Chrome Version: Chrome\Application\69.0.3497.100\chrome.dll
OS: Windows 10 17763
Repro:
1. Open https://whytls.com/test/frames.htm
2. Type "Domain" (no quotes) in the Search box
3. Observe: Dings a few times, including at the end of typing
4. Click "Random cycle"
5. Switch to another tab, do a search.
6. Close the original tab.
Result: Chrome browser busyhangs at 100% of one CPU.
0:000> ~0kp
# Child-SP RetAddr Call Site
00 000000a3`a3dfd1c8 00007ffa`d44005ef chrome!std::_Hash<std::_Uset_traits<media::AudioInputStream *,std::_Uhash_compare<media::AudioInputStream *,std::hash<media::AudioInputStream *>,std::equal_to<media::AudioInputStream *> >,std::allocator<media::AudioInputStream *>,0> >::equal_range(class media::AudioInputStream ** _Keyval = 0x000000a3`a3dfd270)+0x24 [C:\b\c\b\win64_clang\src\third_party\depot_tools\win_toolchain\vs_files\3bc0ec615cf20ee342f3bc29bc991b5ad66d8d2c\VC\Tools\MSVC\14.14.26428\include\xhash @ 700]
01 000000a3`a3dfd1e0 00007ffa`d44009ae chrome!std::_Hash<std::_Uset_traits<content::RenderFrameHost *,std::_Uhash_compare<content::RenderFrameHost *,std::hash<content::RenderFrameHost *>,std::equal_to<content::RenderFrameHost *> >,std::allocator<content::RenderFrameHost *>,0> >::count(class content::RenderFrameHost ** _Keyval = <Value unavailable error>)+0x27 [C:\b\c\b\win64_clang\src\third_party\depot_tools\win_toolchain\vs_files\3bc0ec615cf20ee342f3bc29bc991b5ad66d8d2c\VC\Tools\MSVC\14.14.26428\include\xhash @ 651]
02 000000a3`a3dfd230 00007ffa`d440041e chrome!content::FindRequestManager::Traverse(class content::RenderFrameHost * from_rfh = 0x00000294`21cabb80, bool forward = <Value unavailable error>, bool matches_only = <Value unavailable error>, bool wrap = <Value unavailable error>)+0xd8 [C:\b\c\b\win64_clang\src\content\browser\find_request_manager.cc @ 0]
03 000000a3`a3dfd2f0 00007ffa`d440058e chrome!content::FindRequestManager::FinalUpdateReceived(int request_id = 0n216, class content::RenderFrameHost * rfh = <Value unavailable error>)+0x15c [C:\b\c\b\win64_clang\src\content\browser\find_request_manager.cc @ 755]
04 000000a3`a3dfd370 00007ffa`d3e15f7f chrome!content::FindRequestManager::RemoveFrame(class content::RenderFrameHost * rfh = 0x00000294`21cabb80)+0x130 [C:\b\c\b\win64_clang\src\content\browser\find_request_manager.cc @ 451]
05 000000a3`a3dfd3d0 00007ffa`d3e15c2e chrome!content::WebContentsImpl::OnFrameRemoved(class content::RenderFrameHost * render_frame_host = 0x00000294`21cabb80)+0x7d [C:\b\c\b\win64_clang\src\content\browser\web_contents\web_contents_impl.cc @ 6224]
06 000000a3`a3dfd460 00007ffa`d4403293 chrome!content::FrameTreeNode::~FrameTreeNode(void)+0xb4 [C:\b\c\b\win64_clang\src\content\browser\frame_host\frame_tree_node.cc @ 156]
07 000000a3`a3dfd500 00007ffa`d3a1919e chrome!std::_Default_allocator_traits<std::allocator<std::unique_ptr<content::FrameTreeNode,std::default_delete<content::FrameTreeNode> > > >::destroy<std::unique_ptr<content::FrameTreeNode,std::default_delete<content::FrameTreeNode> > >(class std::unique_ptr<content::FrameTreeNode,std::default_delete<content::FrameTreeNode> > * _Ptr = 0x000000a3`a3dfd208 unique_ptr {...})+0x15 [C:\b\c\b\win64_clang\src\third_party\depot_tools\win_toolchain\vs_files\3bc0ec615cf20ee342f3bc29bc991b5ad66d8d2c\VC\Tools\MSVC\14.14.26428\include\xmemory0 @ 926]
08 000000a3`a3dfd530 00007ffa`d3a19164 chrome!std::vector<std::unique_ptr<content::FrameTreeNode,std::default_delete<content::FrameTreeNode> >,std::allocator<std::unique_ptr<content::FrameTreeNode,std::default_delete<content::FrameTreeNode> > > >::_Tidy(void)+0x26 [C:\b\c\b\win64_clang\src\third_party\depot_tools\win_toolchain\vs_files\3bc0ec615cf20ee342f3bc29bc991b5ad66d8d2c\VC\Tools\MSVC\14.14.26428\include\vector @ 2014]
09 000000a3`a3dfd570 00007ffa`d4410e58 chrome!content::FrameTreeNode::ResetForNewProcess(void)+0x66 [C:\b\c\b\win64_clang\src\content\browser\frame_host\frame_tree_node.cc @ 226]
0a 000000a3`a3dfd5c0 00007ffa`d4410d1a chrome!content::RenderFrameHostImpl::OnRenderProcessGone(int status = 0n4, int exit_code = <Value unavailable error>)+0x5a [C:\b\c\b\win64_clang\src\content\browser\frame_host\render_frame_host_impl.cc @ 2111]
0b 000000a3`a3dfd750 00007ffa`d3ced740 chrome!IPC::MessageT<FrameHostMsg_RenderProcessGone_Meta,std::tuple<int,int>,void>::Dispatch<content::RenderFrameHostImpl,content::RenderFrameHostImpl,void,void (class IPC::Message * msg = 0x000000a3`a3dfdbf0 {size = 0x50}, class content::RenderFrameHostImpl * obj = <Value unavailable error>, class content::RenderFrameHostImpl * sender = <Value unavailable error>, void * parameter = <Value unavailable error>, <function> * func = 0x00000000`00000000)+0x92 [C:\b\c\b\win64_clang\src\ipc\ipc_message_templates.h @ 146]
0c 000000a3`a3dfd850 00007ffa`d3e1d4a2 chrome!content::RenderFrameHostImpl::OnMessageReceived(class IPC::Message * msg = <Value unavailable error>)+0x76 [C:\b\c\b\win64_clang\src\content\browser\frame_host\render_frame_host_impl.cc @ 1031]
0d 000000a3`a3dfdbc0 00007ffa`d4525206 chrome!content::RenderProcessHostImpl::ProcessDied(bool already_dead = <Value unavailable error>, struct content::ChildProcessTerminationInfo * known_info = <Value unavailable error>)+0x20e [C:\b\c\b\win64_clang\src\content\browser\renderer_host\render_process_host_impl.cc @ 3998]
0e 000000a3`a3dfdca0 00007ffa`d51f2af4 chrome!content::RenderProcessHostImpl::FastShutdownIfPossible(unsigned int64 page_count = <Value unavailable error>, bool skip_unload_handlers = <Value unavailable error>)+0xc4 [C:\b\c\b\win64_clang\src\content\browser\renderer_host\render_process_host_impl.cc @ 3096]
0f 000000a3`a3dfdd00 00007ffa`d51f0c70 chrome!TabStripModel::CloseWebContentses(class base::span<content::WebContents *const,18446744073709551615> * items = <Value unavailable error>, unsigned int close_types = <Value unavailable error>)+0xf4 [C:\b\c\b\win64_clang\src\chrome\browser\ui\tabs\tab_strip_model.cc @ 1380]
10 000000a3`a3dfde20 00007ffa`d51f0dc0 chrome!TabStripModel::InternalCloseTabs(class base::span<content::WebContents *const,18446744073709551615> * items = <Value unavailable error>, unsigned int close_types = <Value unavailable error>)+0x112 [C:\b\c\b\win64_clang\src\chrome\browser\ui\tabs\tab_strip_model.cc @ 1343]
11 000000a3`a3dfdef0 00007ffa`d5e70ad3 chrome!TabStripModel::CloseWebContentsAt(int index = <Value unavailable error>, unsigned int close_types = <Value unavailable error>)+0x56 [C:\b\c\b\win64_clang\src\chrome\browser\ui\tabs\tab_strip_model.cc @ 642]
12 000000a3`a3dfdf40 00007ffa`d4873760 chrome!Tab::ButtonPressed(class views::Button * sender = <Value unavailable error>, class ui::Event * event = 0x000000a3`a3dfe268)+0x7f [C:\b\c\b\win64_clang\src\chrome\browser\ui\views\tabs\tab.cc @ 588]
13 000000a3`a3dfdf90 00007ffa`d4cf4064 chrome!views::Button::OnMouseReleased(class ui::MouseEvent * event = 0x000000a3`a3dfe268)+0x80 [C:\b\c\b\win64_clang\src\ui\views\controls\button\button.cc @ 240]
14 000000a3`a3dfdfe0 00007ffa`d3aa4be8 chrome!views::InkDropHostView::OnMouseEvent(class ui::MouseEvent * event = 0x000000a3`a3dfe268)+0xaa [C:\b\c\b\win64_clang\src\ui\views\animation\ink_drop_host_view.cc @ 279]
15 000000a3`a3dfe050 00007ffa`d3aa4b1b chrome!ui::EventHandler::OnEvent(class ui::Event * event = <Value unavailable error>)+0x74 [C:\b\c\b\win64_clang\src\ui\events\event_handler.cc @ 32]
16 000000a3`a3dfe0a0 00007ffa`d3aa46e1 chrome!ui::EventDispatcher::DispatchEvent(class ui::EventHandler * handler = 0x00000294`1eb08c18, class ui::Event * event = 0x000000a3`a3dfe268)+0x3b [C:\b\c\b\win64_clang\src\ui\events\event_dispatcher.cc @ 192]
17 000000a3`a3dfe0f0 00007ffa`d3aa45bb chrome!ui::EventDispatcher::ProcessEvent(class ui::EventTarget * target = 0x00000294`1eb08bd8, class ui::Event * event = 0x000000a3`a3dfe268)+0xb9 [C:\b\c\b\win64_clang\src\ui\events\event_dispatcher.cc @ 140]
18 000000a3`a3dfe140 00007ffa`d3aa3842 chrome!ui::EventDispatcherDelegate::DispatchEventToTarget(class ui::EventTarget * target = 0x00000294`1eb08bd8, class ui::Event * event = <Value unavailable error>)+0x57 [C:\b\c\b\win64_clang\src\ui\events\event_dispatcher.cc @ 87]
19 000000a3`a3dfe1d0 00007ffa`d4cfc3af chrome!ui::EventDispatcherDelegate::DispatchEvent(class ui::EventTarget * target = <Value unavailable error>, class ui::Event * event = <Value unavailable error>)+0xdc [C:\b\c\b\win64_clang\src\ui\events\event_dispatcher.cc @ 58]
1a 000000a3`a3dfe240 00007ffa`d3e079a2 chrome!views::internal::RootView::OnMouseReleased(class ui::MouseEvent * event = <Value unavailable error>)+0x7d [C:\b\c\b\win64_clang\src\ui\views\widget\root_view.cc @ 447]
1b 000000a3`a3dfe390 00007ffa`d3aa4be8 chrome!views::Widget::OnMouseEvent(class ui::MouseEvent * event = <Value unavailable error>)+0x1de [C:\b\c\b\win64_clang\src\ui\views\widget\widget.cc @ 1226]
1c 000000a3`a3dfe400 00007ffa`d3aa4b1b chrome!ui::EventHandler::OnEvent(class ui::Event * event = <Value unavailable error>)+0x74 [C:\b\c\b\win64_clang\src\ui\events\event_handler.cc @ 32]
1d 000000a3`a3dfe450 00007ffa`d3aa46e1 chrome!ui::EventDispatcher::DispatchEvent(class ui::EventHandler * handler = 0x00000294`0ef59a58, class ui::Event * event = 0x000000a3`a3dfe928)+0x3b [C:\b\c\b\win64_clang\src\ui\events\event_dispatcher.cc @ 192]
1e 000000a3`a3dfe4a0 00007ffa`d3aa45bb chrome!ui::EventDispatcher::ProcessEvent(class ui::EventTarget * target = 0x00000294`0edc5df0, class ui::Event * event = 0x000000a3`a3dfe928)+0xb9 [C:\b\c\b\win64_clang\src\ui\events\event_dispatcher.cc @ 140]
1f 000000a3`a3dfe4f0 00007ffa`d3aa3842 chrome!ui::EventDispatcherDelegate::DispatchEventToTarget(class ui::EventTarget * target = 0x00000294`0edc5df0, class ui::Event * event = <Value unavailable error>)+0x57 [C:\b\c\b\win64_clang\src\ui\events\event_dispatcher.cc @ 87]
20 000000a3`a3dfe580 00007ffa`d3aa22e7 chrome!ui::EventDispatcherDelegate::DispatchEvent(class ui::EventTarget * target = <Value unavailable error>, class ui::Event * event = <Value unavailable error>)+0xdc [C:\b\c\b\win64_clang\src\ui\events\event_dispatcher.cc @ 58]
21 000000a3`a3dfe5f0 00007ffa`d3aa2018 chrome!ui::EventProcessor::OnEventFromSource(class ui::Event * event = 0x000000a3`a3dfe928)+0x161 [C:\b\c\b\win64_clang\src\ui\events\event_processor.cc @ 57]
22 000000a3`a3dfe690 00007ffa`d3aa1e5e chrome!ui::EventSource::SendEventToSinkFromRewriter(class ui::Event * event = <Value unavailable error>, class ui::EventRewriter * rewriter = 0x00000000`00000000)+0x1b0 [C:\b\c\b\win64_clang\src\ui\events\event_source.cc @ 86]
23 000000a3`a3dfe750 00007ffa`d519fae0 chrome!ui::EventSource::SendEventToSink(class ui::Event * event = 0x000000a3`a3dfd270)+0x10 [C:\b\c\b\win64_clang\src\ui\events\event_source.cc @ 44]
24 000000a3`a3dfe780 00007ffa`d3aa0ea4 chrome!views::DesktopWindowTreeHostWin::HandlePointerEvent(class ui::PointerEvent * event = 0x000000a3`a3dfe928)+0x2c [C:\b\c\b\win64_clang\src\ui\views\widget\desktop_aura\desktop_window_tree_host_win.cc @ 885]
25 000000a3`a3dfe7d0 00007ffa`d3921677 chrome!views::HWNDMessageHandler::HandleMouseEventInternal(unsigned int message = <Value unavailable error>, unsigned int64 w_param = 0, int64 l_param = 0n1901254, bool track_mouse = <Value unavailable error>)+0x306 [C:\b\c\b\win64_clang\src\ui\views\win\hwnd_message_handler.cc @ 2884]
26 000000a3`a3dfea70 00007ffa`d392143c chrome!views::HWNDMessageHandler::_ProcessWindowMessage(struct HWND__ * hWnd = <Value unavailable error>, unsigned int uMsg = 0x202, unsigned int64 wParam = 0, int64 lParam = 0n1901254, int64 * lResult = 0x000000a3`a3dfeb48, unsigned long dwMsgMapID = 0)+0xaf [C:\b\c\b\win64_clang\src\ui\views\win\hwnd_message_handler.h @ 323]
27 000000a3`a3dfeb00 00007ffa`d37474ef chrome!views::HWNDMessageHandler::OnWndProc(unsigned int message = 0x202, unsigned int64 w_param = 0, int64 l_param = 0n1901254)+0xac [C:\b\c\b\win64_clang\src\ui\views\win\hwnd_message_handler.cc @ 976]
==========
STACK_TEXT:
00000000`00000000 00000000`00000000 chrome.exe!BusyHang+0x0
00000000`00000000 00000000`00000000 unknown![BusyHang]+0x0
000000a3`a3dfd1c8 00007ffa`d40bfb52 chrome!std::_Hash<std::_Uset_traits<media::AudioInputStream *,std::_Uhash_compare<media::AudioInputStream *,std::hash<media::AudioInputStream *>,std::equal_to<media::AudioInputStream *> >,std::allocator<media::AudioInputStream *>,0> >::equal_range+0x0
000000a3`a3dfd1e0 00007ffa`d44005ef chrome!std::_Hash<std::_Uset_traits<content::RenderFrameHost *,std::_Uhash_compare<content::RenderFrameHost *,std::hash<content::RenderFrameHost *>,std::equal_to<content::RenderFrameHost *> >,std::allocator<content::RenderFrameHost *>,0> >::count+0x0
000000a3`a3dfd230 00007ffa`d44009ae chrome!content::FindRequestManager::Traverse+0x0
000000a3`a3dfd2f0 00007ffa`d440041e chrome!content::FindRequestManager::FinalUpdateReceived+0x0
000000a3`a3dfd370 00007ffa`d440058e chrome!content::FindRequestManager::RemoveFrame+0x0
000000a3`a3dfd3d0 00007ffa`d3e15f7f chrome!content::WebContentsImpl::OnFrameRemoved+0x0
000000a3`a3dfd460 00007ffa`d3e15c2e chrome!content::FrameTreeNode::~FrameTreeNode+0x0
000000a3`a3dfd500 00007ffa`d4403293 chrome!std::_Default_allocator_traits<std::allocator<std::unique_ptr<content::FrameTreeNode,std::default_delete<content::FrameTreeNode> > > >::destroy<std::unique_ptr<content::FrameTreeNode,std::default_delete<content::FrameTreeNode> > >+0x0
000000a3`a3dfd530 00007ffa`d3a1919e chrome!std::vector<std::unique_ptr<content::FrameTreeNode,std::default_delete<content::FrameTreeNode> >,std::allocator<std::unique_ptr<content::FrameTreeNode,std::default_delete<content::FrameTreeNode> > > >::_Tidy+0x0
000000a3`a3dfd570 00007ffa`d3a19164 chrome!content::FrameTreeNode::ResetForNewProcess+0x0
000000a3`a3dfd5c0 00007ffa`d4410e58 chrome!content::RenderFrameHostImpl::OnRenderProcessGone+0x0
000000a3`a3dfd750 00007ffa`d4410d1a chrome!IPC::MessageT<FrameHostMsg_RenderProcessGone_Meta,std::tuple<int,int>,void>::Dispatch<content::RenderFrameHostImpl,content::RenderFrameHostImpl,void,void (content::RenderFrameHostImpl::*)+0x0
000000a3`a3dfd850 00007ffa`d3ced740 chrome!content::RenderFrameHostImpl::OnMessageReceived+0x0
000000a3`a3dfdbc0 00007ffa`d3e1d4a2 chrome!content::RenderProcessHostImpl::ProcessDied+0x0
000000a3`a3dfdca0 00007ffa`d4525206 chrome!content::RenderProcessHostImpl::FastShutdownIfPossible+0x0
000000a3`a3dfdd00 00007ffa`d51f2af4 chrome!TabStripModel::CloseWebContentses+0x0
000000a3`a3dfde20 00007ffa`d51f0c70 chrome!TabStripModel::InternalCloseTabs+0x0
000000a3`a3dfdef0 00007ffa`d51f0dc0 chrome!TabStripModel::CloseWebContentsAt+0x0
000000a3`a3dfdf40 00007ffa`d5e70ad3 chrome!Tab::ButtonPressed+0x0
Comment 1 by elawrence@chromium.org
, Sep 25