New issue
Advanced search Search tips

Issue 867084 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Aug 2
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 2
Type: Bug



Sign in to add a comment

mash: Crash when clicking on system tray IME menu

Project Member Reported by jamescook@chromium.org, Jul 24

Issue description

linux-chromeos ToT r577596

* Run chrome --enable-features=Mash
* Open settings
* Turn on "Show input options in the shelf"
* Click on shelf icon

Crash:
Received signal 11 SEGV_MAPERR 000000000000
#0 0x7f0741e63cad base::debug::StackTrace::StackTrace()
#1 0x7f0741b7794c base::debug::StackTrace::StackTrace()
#2 0x7f0741e63738 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#3 0x7f071dd060c0 <unknown>
#4 0x7f072f83ede9 ash::(anonymous namespace)::IsInPasswordInputContext()
#5 0x7f072f83de20 ash::ImeMenuTray::ShouldShowBottomButtons()
#6 0x7f072f83d887 ash::ImeMenuTray::ShowImeMenuBubbleInternal()
#7 0x7f072f83f11a ash::ImeMenuTray::ShowBubble()
#8 0x7f072f83ef72 ash::ImeMenuTray::PerformAction()
#9 0x7f072f928190 ash::ActionableView::ButtonPressed()
#10 0x7f0731acf89b views::Button::NotifyClick()
#11 0x7f0731ace288 views::Button::OnMouseReleased()
#12 0x7f0731bcd37c views::View::ProcessMouseReleased()
#13 0x7f0731bcce65 views::View::OnMouseEvent()
#14 0x7f0731a9dfea views::InkDropHostView::OnMouseEvent()
#15 0x7f073701ac45 ui::EventHandler::OnEvent()
#16 0x7f073702e94c ui::ScopedTargetHandler::OnEvent()
#17 0x7f07370195aa ui::EventDispatcher::DispatchEvent()
#18 0x7f0737017e7c ui::EventDispatcher::ProcessEvent()
#19 0x7f0737017944 ui::EventDispatcherDelegate::DispatchEventToTarget()
#20 0x7f0737017836 ui::EventDispatcherDelegate::DispatchEvent()
#21 0x7f0731be045b views::internal::RootView::OnMouseReleased()
#22 0x7f0731be92a4 views::Widget::OnMouseEvent()
#23 0x7f0731c307ec views::NativeWidgetAura::OnMouseEvent()
#24 0x7f073701ac45 ui::EventHandler::OnEvent()
#25 0x7f07370195aa ui::EventDispatcher::DispatchEvent()
#26 0x7f0737017e7c ui::EventDispatcher::ProcessEvent()
#27 0x7f0737017944 ui::EventDispatcherDelegate::DispatchEventToTarget()
#28 0x7f0737017836 ui::EventDispatcherDelegate::DispatchEvent()
#29 0x7f073701c208 ui::EventProcessor::OnEventFromSource()
#30 0x7f073701c4dc ui::EventProcessor::OnEventFromSource()
#31 0x7f073701e789 ui::EventSource::DeliverEventToSink()
#32 0x7f073701de28 ui::EventSource::SendEventToSinkFromRewriter()
#33 0x7f073701d341 ui::EventSource::SendEventToSink()
#34 0x7f072f61e701 ash::AshWindowTreeHostPlatform::DispatchEvent()
#35 0x7f072d97f720 _ZN4base8internal13FunctorTraitsIMN2ui22PlatformWindowDelegateEFvPNS2_5EventEEvE6InvokeIS7_PS3_JS5_EEEvT_OT0_DpOT1_
#36 0x7f072d97f64f _ZN4base8internal12InvokeHelperILb0EvE8MakeItSoIMN2ui22PlatformWindowDelegateEFvPNS4_5EventEEJPS5_S7_EEEvOT_DpOT0_
#37 0x7f072d97f5e5 _ZN4base8internal7InvokerINS0_9BindStateIMN2ui22PlatformWindowDelegateEFvPNS3_5EventEEJNS0_17UnretainedWrapperIS4_EEEEEFvS6_EE7RunImplIS8_NSt3__15tupleIJSA_EEEJLm0EEEEvOT_OT0_NSF_16integer_sequenceImJXspT1_EEEEOS6_
#38 0x7f072d97f529 _ZN4base8internal7InvokerINS0_9BindStateIMN2ui22PlatformWindowDelegateEFvPNS3_5EventEEJNS0_17UnretainedWrapperIS4_EEEEEFvS6_EE7RunOnceEPNS0_13BindStateBaseES6_
#39 0x7f073702fe51 _ZNO4base12OnceCallbackIFvPN2ui5EventEEE3RunES3_
#40 0x7f073702fc7d ui::DispatchEventFromNativeUiEvent()
#41 0x7f072da092cc ui::X11WindowOzone::DispatchEvent()
#42 0x7f073ffe88c4 ui::PlatformEventSource::DispatchEvent()
#43 0x7f0717633979 ui::X11EventSourceLibevent::DispatchPlatformEvent()
#44 0x7f071763237a ui::X11EventSourceLibevent::ProcessXEvent()
#45 0x7f0717622665 ui::X11EventSource::ExtractCookieDataDispatchEvent()
#46 0x7f07176225ee ui::X11EventSource::DispatchXEvents()
#47 0x7f0717633bbc ui::X11EventSourceLibevent::OnFileCanReadWithoutBlocking()
#48 0x7f0741ea6b6e base::MessagePumpLibevent::FdWatchController::OnFileCanReadWithoutBlocking()
#49 0x7f0741ea826b base::MessagePumpLibevent::OnLibeventNotification()
#50 0x7f0741ef98ee event_process_active
#51 0x7f0741ef8f37 event_base_loop
#52 0x7f0741ea83de base::MessagePumpLibevent::Run()
#53 0x7f0741c0b4ee base::MessageLoop::Run()
#54 0x7f0741cb2cd2 base::RunLoop::Run()
#55 0x7f073c97aaf1 content::UtilityMain()
#56 0x7f073c9a0532 content::RunOtherNamedProcessTypeMain()
#57 0x7f073c9a2b0d content::ContentMainRunnerImpl::Run()
#58 0x7f073c99733c content::ContentServiceManagerMainDelegate::RunEmbedderProcess()
#59 0x7f074217bbf1 service_manager::Main()
#60 0x7f073c99d4b5 content::ContentMain()
#61 0x561c2fb7dfb6 ChromeMain

mukai or xiyuan, do you have time to look at this? I suspect one of the IME controllers is null in the ash process.

 
IsInPasswordInputContext() uses IMEBridge::Get(). However, IMEBridge::Initialize() is only called in the browser process. Hence, IMEBridge::Get() returns null and we crash.

Maybe make ImeController to provide this piece info instead of going through IMEBridge?
Labels: -Pri-1 Pri-2
Owner: shuchen@chromium.org
Status: Assigned (was: Untriaged)
The tray menu should be hooked up to the "input method manager mojo service" in the future mojo based IMF under mash.
For now, I think it should be ok to just mute the crash by letting IsInPasswordInputContext() always return false.
WDYT?

That seems fine to me. Please use the function features::IsAshInBrowserProcess() to check if mash is running and leave a TODO -- that will help us find the issue to fix it later.
Labels: M-70
Project Member

Comment 7 by bugdroid1@chromium.org, Aug 2

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/86c0c539a6b7a1d5340bb763271a94bccd5d17cb

commit 86c0c539a6b7a1d5340bb763271a94bccd5d17cb
Author: Shu Chen <shuchen@google.com>
Date: Thu Aug 02 02:44:01 2018

Mutes the crash in ImeMenuTray when the ash is not in browser process.

Bug:  867084 
Change-Id: I1a667b8c54d8f111dbe00a2b398fb99f1527aa0b
Reviewed-on: https://chromium-review.googlesource.com/1157741
Reviewed-by: James Cook <jamescook@chromium.org>
Commit-Queue: Shu Chen <shuchen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#580036}
[modify] https://crrev.com/86c0c539a6b7a1d5340bb763271a94bccd5d17cb/ash/system/ime_menu/ime_menu_tray.cc

Status: Fixed (was: Assigned)

Sign in to add a comment