it appears that filenames[0] can be null here, maybe from size() being 0.

https://chromium.googlesource.com/chromium/src.git/+/68.0.3440.84/ui/base/clipboard/clipboard_util_win.cc#165

So perhaps this should bail out instead of just having a DCHECK protecting it.

This is #30 out of all crashes in WER for 68.0.3440.84

it seems these might not be being caught by crashpad because combase seems to register an exception handler for these types of events.

To reproduce, set a BP at chrome!ui::ClipboardUtil::GetUrl then drag something from explorer into chrome. Stack I get is:

 # ChildEBP RetAddr  
00 002ae36c 10b46f4e chrome!ui::ClipboardUtil::GetUrl [C:\b\c\b\win_clang\src\ui\base\clipboard\clipboard_util_win.cc @ 129] 
01 002ae438 10b48d96 chrome!ui::ClipboardUtil::GetPlainText+0x104 [C:\b\c\b\win_clang\src\ui\base\clipboard\clipboard_util_win.cc @ 254] 
02 002ae448 103ebc70 chrome!ui::OSExchangeDataProviderWin::GetString+0xe [C:\b\c\b\win_clang\src\ui\base\dragdrop\os_exchange_data_provider_win.cc @ 417] 
03 002ae5c4 114e725a chrome!content::WebContentsViewAura::OnDragEntered+0x144 [C:\b\c\b\win_clang\src\content\browser\web_contents\web_contents_view_aura.cc @ 1157] 
04 002ae604 114e7075 chrome!views::DesktopDropTargetWin::Translate+0x1a0 [C:\b\c\b\win_clang\src\ui\views\widget\desktop_aura\desktop_drop_target_win.cc @ 158] 
05 002ae648 114e754d chrome!views::DesktopDropTargetWin::OnDragEnter+0x3b [C:\b\c\b\win_clang\src\ui\views\widget\desktop_aura\desktop_drop_target_win.cc @ 66] 
06 002ae67c 74364fa2 chrome!ui::DropTargetWin::DragEnter+0x99 [C:\b\c\b\win_clang\src\ui\base\dragdrop\drop_target_win.cc @ 53] 
07 002ae6c0 74b7faec ole32!CPrivDragDrop::PrivDragDrop+0x302 [com\ole32\com\rot\getif.cxx @ 659] 
08 002ae704 74b47301 RPCRT4!Invoke+0x34
09 002aeb58 746a47d9 RPCRT4!NdrStubCall2+0x451
0a 002aeba4 7465f218 combase!CStdStubBuffer_Invoke+0x99 [onecore\com\combase\ndr\ndrole\stub.cxx @ 1527] 
0b (Inline) -------- combase!InvokeStubWithExceptionPolicyAndTracing::__l6::<lambda_1ba7c1521bf8e7d0ebd8f0b3c0295667>::operator()+0x4e [onecore\com\combase\dcomrem\channelb.cxx @ 1907] 
0c 002aebf8 7465ec9d combase!ObjectMethodExceptionHandlingAction<<lambda_1ba7c1521bf8e7d0ebd8f0b3c0295667> >+0xa8 [onecore\com\combase\dcomrem\excepn.hxx @ 91] 
0d (Inline) -------- combase!InvokeStubWithExceptionPolicyAndTracing+0xfa [onecore\com\combase\dcomrem\channelb.cxx @ 1905] 
0e 002aecc4 7465faa7 combase!DefaultStubInvoke+0x2bd [onecore\com\combase\dcomrem\channelb.cxx @ 1974] 
0f (Inline) -------- combase!SyncStubCall::Invoke+0x1e [onecore\com\combase\dcomrem\channelb.cxx @ 2031] 
10 (Inline) -------- combase!SyncServerCall::StubInvoke+0x1e [onecore\com\combase\dcomrem\servercall.hpp @ 807] 
11 (Inline) -------- combase!StubInvoke+0x498 [onecore\com\combase\dcomrem\channelb.cxx @ 2257] 
12 002aef7c 7465c50e combase!ServerCall::ContextInvoke+0x677 [onecore\com\combase\dcomrem\ctxchnl.cxx @ 1542] 
13 (Inline) -------- combase!CServerChannel::ContextInvoke+0x93 [onecore\com\combase\dcomrem\ctxchnl.cxx @ 1438] 
14 (Inline) -------- combase!DefaultInvokeInApartment+0xcf [onecore\com\combase\dcomrem\callctrl.cxx @ 3550] 
15 (Inline) -------- combase!ClassicSTAInvokeInApartment+0x399 [onecore\com\combase\dcomrem\callctrl.cxx @ 3314] 
16 002af04c 7465b40d combase!AppInvoke+0x79e [onecore\com\combase\dcomrem\channelb.cxx @ 1688] 
17 002af424 746165f2 combase!ComInvokeWithLockAndIPID+0x60d [onecore\com\combase\dcomrem\channelb.cxx @ 2805] 
18 (Inline) -------- combase!ComInvoke+0x1d7 [onecore\com\combase\dcomrem\channelb.cxx @ 2326] 
19 (Inline) -------- combase!ThreadDispatch+0x4ab [onecore\com\combase\dcomrem\chancont.cxx @ 422] 
1a 002af4c0 773cbe6b combase!ThreadWndProc+0x592 [onecore\com\combase\dcomrem\chancont.cxx @ 750] 
1b 002af4ec 773c833a USER32!_InternalCallWinProc+0x2b
1c 002af5d4 773c7bee USER32!UserCallWinProcCheckWow+0x3aa
1d 002af650 773c79d0 USER32!DispatchMessageWorker+0x20e
1e 002af65c 0fabaea8 USER32!DispatchMessageW+0x10
1f 002af6cc 0f89541f chrome!base::MessagePumpForUI::ProcessMessageHelper+0x88 [C:\b\c\b\win_clang\src\base\message_loop\message_pump_win.cc @ 378] 
20 002af708 0f7ff39e chrome!base::MessagePumpForUI::DoRunLoop+0x4f [C:\b\c\b\win_clang\src\base\message_loop\message_pump_win.cc @ 173] 
21 002af738 0f7ff30f chrome!base::MessagePumpWin::Run+0x6e [C:\b\c\b\win_clang\src\base\message_loop\message_pump_win.cc @ 58] 
22 002af748 0f7ff15e chrome!base::MessageLoop::Run+0x1f [C:\b\c\b\win_clang\src\base\message_loop\message_loop.cc @ 271] 
23 002af758 0fab8ae2 chrome!base::RunLoop::Run+0x2e [C:\b\c\b\win_clang\src\base\run_loop.cc @ 108] 
24 002af7a4 0fab8971 chrome!ChromeBrowserMainParts::MainMessageLoopRun+0x88 [C:\b\c\b\win_clang\src\chrome\browser\chrome_browser_main.cc @ 2157] 
25 002af7d4 0fab892c chrome!content::BrowserMainLoop::RunMainMessageLoopParts+0x3b [C:\b\c\b\win_clang\src\content\browser\browser_main_loop.cc @ 980] 
26 002af7e0 10193225 chrome!content::BrowserMainRunnerImpl::Run+0xe [C:\b\c\b\win_clang\src\content\browser\browser_main_runner_impl.cc @ 170] 
27 002af828 1060f60d chrome!content::BrowserMain+0xb5 [C:\b\c\b\win_clang\src\content\browser\browser_main.cc @ 53] 
28 002af864 0f7c2971 chrome!content::RunBrowserProcessMain+0x75 [C:\b\c\b\win_clang\src\content\app\content_main_runner_impl.cc @ 620] 
29 002af978 0f7b4bc7 chrome!content::ContentMainRunnerImpl::Run+0x179 [C:\b\c\b\win_clang\src\content\app\content_main_runner_impl.cc @ 964] 
2a 002afa8c 0f7b46c8 chrome!service_manager::Main+0x490 [C:\b\c\b\win_clang\src\services\service_manager\embedder\main.cc @ 459] 
2b 002afac8 0f7b1a45 chrome!content::ContentMain+0x33 [C:\b\c\b\win_clang\src\content\app\content_main.cc @ 19] 
2c 002afb30 003c314e chrome!ChromeMain+0x108 [C:\b\c\b\win_clang\src\chrome\app\chrome_main.cc @ 104] 
2d 002afbbc 003c145d chrome_exe!MainDllLoader::Launch+0x230 [C:\b\c\b\win_clang\src\chrome\app\main_dll_loader_win.cc @ 201] 
2e 002afd28 0047fed3 chrome_exe!wWinMain+0x45d [C:\b\c\b\win_clang\src\chrome\app\chrome_exe_main_win.cc @ 231] 
2f 002afd74 743d8484 chrome_exe!__scrt_common_main_seh+0xf8 [f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl @ 283] 
30 002afd88 77832fea KERNEL32!BaseThreadInitThunk+0x24
31 002afdd0 77832fba ntdll!__RtlUserThreadStart+0x2f
32 002afde0 00000000 ntdll!_RtlUserThreadStart+0x1b

combase!InvokeStubWithExceptionPolicyAndTracing looks suspiciously like an exception handler, confirmed by !exchain

0:000> !exchain
048fecc0: RPCRT4!_except_handler4+0 (74b7fb40)
  CRT scope  2, filter: RPCRT4!NdrStubCall2+1c60 (74b48b10)
                func:   RPCRT4!NdrStubCall2+1c7d (74b48b2d)
  CRT scope  0, func:   RPCRT4!NdrStubCall2+1e0f (74b48cbf)
048fed0c: combase!_except_handler4+0 (746bdff0)                  <-----  HERE, maybe?
  CRT scope  0, filter: combase!CStdStubBuffer_Invoke+e7 (746a4827)
                func:   combase!CStdStubBuffer_Invoke+102 (746a4842)
048fed60: combase!_except_handler4+0 (746bdff0)
  CRT scope  0, filter: combase!ObjectMethodExceptionHandlingAction<<lambda_1ba7c1521bf8e7d0ebd8f0b3c0295667> >+aa (7465f21a)
                func:   combase!ObjectMethodExceptionHandlingAction<<lambda_1ba7c1521bf8e7d0ebd8f0b3c0295667> >+a662f (7470579f)
048ff73c: USER32!_except_handler4+0 (773cdbd0)
  CRT scope  0, func:   USER32!UserCallWinProcCheckWow+1a568 (773e24f8)
048ff7b8: USER32!_except_handler4+0 (773cdbd0)
  CRT scope  0, filter: USER32!DispatchMessageWorker+1a685 (773e2065)
                func:   USER32!DispatchMessageWorker+1a6a5 (773e2085)
048ffedc: chrome_exe!_except_handler4+0 (00480dd0)
  CRT scope  0, filter: chrome_exe!__scrt_common_main_seh+121 (0047fefc)
                func:   chrome_exe!__scrt_common_main_seh+135 (0047ff10)
048fff38: ntdll!_except_handler4+0 (77842510)
  CRT scope  0, filter: ntdll!__RtlUserThreadStart+3a51d (7786d4d8)
                func:   ntdll!__RtlUserThreadStart+3a564 (7786d51f)
048fff50: ntdll!FinalExceptionHandlerPad0+0 (7784ec10)
Invalid exception stack at ffffffff

compare with a !exchain when it's not going via combase (e.g. set same breakpoint, and drag something OUT of chrome rather than INTO it).

0:000> !exchain
048ffedc: chrome_exe!_except_handler4+0 (00480dd0)
  CRT scope  0, filter: chrome_exe!__scrt_common_main_seh+121 (0047fefc)
                func:   chrome_exe!__scrt_common_main_seh+135 (0047ff10)
048fff38: ntdll!_except_handler4+0 (77842510)
  CRT scope  0, filter: ntdll!__RtlUserThreadStart+3a51d (7786d4d8)
                func:   ntdll!__RtlUserThreadStart+3a564 (7786d51f)
048fff50: ntdll!FinalExceptionHandlerPad0+0 (7784ec10)
Invalid exception stack at ffffffff

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/be6c3459c415143644103b3a2b1ecd097100bbde

commit be6c3459c415143644103b3a2b1ecd097100bbde
Author: Daniel Cheng <dcheng@chromium.org>
Date: Thu Aug 30 04:22:17 2018

Speculative fix for drag and drop crash.

At least one caller of ClipboardUtil::GetFilenames() expects the output
vector to be non-empty when the method returns true. Ensure that's
always the case. Unfortunately, there's no repro case so this fix is
based on wild conjecture...

Bug: 878583
Change-Id: Idb97f34c804a8b3cb4a2d80a23bff862ebd168f0
Reviewed-on: https://chromium-review.googlesource.com/1195112
Reviewed-by: Will Harris <wfh@chromium.org>
Reviewed-by: Scott Violet <sky@chromium.org>
Commit-Queue: Daniel Cheng <dcheng@chromium.org>
Cr-Commit-Position: refs/heads/master@{#587438}
[modify] https://crrev.com/be6c3459c415143644103b3a2b1ecd097100bbde/ui/base/clipboard/clipboard_util_win.cc
[modify] https://crrev.com/be6c3459c415143644103b3a2b1ecd097100bbde/ui/base/clipboard/clipboard_util_win.h

wfh, would you like me to leave this open so we can track it, or just go ahead and close it?

There are crashes observed for this magic signature since: #68.0.3440.106
Hence adding TE Verified labels

List of Builds:
68.0.3440.106	24.06%	198
68.0.3440.84	3.77%	31
68.0.3440.75	2.67%	22
67.0.3396.99	24.91%	205
67.0.3396.87	5.59%	46
67.0.3396.79	3.04%	25
67.0.3396.62	0.97%	8
67.0.3396.18	0.12%	1

The CL in #4 landed in 70.0.3538.0. There are no crashes past M69 [1]. On the flip side, all crashes appear to be in stable, so we can't tell for sure until M70 rolls out completely to stable.

Setting NextAction to check up on this after M70 rolls out.

[1] https://crash.corp.google.com/browse?q=expanded_custom_data.ChromeCrashProto.magic_signature_1.name%3D%27ui%3A%3AClipboardUtil%3A%3AGetUrl%27#-propertyselector,productname:1000,productversion:100,-magicsignature:50,-magicsignature2:50,-stablesignature:50

The NextAction date has arrived: 2018-11-01