The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/35e605d2c413aef4719dea86dc3b55288650b985

commit 35e605d2c413aef4719dea86dc3b55288650b985
Author: Sammie Quon <sammiequon@google.com>
Date: Wed Jul 25 22:08:27 2018

overview: Fix crash when swiping to close.

If items are swiped to close quickly one after the other, we may crash.
This is because there is a animation before the window closes and deletes
the selector item, which will still be on WindowGrids internal collection.
However when the nudge starts the selector items may still be on the
collection so the nudge indexes are stored incorrectly.

This cl will prevent nudges from starting if any of the window items are
currently animating to close. We could instead find some logics which
handles the windows which are closing, but this way is much simpler and
users who are closing windows so quickly will probably not notice the
lack of nudging.

Test: manual
Bug:  867573 
Change-Id: Ia268d152c0862b81481199d03916b010f4403c59
Reviewed-on: https://chromium-review.googlesource.com/1150696
Commit-Queue: Sammie Quon <sammiequon@chromium.org>
Reviewed-by: Xiaoqian Dai <xdai@chromium.org>
Cr-Commit-Position: refs/heads/master@{#578092}
[modify] https://crrev.com/35e605d2c413aef4719dea86dc3b55288650b985/ash/wm/overview/window_grid.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1dbe2ab2b3ba2e4c2c6e975b518e998b7265655e

commit 1dbe2ab2b3ba2e4c2c6e975b518e998b7265655e
Author: Sammie Quon <sammiequon@google.com>
Date: Mon Jul 30 20:54:32 2018

[merge to 69] overview: Fix crash when swiping to close.

If items are swiped to close quickly one after the other, we may crash.
This is because there is a animation before the window closes and deletes
the selector item, which will still be on WindowGrids internal collection.
However when the nudge starts the selector items may still be on the
collection so the nudge indexes are stored incorrectly.

This cl will prevent nudges from starting if any of the window items are
currently animating to close. We could instead find some logics which
handles the windows which are closing, but this way is much simpler and
users who are closing windows so quickly will probably not notice the
lack of nudging.

TBR=sammiequon@google.com

(cherry picked from commit 35e605d2c413aef4719dea86dc3b55288650b985)

Test: manual
Bug:  867573 
Change-Id: Ia268d152c0862b81481199d03916b010f4403c59
Reviewed-on: https://chromium-review.googlesource.com/1150696
Commit-Queue: Sammie Quon <sammiequon@chromium.org>
Reviewed-by: Xiaoqian Dai <xdai@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#578092}
Reviewed-on: https://chromium-review.googlesource.com/1155729
Reviewed-by: Sammie Quon <sammiequon@chromium.org>
Cr-Commit-Position: refs/branch-heads/3497@{#246}
Cr-Branched-From: 271eaf50594eb818c9295dc78d364aea18c82ea8-refs/heads/master@{#576753}
[modify] https://crrev.com/1dbe2ab2b3ba2e4c2c6e975b518e998b7265655e/ash/wm/overview/window_grid.cc

sammiequon@ Just reproduced this crash on latest M69 (10895.18.0, 69.0.3497.31) while swiping to close apps in overview mode.

Feedback report: https://listnr.corp.google.com/report/85593232252

Crash report link: https://crash.corp.google.com/browse?stbtiq=d79f34e1e4de21a4

Magic Signature:- ash::WindowSelectorItem::SetBounds

Crash stack:
0x000058fb9be91b29	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ash/wm/overview/window_selector_item.cc:768 )	ash::WindowSelectorItem::SetBounds(gfx::Rect const&, ash::OverviewAnimationType)
0x000058fb9bfb8e41	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ash/wm/overview/window_grid.cc:991 )	ash::WindowGrid::UpdateNudge(ash::WindowSelectorItem*, double)
0x000058fb9c035f23	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ash/wm/overview/overview_window_drag_controller.cc:102 )	ash::OverviewWindowDragController::Drag(gfx::Point const&)
0x000058fb9be95bbf	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ash/wm/overview/window_selector.cc:575 )	ash::(anonymous namespace)::ShieldButton::OnGestureEvent(ui::GestureEvent*)
0x000058fb9a24c1b3	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/events/event_handler.cc:38 )	ui::EventHandler::OnEvent(ui::Event*)
0x000058fb9a24b8d4	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/events/event_dispatcher.cc:191 )	ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget*, ui::Event*)
0x000058fb9da2df97	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/events/event_processor.cc:57 )	ui::EventProcessor::OnEventFromSource(ui::Event*)
0x000058fb9da2e423	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/events/event_source.cc:107 )	ui::EventSource::SendEventToSinkFromRewriter(ui::Event*, ui::EventRewriter const*)
0x000058fb9a24c1b3	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/events/event_handler.cc:38 )	ui::EventHandler::OnEvent(ui::Event*)
0x000058fb9a24b8d4	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/events/event_dispatcher.cc:191 )	ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget*, ui::Event*)
0x000058fb9ad62627	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/aura/window_event_dispatcher.cc:343 )	aura::WindowEventDispatcher::ProcessGestures(aura::Window*, std::__1::vector<std::__1::unique_ptr<ui::GestureEvent, std::__1::default_delete<ui::GestureEvent> >, std::__1::allocator<std::__1::unique_ptr<ui::GestureEvent, std::__1::default_delete<ui::GestureEvent> > > >)
0x000058fb9ad6791d	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/aura/window_event_dispatcher.cc:635 )	aura::WindowEventDispatcher::PostDispatchEvent(ui::EventTarget*, ui::Event const&)
0x000058fb9a24b9e9	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/events/event_dispatcher.cc:62 )	ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget*, ui::Event*)
0x000058fb9da2df97	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/events/event_processor.cc:57 )	ui::EventProcessor::OnEventFromSource(ui::Event*)
0x000058fb9da2e423	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/events/event_source.cc:107 )	ui::EventSource::SendEventToSinkFromRewriter(ui::Event*, ui::EventRewriter const*)
0x000058fb9bdbac10	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/events/event_source.cc:44 )	ash::AshWindowTreeHostPlatform::DispatchEvent(ui::Event*)
0x000058fb9a24e953	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/base/callback.h:99 )	ui::DispatchEventFromNativeUiEvent(ui::Event* const&, base::OnceCallback<void (ui::Event*)>)
0x000058fb972ffb03	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/ozone/platform/drm/host/drm_window_host.cc:191 )	<name omitted>
0x000058fb972ffbcc	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/ozone/platform/drm/host/drm_window_host.cc )	non-virtual thunk to ui::DrmWindowHost::DispatchEvent(ui::Event* const&)
0x000058fb9a240b01	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/events/platform/platform_event_source.cc:91 )	ui::PlatformEventSource::DispatchEvent(ui::Event*)
0x000058fb9a5879f5	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/events/ozone/evdev/event_factory_evdev.cc:363 )	ui::EventFactoryEvdev::DispatchTouchEvent(ui::TouchEventParams const&)
0x000058fb96c25ba5	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/base/callback.h:99 )	base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*)
0x000058fb96c1a3f3	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/base/message_loop/message_loop.cc:421 )	base::MessageLoop::RunTask(base::PendingTask*)
0x000058fb96c1ad6d	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/base/message_loop/message_loop.cc:432 )	base::MessageLoop::DoWork()
0x000058fb96c25650	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/base/message_loop/message_pump_libevent.cc:210 )	base::MessagePumpLibevent::Run(base::MessagePump::Delegate*)
0x000058fb998106a3	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/base/run_loop.cc:102 )	<name omitted>
0x000058fb9941e1c6	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/chrome/browser/chrome_browser_main.cc:2092 )	ChromeBrowserMainParts::MainMessageLoopRun(int*)
0x000058fb9799e2ad	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/content/browser/browser_main_loop.cc:1034 )	content::BrowserMainLoop::RunMainMessageLoopParts()
0x000058fb979a1591	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/content/browser/browser_main_runner_impl.cc:162 )	content::BrowserMainRunnerImpl::Run()
0x000058fb97996801	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/content/browser/browser_main.cc:47 )	content::BrowserMain(content::MainFunctionParams const&)
0x000058fb99409a48	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/content/app/content_main_runner_impl.cc:596 )	content::ContentMainRunnerImpl::Run(bool)
0x000058fb99411782	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/services/service_manager/embedder/main.cc:472 )	service_manager::Main(service_manager::MainParams const&)
0x000058fb96d1d744	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/content/app/content_main.cc:19 )	ChromeMain
0x00007beffcce7735	(libc-2.23.so -libc-start.c:289 )	__libc_start_main
0x000058fb96d0d7b8	(chrome + 0x002377b8 )	_start

re #4 - do you have repro steps?

re #5 - I don't have specific repro steps for the crash. Crash happened when I tried to dismiss apps quickly one after the other. I had around 6 apps open (all are chrome apps). The crash reproduced only once out of the multiple times I have tried to repro today.

Hmm, thats going to be hard to track. What percentage of times does it crash?

Unfortunately I could reproduce only 1/20 times I have tried to repro so far.

does this still happen on ToT?

sammiequon@ I couldn't reproduce the bug on M69/M70 after the repro in c#4. 

Also, there are no new crash reports (except the one in c#4) after fix has landed. https://crash.corp.google.com/browse?stbtiq=ash%3A%3AWindowSelectorItem%3A%3ASetBounds#reports:95

Marking as fixed due to c#10.