Regression : Current tab crashes after pressing 'F5' key multiple times in print preview window.
Reported by
avsha...@etouch.net,
Aug 16
|
||||||||
Issue descriptionChrome Version : 70.0.3524.0 (Official Build) af89913d666a6f95572c04f15ab3a0752343ebf3-refs/branch-heads/3524@{#1} 32/64 bit OS : Windows (7, 8, 8.1, 10) What steps will reproduce the problem? 1. Launch chrome, open NTP and press CTRL + P keys to open print preview. 2. Right click on preview page and select 'Inspect' option. 3. Now, hit 'F5' key rapidly multiple times and observe. Actual Result : Current tab crashes after pressing 'F5' key multiple times in print preview window. Expected Result : Tab should not crash after step 3. Crash ID : ----------- Crash ID 42d4ca659b423464 (Local Crash ID: e90ecc5a-5b3c-4575-a9f6-03259e68e40a) This is a regression issue broken in ‘M-70’ and will soon update remaining info. Good Build : 70.0.3503.0 (Revision : 578160) Bad Build : 70.0.3504.0 (Revision : 578510)
,
Aug 16
Stack trace for the crash id: ----------------------------- Thread 0 (id: 0x1560) CRASHED [Simulated Exception @ 0x000007fef09cfc27 ] MAGIC SIGNATURE THREAD Stack Quality100%Show frame trust levels 0x000007fef09cfc27 (chrome_elf.dll -crashpad.cc:256 ) crash_reporter::DumpWithoutCrashing() 0x000007fecff9b341 (chrome.dll -dump_without_crashing.cc:23 ) base::debug::DumpWithoutCrashing() 0x000007fecfc1f701 (chrome.dll -render_process_host_impl.cc:2440 ) content::RenderProcessHostImpl::ShutdownForBadMessage(content::RenderProcessHost::CrashReportMode) 0x000007fed0daee9a (chrome.dll -print_preview_handler.cc:635 ) PrintPreviewHandler::ShouldReceiveRendererMessage(int) 0x000007fed0db0e53 (chrome.dll -print_preview_handler.cc:1255 ) PrintPreviewHandler::SendPagePreviewReady(int,int,int) 0x000007fed0efabe4 (chrome.dll -print_preview_message_handler.cc:270 ) printing::PrintPreviewMessageHandler::NotifyUIPreviewPageReady(int,PrintHostMsg_PreviewIds const &,scoped_refptr<base::RefCountedMemory>) 0x000007fed0efab43 (chrome.dll -print_preview_message_handler.cc:299 ) printing::PrintPreviewMessageHandler::OnCompositePdfPageDone(int,PrintHostMsg_PreviewIds const &,printing::mojom::PdfCompositor_Status,base::ReadOnlySharedMemoryRegion) 0x000007fed0efc21b (chrome.dll -bind_internal.h:516 ) base::internal::FunctorTraits<void (printing::PrintPreviewMessageHandler::*)(int, const PrintHostMsg_PreviewIds &, printing::mojom::PdfCompositor_Status, base::ReadOnlySharedMemoryRegion),void>::Invoke<void (printing::PrintPreviewMessageHandler::*)(int, const PrintHostMsg_PreviewIds &, printing::mojom::PdfCompositor_Status, base::ReadOnlySharedMemoryRegion),base::WeakPtr<printing::PrintPreviewMessageHandler>,int,PrintHostMsg_PreviewIds,printing::mojom::PdfCompositor_Status,base::ReadOnlySharedMemoryRegion> 0x000007fed0efc109 (chrome.dll -bind_internal.h:658 ) base::internal::Invoker<base::internal::BindState<void (printing::PrintPreviewMessageHandler::*)(int, const PrintHostMsg_PreviewIds &, printing::mojom::PdfCompositor_Status, base::ReadOnlySharedMemoryRegion),base::WeakPtr<printing::PrintPreviewMessageHandler>,int,PrintHostMsg_PreviewIds>,void (printing::mojom::PdfCompositor_Status, base::ReadOnlySharedMemoryRegion)>::RunOnce 0x000007fed0c69756 (chrome.dll -print_composite_client.cc:210 ) printing::PrintCompositeClient::OnDidCompositePageToPdf(base::OnceCallback<void >,printing::mojom::PdfCompositor_Status,base::ReadOnlySharedMemoryRegion) 0x000007fed0c6a312 (chrome.dll -bind_internal.h:658 ) base::internal::Invoker<base::internal::BindState<void (printing::PrintCompositeClient::*)(base::OnceCallback<void (printing::mojom::PdfCompositor_Status, base::ReadOnlySharedMemoryRegion)>, printing::mojom::PdfCompositor_Status, base::ReadOnlySharedMemoryRegion),base::internal::UnretainedWrapper<printing::PrintCompositeClient>,base::OnceCallback<void (printing::mojom::PdfCompositor_Status, base::ReadOnlySharedMemoryRegion)> >,void (printing::mojom::PdfCompositor_Status, base::ReadOnlySharedMemoryRegion)>::RunOnce 0x000007fecff5b14e (chrome.dll -pdf_compositor.mojom.cc:388 ) printing::mojom::PdfCompositor_CompositePageToPdf_ForwardToCallback::Accept(mojo::Message *) 0x000007fecee89d34 (chrome.dll -interface_endpoint_client.cc:418 ) mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message *) 0x000007fecee89654 (chrome.dll -multiplex_router.cc:868 ) mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper *,mojo::internal::MultiplexRouter::ClientCallBehavior,base::SequencedTaskRunner *) 0x000007fecee8918b (chrome.dll -multiplex_router.cc:590 ) mojo::internal::MultiplexRouter::Accept(mojo::Message *) 0x000007fecee88933 (chrome.dll -connector.cc:456 ) mojo::Connector::ReadSingleMessage(unsigned int *) 0x000007fecee887ae (chrome.dll -connector.cc:486 ) mojo::Connector::ReadAllAvailableMessages() 0x000007fecee88698 (chrome.dll -simple_watcher.cc:273 ) mojo::SimpleWatcher::OnHandleReady(int,unsigned int,mojo::HandleSignalsState const &) 0x000007fecedc39fb (chrome.dll -task_annotator.cc:101 ) base::debug::TaskAnnotator::RunTask(char const *,base::PendingTask *) 0x000007fecedc33f6 (chrome.dll -message_loop.cc:431 ) base::MessageLoop::RunTask(base::PendingTask *) 0x000007fecedbcad4 (chrome.dll -message_loop.cc:514 ) base::MessageLoop::DoWork() 0x000007feceeb5878 (chrome.dll -message_pump_win.cc:179 ) base::MessagePumpForUI::DoRunLoop() 0x000007fecedbc7cd (chrome.dll -message_pump_win.cc:52 ) base::MessagePumpWin::Run(base::MessagePump::Delegate *) 0x000007fecedbc530 (chrome.dll -run_loop.cc:102 ) base::RunLoop::Run() 0x000007fecf168cbf (chrome.dll -chrome_browser_main.cc:2065 ) ChromeBrowserMainParts::MainMessageLoopRun(int *) 0x000007fecf168ad1 (chrome.dll -browser_main_loop.cc:1040 ) content::BrowserMainLoop::RunMainMessageLoopParts() 0x000007fecf168a7c (chrome.dll -browser_main_runner_impl.cc:162 ) content::BrowserMainRunnerImpl::Run() 0x000007fecfa2797d (chrome.dll -browser_main.cc:47 ) content::BrowserMain(content::MainFunctionParams const &) 0x000007fecff75232 (chrome.dll -content_main_runner_impl.cc:536 ) content::RunBrowserProcessMain(content::MainFunctionParams const &,content::ContentMainDelegate *) 0x000007fecff75539 (chrome.dll -content_main_runner_impl.cc:888 ) content::ContentMainRunnerImpl::Run(bool) 0x000007feceda5977 (chrome.dll -main.cc:472 ) service_manager::Main(service_manager::MainParams const &) 0x000007feceda5577 (chrome.dll -content_main.cc:19 ) content::ContentMain(content::ContentMainParams const &) 0x000007feceda1d69 (chrome.dll -chrome_main.cc:101 ) ChromeMain 0x000000013f14376b (chrome.exe -main_dll_loader_win.cc:201 ) MainDllLoader::Launch(HINSTANCE__ *,base::TimeTicks) 0x000000013f141698 (chrome.exe -chrome_exe_main_win.cc:230 ) wWinMain 0x000000013f205491 (chrome.exe -exe_common.inl:283 ) __scrt_common_main_seh 0x76e159cc (KERNEL32.dll + 0x000159cc ) BaseThreadInitThunk 0x7707383c (ntdll.dll + 0x0005383c ) RtlUserThreadStart Adding release blocker label for this issue.Please reduce priority or remove if not the case. Thank You!
,
Aug 31
[Stability Sheriff] Reviewing release blockers. I'm not sure the crash is specifically related to devools (perhaps having devtools open makes it more likely to happen)? It's also been happening since 69.0.3485.0 at a low rate (< 1/day). Given the low rate of occurrence, not sure it should be a release blocker, but would be good to fix. The code that's crashing is accepting a print preview image in response to a previous request, and it could be that rapid reloading causes a race condition there. rbpotter@ landed a fix in 5162124a8b00371c649fe9df551200b997cc45bd that addressed some crashes in print preview, but this might be a side effect of that (or just changed the signatures of existing crashes). rbpotter@, can you take a look?
,
Aug 31
avshaikh@ are you still seeing this crash?
,
Sep 3
Update : Retested the above issue using latest Canary build #71.0.3541.0 on Windows (7, 8, 8.1, 10)OS. Kindly refer the attached screen-cast. Thank You!
,
Sep 5
devtools is definitely required for this crash to happen, because it is refreshing the Print Preview, which is what causes the crash - the print preview isn't actually getting destroyed, but it is getting fully re-initialized. This means the UI ID has not changed so the message handler thinks it can forward the message safely, but in fact the state has been reset so Print Preview isn't expecting to get a renderer message. If you just refresh the page with print preview open and no devtools window, the preview closes, so this crash can't occur. Since this requires a pretty complicated and unusual sequence of actions (open Print Preview, then open dev tools for print preview, then refresh it at the right time), I'm removing RBS and reducing priority. Will investigate to see if there is anything we can do to detect that the print preview has been refreshed rather than closed, and drop the messages in that case instead of killing the renderer.
,
Oct 26
https://goto.google.com/wckai from bug 899030 seems to imply this renderer kill can occur in other situations. (Search for "aw snap" and "crash" on that page)
,
Oct 29
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/a7a9dbd2bcee8cc899d1046cc2aa850021070fe3 commit a7a9dbd2bcee8cc899d1046cc2aa850021070fe3 Author: rbpotter <rbpotter@chromium.org> Date: Mon Oct 29 20:46:33 2018 Fix Print Preview refresh Previously, it was not possible to refresh Print Preview using dev tools. However, it is now possible to do so, and as a result renderer/compositor messages can return to a refreshed Print Preview page that is not expecting any messages, leading to a renderer kill. Since the preview ui id is used only for routing messages from the PrintPreviewMessageHandler back to the appropriate PrintPreviewUI instance, which then forwards them to the PrintPreviewHandler that ultimately sends them to the Print Preview Web UI, it should not be initialized until the web UI is ready to receive messages. It should also be reset whenever the web UI is reloaded. This can be accomplished by setting the preview ui id in OnJavascriptAllowed() and clearing it in OnJavascriptDisallowed() or the PrintPreviewUI destructor, whichever occurs first. Refreshed Preview UIs will then have a different unique identifier after each refresh, which ensures renderer messages intended for previous instances of the web UI page will be dropped instead of being received by the handler and causing a renderer kill. Bug: 874744 Change-Id: Ia43aa9abb97e7952ec3761e5fb016f6513c1c982 Reviewed-on: https://chromium-review.googlesource.com/c/1302676 Reviewed-by: Lei Zhang <thestig@chromium.org> Commit-Queue: Rebekah Potter <rbpotter@chromium.org> Cr-Commit-Position: refs/heads/master@{#603609} [modify] https://crrev.com/a7a9dbd2bcee8cc899d1046cc2aa850021070fe3/chrome/browser/printing/print_preview_message_handler.cc [modify] https://crrev.com/a7a9dbd2bcee8cc899d1046cc2aa850021070fe3/chrome/browser/ui/webui/print_preview/print_preview_handler.cc [modify] https://crrev.com/a7a9dbd2bcee8cc899d1046cc2aa850021070fe3/chrome/browser/ui/webui/print_preview/print_preview_ui.cc [modify] https://crrev.com/a7a9dbd2bcee8cc899d1046cc2aa850021070fe3/chrome/browser/ui/webui/print_preview/print_preview_ui.h [modify] https://crrev.com/a7a9dbd2bcee8cc899d1046cc2aa850021070fe3/chrome/browser/ui/webui/print_preview/print_preview_ui_unittest.cc
,
Oct 31
,
Nov 1
|
||||||||
►
Sign in to add a comment |
||||||||
Comment 1 by avsha...@etouch.net
, Aug 16Owner: lushnikov@chromium.org
Status: Assigned (was: Unconfirmed)