New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 874744 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: Nov 1
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Mac
Pri: 2
Type: Bug-Regression



Sign in to add a comment

Regression : Current tab crashes after pressing 'F5' key multiple times in print preview window.

Reported by avsha...@etouch.net, Aug 16

Issue description

Chrome Version : 70.0.3524.0 (Official Build) af89913d666a6f95572c04f15ab3a0752343ebf3-refs/branch-heads/3524@{#1} 32/64 bit
OS : Windows (7, 8, 8.1, 10)

What steps will reproduce the problem?
1. Launch chrome, open NTP and press CTRL + P keys to open print preview.
2. Right click on preview page and select 'Inspect' option.
3. Now, hit 'F5' key rapidly multiple times and observe.

Actual Result : Current tab crashes after pressing 'F5' key multiple times in print preview window.

Expected Result : Tab should not crash after step 3.

Crash ID : 
-----------
Crash ID 42d4ca659b423464 (Local Crash ID: e90ecc5a-5b3c-4575-a9f6-03259e68e40a)

This is a regression issue broken in ‘M-70’ and will soon update remaining info.
Good Build : 70.0.3503.0 (Revision : 578160)
Bad Build : 70.0.3504.0 (Revision : 578510)
 
Actual_Crash.mp4
652 KB View Download
Expected.mp4
803 KB View Download
Labels: hasbisect-per-revision RegressedIn-70 Target-70 FoundIn-70 OS-Linux OS-Mac
Owner: lushnikov@chromium.org
Status: Assigned (was: Unconfirmed)
This is a regression issue broken in ‘M-70’ and below is the bisect info:
Good Build : 70.0.3503.0 (Revision : 578160)
Bad Build : 70.0.3504.0 (Revision : 578510)

Change Log URL :
https://chromium.googlesource.com/chromium/src/+log/4c440b7c6b5edb7c01d41d498bc00f686c2251fa..bd8a9141c0588fd211570c769d82dfa595add19a

Suspecting : https://chromium.googlesource.com/chromium/src/+/bd8a9141c0588fd211570c769d82dfa595add19a

Andrey@ : Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Note : 
1. Issue is also observed in Dev build #70.0.3521.2
2. Issue is also reproducible in Mac(10.12.6, 10.13.1, 10.13.6, 10.14) & Linux(14.04 LTS) OS
3. This issue can be reproduced on any web page.

Thank you..!
Labels: ReleaseBlock-Stable
Stack trace for the crash id:
-----------------------------
Thread 0 (id: 0x1560) CRASHED [Simulated Exception @ 0x000007fef09cfc27 ] MAGIC SIGNATURE THREAD
Stack Quality100%Show frame trust levels
0x000007fef09cfc27	(chrome_elf.dll -crashpad.cc:256 )	crash_reporter::DumpWithoutCrashing()
0x000007fecff9b341	(chrome.dll -dump_without_crashing.cc:23 )	base::debug::DumpWithoutCrashing()
0x000007fecfc1f701	(chrome.dll -render_process_host_impl.cc:2440 )	content::RenderProcessHostImpl::ShutdownForBadMessage(content::RenderProcessHost::CrashReportMode)
0x000007fed0daee9a	(chrome.dll -print_preview_handler.cc:635 )	PrintPreviewHandler::ShouldReceiveRendererMessage(int)
0x000007fed0db0e53	(chrome.dll -print_preview_handler.cc:1255 )	PrintPreviewHandler::SendPagePreviewReady(int,int,int)
0x000007fed0efabe4	(chrome.dll -print_preview_message_handler.cc:270 )	printing::PrintPreviewMessageHandler::NotifyUIPreviewPageReady(int,PrintHostMsg_PreviewIds const &,scoped_refptr<base::RefCountedMemory>)
0x000007fed0efab43	(chrome.dll -print_preview_message_handler.cc:299 )	printing::PrintPreviewMessageHandler::OnCompositePdfPageDone(int,PrintHostMsg_PreviewIds const &,printing::mojom::PdfCompositor_Status,base::ReadOnlySharedMemoryRegion)
0x000007fed0efc21b	(chrome.dll -bind_internal.h:516 )	base::internal::FunctorTraits<void (printing::PrintPreviewMessageHandler::*)(int, const PrintHostMsg_PreviewIds &, printing::mojom::PdfCompositor_Status, base::ReadOnlySharedMemoryRegion),void>::Invoke<void (printing::PrintPreviewMessageHandler::*)(int, const PrintHostMsg_PreviewIds &, printing::mojom::PdfCompositor_Status, base::ReadOnlySharedMemoryRegion),base::WeakPtr<printing::PrintPreviewMessageHandler>,int,PrintHostMsg_PreviewIds,printing::mojom::PdfCompositor_Status,base::ReadOnlySharedMemoryRegion>
0x000007fed0efc109	(chrome.dll -bind_internal.h:658 )	base::internal::Invoker<base::internal::BindState<void (printing::PrintPreviewMessageHandler::*)(int, const PrintHostMsg_PreviewIds &, printing::mojom::PdfCompositor_Status, base::ReadOnlySharedMemoryRegion),base::WeakPtr<printing::PrintPreviewMessageHandler>,int,PrintHostMsg_PreviewIds>,void (printing::mojom::PdfCompositor_Status, base::ReadOnlySharedMemoryRegion)>::RunOnce
0x000007fed0c69756	(chrome.dll -print_composite_client.cc:210 )	printing::PrintCompositeClient::OnDidCompositePageToPdf(base::OnceCallback<void >,printing::mojom::PdfCompositor_Status,base::ReadOnlySharedMemoryRegion)
0x000007fed0c6a312	(chrome.dll -bind_internal.h:658 )	base::internal::Invoker<base::internal::BindState<void (printing::PrintCompositeClient::*)(base::OnceCallback<void (printing::mojom::PdfCompositor_Status, base::ReadOnlySharedMemoryRegion)>, printing::mojom::PdfCompositor_Status, base::ReadOnlySharedMemoryRegion),base::internal::UnretainedWrapper<printing::PrintCompositeClient>,base::OnceCallback<void (printing::mojom::PdfCompositor_Status, base::ReadOnlySharedMemoryRegion)> >,void (printing::mojom::PdfCompositor_Status, base::ReadOnlySharedMemoryRegion)>::RunOnce
0x000007fecff5b14e	(chrome.dll -pdf_compositor.mojom.cc:388 )	printing::mojom::PdfCompositor_CompositePageToPdf_ForwardToCallback::Accept(mojo::Message *)
0x000007fecee89d34	(chrome.dll -interface_endpoint_client.cc:418 )	mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message *)
0x000007fecee89654	(chrome.dll -multiplex_router.cc:868 )	mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper *,mojo::internal::MultiplexRouter::ClientCallBehavior,base::SequencedTaskRunner *)
0x000007fecee8918b	(chrome.dll -multiplex_router.cc:590 )	mojo::internal::MultiplexRouter::Accept(mojo::Message *)
0x000007fecee88933	(chrome.dll -connector.cc:456 )	mojo::Connector::ReadSingleMessage(unsigned int *)
0x000007fecee887ae	(chrome.dll -connector.cc:486 )	mojo::Connector::ReadAllAvailableMessages()
0x000007fecee88698	(chrome.dll -simple_watcher.cc:273 )	mojo::SimpleWatcher::OnHandleReady(int,unsigned int,mojo::HandleSignalsState const &)
0x000007fecedc39fb	(chrome.dll -task_annotator.cc:101 )	base::debug::TaskAnnotator::RunTask(char const *,base::PendingTask *)
0x000007fecedc33f6	(chrome.dll -message_loop.cc:431 )	base::MessageLoop::RunTask(base::PendingTask *)
0x000007fecedbcad4	(chrome.dll -message_loop.cc:514 )	base::MessageLoop::DoWork()
0x000007feceeb5878	(chrome.dll -message_pump_win.cc:179 )	base::MessagePumpForUI::DoRunLoop()
0x000007fecedbc7cd	(chrome.dll -message_pump_win.cc:52 )	base::MessagePumpWin::Run(base::MessagePump::Delegate *)
0x000007fecedbc530	(chrome.dll -run_loop.cc:102 )	base::RunLoop::Run()
0x000007fecf168cbf	(chrome.dll -chrome_browser_main.cc:2065 )	ChromeBrowserMainParts::MainMessageLoopRun(int *)
0x000007fecf168ad1	(chrome.dll -browser_main_loop.cc:1040 )	content::BrowserMainLoop::RunMainMessageLoopParts()
0x000007fecf168a7c	(chrome.dll -browser_main_runner_impl.cc:162 )	content::BrowserMainRunnerImpl::Run()
0x000007fecfa2797d	(chrome.dll -browser_main.cc:47 )	content::BrowserMain(content::MainFunctionParams const &)
0x000007fecff75232	(chrome.dll -content_main_runner_impl.cc:536 )	content::RunBrowserProcessMain(content::MainFunctionParams const &,content::ContentMainDelegate *)
0x000007fecff75539	(chrome.dll -content_main_runner_impl.cc:888 )	content::ContentMainRunnerImpl::Run(bool)
0x000007feceda5977	(chrome.dll -main.cc:472 )	service_manager::Main(service_manager::MainParams const &)
0x000007feceda5577	(chrome.dll -content_main.cc:19 )	content::ContentMain(content::ContentMainParams const &)
0x000007feceda1d69	(chrome.dll -chrome_main.cc:101 )	ChromeMain
0x000000013f14376b	(chrome.exe -main_dll_loader_win.cc:201 )	MainDllLoader::Launch(HINSTANCE__ *,base::TimeTicks)
0x000000013f141698	(chrome.exe -chrome_exe_main_win.cc:230 )	wWinMain
0x000000013f205491	(chrome.exe -exe_common.inl:283 )	__scrt_common_main_seh
0x76e159cc	(KERNEL32.dll + 0x000159cc )	BaseThreadInitThunk
0x7707383c	(ntdll.dll + 0x0005383c )	RtlUserThreadStart

Adding release blocker label for this issue.Please reduce priority or remove if not the case.

Thank You!
Cc: lushnikov@chromium.org
Owner: rbpotter@chromium.org
[Stability Sheriff] Reviewing release blockers.

I'm not sure the crash is specifically related to devools (perhaps having devtools open makes it more likely to happen)?  It's also been happening since 69.0.3485.0 at a low rate (< 1/day).  Given the low rate of occurrence, not sure it should be a release blocker, but would be good to fix.

The code that's crashing is accepting a print preview image in response to a previous request, and it could be that rapid reloading causes a race condition there.  rbpotter@ landed a fix in 5162124a8b00371c649fe9df551200b997cc45bd that addressed some crashes in print preview, but this might be a side effect of that (or just changed the signatures of existing crashes).

rbpotter@, can you take a look?


Labels: Needs-Feedback
avshaikh@ are you still seeing this crash? 
Labels: -Needs-Feedback
Update :
Retested the above issue using latest Canary build #71.0.3541.0 on Windows (7, 8, 8.1, 10)OS. Kindly refer the attached screen-cast.
Thank You!
Canary_Behaviour#71.0.3541.0.mp4
535 KB View Download
Labels: -Pri-1 -ReleaseBlock-Stable Pri-2
devtools is definitely required for this crash to happen, because it is refreshing the Print Preview, which is what causes the crash - the print preview isn't actually getting destroyed, but it is getting fully re-initialized. This means the UI ID has not changed so the message handler thinks it can forward the message safely, but in fact the state has been reset so Print Preview isn't expecting to get a renderer message.

If you just refresh the page with print preview open and no devtools window, the preview closes, so this crash can't occur.

Since this requires a pretty complicated and unusual sequence of actions (open Print Preview, then open dev tools for print preview, then refresh it at the right time), I'm removing RBS and reducing priority. Will investigate to see if there is anything we can do to detect that the print preview has been refreshed rather than closed, and drop the messages in that case instead of killing the renderer.
https://goto.google.com/wckai from bug 899030 seems to imply this renderer kill can occur in other situations. (Search for "aw snap" and "crash" on that page)
Project Member

Comment 8 by bugdroid1@chromium.org, Oct 29

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a7a9dbd2bcee8cc899d1046cc2aa850021070fe3

commit a7a9dbd2bcee8cc899d1046cc2aa850021070fe3
Author: rbpotter <rbpotter@chromium.org>
Date: Mon Oct 29 20:46:33 2018

Fix Print Preview refresh

Previously, it was not possible to refresh Print Preview using dev
tools. However, it is now possible to do so, and as a result
renderer/compositor messages can return to a refreshed Print Preview
page that is not expecting any messages, leading to a renderer kill.

Since the preview ui id is used only for routing messages from the
PrintPreviewMessageHandler back to the appropriate PrintPreviewUI
instance, which then forwards them to the PrintPreviewHandler that
ultimately sends them to the Print Preview Web UI, it should not be
initialized until the web UI is ready to receive messages. It should
also be reset whenever the web UI is reloaded. This can be accomplished
by setting the preview ui id in OnJavascriptAllowed() and clearing it
in OnJavascriptDisallowed() or the PrintPreviewUI destructor, whichever
occurs first.

Refreshed Preview UIs will then have a different unique identifier
after each refresh, which ensures renderer messages intended for
previous instances of the web UI page will be dropped instead of being
received by the handler and causing a renderer kill.

Bug:  874744 
Change-Id: Ia43aa9abb97e7952ec3761e5fb016f6513c1c982
Reviewed-on: https://chromium-review.googlesource.com/c/1302676
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Rebekah Potter <rbpotter@chromium.org>
Cr-Commit-Position: refs/heads/master@{#603609}
[modify] https://crrev.com/a7a9dbd2bcee8cc899d1046cc2aa850021070fe3/chrome/browser/printing/print_preview_message_handler.cc
[modify] https://crrev.com/a7a9dbd2bcee8cc899d1046cc2aa850021070fe3/chrome/browser/ui/webui/print_preview/print_preview_handler.cc
[modify] https://crrev.com/a7a9dbd2bcee8cc899d1046cc2aa850021070fe3/chrome/browser/ui/webui/print_preview/print_preview_ui.cc
[modify] https://crrev.com/a7a9dbd2bcee8cc899d1046cc2aa850021070fe3/chrome/browser/ui/webui/print_preview/print_preview_ui.h
[modify] https://crrev.com/a7a9dbd2bcee8cc899d1046cc2aa850021070fe3/chrome/browser/ui/webui/print_preview/print_preview_ui_unittest.cc

Components: -Platform>DevTools
Status: Fixed (was: Assigned)

Sign in to add a comment