MessageLoop::DeferOrRunPendingTask(base::PendingTask pending_task) Line 332	C++	Symbols loaded.
 	base.dll!base::MessageLoop::DoWork() Line 373	C++	Symbols loaded.
 	base.dll!base::MessagePumpForUI::DoRunLoop() Line 173	C++	Symbols loaded.
 	base.dll!base::MessagePumpWin::Run(base::MessagePump::Delegate * delegate) Line 58	C++	Symbols loaded.
 	base.dll!base::MessageLoop::Run(bool application_tasks_allowed) Line 273	C++	Symbols loaded.
 	base.dll!base::RunLoop::Run() Line 134	C++	Symbols loaded.
 	chrome.dll!ChromeBrowserMainParts::MainMessageLoopRun(int * result_code) Line 2141	C++	Symbols loaded.
 	content.dll!content::BrowserMainLoop::RunMainMessageLoopParts() Line 973	C++	Symbols loaded.
 	content.dll!content::BrowserMainRunnerImpl::Run() Line 161	C++	Symbols loaded.
 	content.dll!content::BrowserMain(const content::MainFunctionParams & parameters) Line 46	C++	Symbols loaded.
 	content.dll!content::RunNamedProcessTypeMain(const std::basic_string<char,std::char_traits<char>,std::allocator<char> > & process_type, const content::MainFunctionParams & main_function_params, content::ContentMainDelegate * delegate) Line 644	C++	Symbols loaded.
 	content.dll!content::ContentMainRunnerImpl::Run() Line 951	C++	Symbols loaded.
 	content.dll!content::ContentServiceManagerMainDelegate::RunEmbedderProcess() Line 53	C++	Symbols loaded.
 	embedder.dll!service_manager::Main(const service_manager::MainParams & params) Line 452	C++	Symbols loaded.
 	content.dll!content::ContentMain(const content::ContentMainParams & params) Line 20	C++	Symbols loaded.
 	chrome.dll!ChromeMain(HINSTANCE__ * instance, sandbox::SandboxInterfaceInfo * sandbox_info, __int64 exe_entry_point_ticks) Line 101	C++	Symbols loaded.
 	chrome.exe!MainDllLoader::Launch(HINSTANCE__ * instance, base::TimeTicks exe_entry_point_ticks) Line 201	C++	Symbols loaded.
 	chrome.exe!wWinMain(HINSTANCE__ * instance, HINSTANCE__ * prev, wchar_t *, int) Line 230	C++	Symbols loaded.
 	[External Code]		Annotated Frame
 
Cc: pbos@chromium.org
Project Member

Comment 2 by bugdroid1@chromium.org, May 24 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7dc6c9bba762785892045ad6693058affbeba1d7

commit 7dc6c9bba762785892045ad6693058affbeba1d7
Author: Tommy C. Li <tommycli@chromium.org>
Date: Thu May 24 21:46:14 2018

Search Engines: Fix crash in TemplateURLService::UpdateProviderFavicons

Previously we could crash, because within this method, we iterate over
a collection and update its elements, and subsequently invalidate the
very collection we are iterating over.

This CL fixes it. pbos@ provided the diagnosis.

Bug:  846406 
Change-Id: Ibeadddfaef2e7a3700b9b9fae6143892aee10af1
Reviewed-on: https://chromium-review.googlesource.com/1072189
Reviewed-by: Peter Kasting <pkasting@chromium.org>
Commit-Queue: Tommy Li <tommycli@chromium.org>
Cr-Commit-Position: refs/heads/master@{#561646}
[modify] https://crrev.com/7dc6c9bba762785892045ad6693058affbeba1d7/components/search_engines/template_url_service.cc

Status: Fixed (was: Started)

Sign in to add a comment