Doc link https://dev.chromium.org/administrators/policy-list-3#DefaultSearchProviderEnabled

Verified behavior on both Stable 68.0.3440.75 and Dev 69.0.3493.3. It's not required to press enter; as soon as a question mark is typed in the omnibox Chrome immediately quits.

No other characters triggers the crash, only a question mark. Also, any preceding text prevents the crash. "a?" (no quotes) does not crash while "?" does.

[omnibox triage]

Even with the (likely) uncommon enterprise policy, I think this should be fixed.  I don't know who to assign it to at the moment, so leaving untriaged in the omnibox queue.

Hi Nicolas,

can you help figure out what's wrong here? Seems like this is easy to repro but we need to know what causes the crash and prevent it.

Hitting '?' normally causes the omnibox to enter 'Default Search Provider' mode. So, [1] is probably what is causing the crash.

I'll work on a fix right away. :-)

[1] https://cs.chromium.org/chromium/src/components/omnibox/browser/omnibox_edit_model.cc?l=1235&rcl=accb9e4e1822d9e050074b2108e426915b2ad7c5

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e98a790d5245feba119cf098ee4cbe094daf2efe

commit e98a790d5245feba119cf098ee4cbe094daf2efe
Author: Nicolas Ouellet-Payeur <nicolaso@chromium.org>
Date: Tue Aug 07 14:27:30 2018

Fix a crash with DefaultSearchProviderEnabled policy set to false

With the policy set to false, the browser used to crash when:
- The user enters '?' as the first character in the omnibar
- The user hits CTRL+K or CTRL+E to start a default search

Bug:  869384 
Cq-Include-Trybots: luci.chromium.try:ios-simulator-full-configs;master.tryserver.chromium.mac:ios-simulator-cronet
Change-Id: I7b98bd7a745a8e66ffd22b1f972a5110e89a568c
Reviewed-on: https://chromium-review.googlesource.com/1162421
Reviewed-by: Tommy Li <tommycli@chromium.org>
Reviewed-by: Stepan Khapugin <stkhapugin@chromium.org>
Commit-Queue: Nicolas Ouellet-Payeur <nicolaso@chromium.org>
Cr-Commit-Position: refs/heads/master@{#581219}
[modify] https://crrev.com/e98a790d5245feba119cf098ee4cbe094daf2efe/chrome/browser/ui/omnibox/chrome_omnibox_client.cc
[modify] https://crrev.com/e98a790d5245feba119cf098ee4cbe094daf2efe/chrome/browser/ui/omnibox/chrome_omnibox_client.h
[modify] https://crrev.com/e98a790d5245feba119cf098ee4cbe094daf2efe/chrome/browser/ui/omnibox/omnibox_view_browsertest.cc
[modify] https://crrev.com/e98a790d5245feba119cf098ee4cbe094daf2efe/components/omnibox/browser/omnibox_client.cc
[modify] https://crrev.com/e98a790d5245feba119cf098ee4cbe094daf2efe/components/omnibox/browser/omnibox_client.h
[modify] https://crrev.com/e98a790d5245feba119cf098ee4cbe094daf2efe/components/omnibox/browser/omnibox_edit_model.cc
[modify] https://crrev.com/e98a790d5245feba119cf098ee4cbe094daf2efe/ios/chrome/browser/ui/omnibox/chrome_omnibox_client_ios.h
[modify] https://crrev.com/e98a790d5245feba119cf098ee4cbe094daf2efe/ios/chrome/browser/ui/omnibox/chrome_omnibox_client_ios.mm

Filed bug 871898 for follow-up work.  In particular, the fix above introduce a new helper function that should be used elsewhere in the omnibox code.  Mostly it's a code health issue, though I wouldn't be surprised if there were both crashes and functionality edge cases that still exist.