The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a8e9bac62172fefbaee1006def815329ea449fdb

commit a8e9bac62172fefbaee1006def815329ea449fdb
Author: Takumi Fujimoto <takumif@chromium.org>
Date: Mon Jul 30 19:54:38 2018

[Harmony Cast Dialog] Close dialog after starting a page-initiated route

The dialog needs to be closed when a PresentationRequest is fulfilled,
so that the user cannot attempt to cast again using the same request.

Bug: 868186

Change-Id: I9d00cc5119257bba046e67c750210104123f0bdb
Reviewed-on: https://chromium-review.googlesource.com/1151890
Reviewed-by: Derek Cheng <imcheng@chromium.org>
Commit-Queue: Takumi Fujimoto <takumif@chromium.org>
Cr-Commit-Position: refs/heads/master@{#579129}
[modify] https://crrev.com/a8e9bac62172fefbaee1006def815329ea449fdb/chrome/browser/ui/media_router/media_router_ui_base.cc
[modify] https://crrev.com/a8e9bac62172fefbaee1006def815329ea449fdb/chrome/browser/ui/media_router/media_router_ui_base.h
[modify] https://crrev.com/a8e9bac62172fefbaee1006def815329ea449fdb/chrome/browser/ui/views/media_router/media_router_views_ui.cc
[modify] https://crrev.com/a8e9bac62172fefbaee1006def815329ea449fdb/chrome/browser/ui/views/media_router/media_router_views_ui.h
[modify] https://crrev.com/a8e9bac62172fefbaee1006def815329ea449fdb/chrome/browser/ui/webui/media_router/media_router_ui.cc
[modify] https://crrev.com/a8e9bac62172fefbaee1006def815329ea449fdb/chrome/browser/ui/webui/media_router/media_router_ui.h

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/91dfc811c5e432073d9d1a755696c854cc243a48

commit 91dfc811c5e432073d9d1a755696c854cc243a48
Author: Takumi Fujimoto <takumif@chromium.org>
Date: Tue Sep 11 17:58:36 2018

Revert "[Harmony Cast Dialog] Close dialog after starting a page-initiated route"

This reverts commit a8e9bac62172fefbaee1006def815329ea449fdb.

Reason for revert: We have a crash in issue 876900 which we're not sure how it
happens. Based on when the crash started happening, this CL may be relevant.
We're reverting this CL to see if the crashes stop.

Original change's description:
> [Harmony Cast Dialog] Close dialog after starting a page-initiated route
>
> The dialog needs to be closed when a PresentationRequest is fulfilled,
> so that the user cannot attempt to cast again using the same request.
>
> Bug: 868186
>
> Change-Id: I9d00cc5119257bba046e67c750210104123f0bdb
> Reviewed-on: https://chromium-review.googlesource.com/1151890
> Reviewed-by: Derek Cheng <imcheng@chromium.org>
> Commit-Queue: Takumi Fujimoto <takumif@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#579129}

TBR=imcheng@chromium.org,takumif@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: 868186,876900
Change-Id: I419a343cf8ea85cc92e219b0c5422fa9d095b805
Reviewed-on: https://chromium-review.googlesource.com/1218162
Reviewed-by: Derek Cheng <imcheng@chromium.org>
Reviewed-by: Takumi Fujimoto <takumif@chromium.org>
Commit-Queue: Takumi Fujimoto <takumif@chromium.org>
Cr-Commit-Position: refs/heads/master@{#590391}
[modify] https://crrev.com/91dfc811c5e432073d9d1a755696c854cc243a48/chrome/browser/ui/media_router/media_router_ui_base.cc
[modify] https://crrev.com/91dfc811c5e432073d9d1a755696c854cc243a48/chrome/browser/ui/media_router/media_router_ui_base.h
[modify] https://crrev.com/91dfc811c5e432073d9d1a755696c854cc243a48/chrome/browser/ui/views/media_router/media_router_views_ui.cc
[modify] https://crrev.com/91dfc811c5e432073d9d1a755696c854cc243a48/chrome/browser/ui/views/media_router/media_router_views_ui.h
[modify] https://crrev.com/91dfc811c5e432073d9d1a755696c854cc243a48/chrome/browser/ui/webui/media_router/media_router_ui.cc
[modify] https://crrev.com/91dfc811c5e432073d9d1a755696c854cc243a48/chrome/browser/ui/webui/media_router/media_router_ui.h

Reopening, as we've landed a revert.

Crash only shows up on Mac.

There's been one crash since the revert landed, so while the revert helped, it didn't fix the problem 100%.

This looks like a situation similar to  Bug 883976 , except here the dialog is outliving its dialog controller.  I didn't find where the task was posted to StartCasting().

I wonder if we can fix up any remaining lifetime issues with the dialog controller, then reland the patch in C#4?

I'm not seeing any crashes for versions 71.0.3550.0 or later, in which the revert landed. Maybe we are looking at different stats?

The crash was weird and Brandon and I couldn't tell how it was happening, because it was in the vtable and our thinking was that that shouldn't happen with a UAF. Lifetime handling seemed fine as well, although I can take another look.

https://crash.corp.google.com/browse?q=expanded_custom_data.ChromeCrashProto.magic_signature_1.name%3D%27non-virtual+thunk+to+media_router%3A%3AMediaRouterViewsUI%3A%3AStartCasting%27#-propertyselector,productname:1000,productversion:100,-magicsignature:50,-magicsignature2:50,-stablesignature:50

The crash hasn't appeared in three weeks, and I don't think not automatically closing the dialog after starting casting is a launch blocker. I'm removing the blocking label.

Given we don't know how the crash was happening, I'd rather wait until the next milestone to try other ways to close the dialog (e.g. after a delay), just to make sure we don't introduce the crash again.

It looks like we don't automatically close after starting tab mirroring, so the current behavior is consistent.  And starting a second media route from the same presentation request actually seems to behave logically (it stops the first route and starts the second).

SGTM to discuss post-M71 and decide if there is any change in behavior warranted.