New issue
Advanced search Search tips

Issue 895322 link

Starred by 3 users

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: 2019-01-09
OS: Windows , Mac
Pri: 1
Type: Bug-Regression



Sign in to add a comment

Regression:Browser crash is observed on toggling the 'on' button of extension details.

Reported by shruti.j...@etouch.net, Oct 15

Issue description

Chrome Version : 72.0.3581.0 (Official Build) 694c924ff97377dc28696e1796587cef97b1c10e-refs/branch-heads/3581@{#1} 64 bit
OS : MAC(10.13.1,10.13.6,10.14.1) Windows(7,8,8.1,10)

Test URL:https://chrome.google.com/webstore/detail/office-online/ndjpnladcallmjemlbaebfadecfhkepb?utm_source=chrome-ntp-icon

Steps to reproduce:
1. Launch chrome and download the extension.
2. Open Task Manager from wrench menu and kill the extension.
3. Navigate chrome://extension and click on 'Details' of extension card.
4. Toggle 'On' button  and observe.

Actual Result :Browser crash is observed on toggling the 'on' button of extension details.
Expected Result :Browser should not get crashed on toggling the 'on' button of extension details.

Crash ID:
Uploaded Crash Report ID dcdce7d27ac2b749 (Local Crash ID: 5f673cdd-2e44-417c-943b-3842d545af41)

This is a regression issue broken in ‘M-68’ and will soon inform the bisect info:
Good Build : 68.0.3433.0
Bad Build : 68.0.3434.0

Kindly refer the attached screen-cast from drive link.
https://drive.google.com/open?id=1ISw0mub6BYQGMH4Pnwiqf42LRz1vDXBT

Thank you..!
 
 
Labels: hasbisect
Owner: isandrk@google.com
Status: Assigned (was: Unconfirmed)
Update 

Bisect info:
Change-log:
https://chromium.googlesource.com/chromium/src/+log/3a59c3eb8a2b87cfda23a6642de915c99bd3905f..556f14d5c4480e9384ed9588fc484779e169f4b6 

Suspect:https://chromium.googlesource.com/chromium/src/+/4a55dc2f10c67667256a7c28a82ead57287e0ef3

@Ivan Sandrk:Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.


Note:

1.Unable to provide 'per-revision' bisect as it shows "We don't have enough builds to bisect" error message.
2.Tried on other machines but still getting the same error again.
3.Hence provided suspect through 'Chromium bisect'.
4.Issue is also seen on latest canary #72.0.3581.0.

Thank you..!
Please find the stack trace for the crash id:
---------------------------------------------
Thread 0 (id: 0x25770) CRASHED [EXC_BAD_ACCESS / KERN_INVALID_ADDRESS @ 0x00000198 ] MAGIC SIGNATURE THREAD
Stack Quality84%Show frame trust levels
0x000000010df93ae4	(Google Chrome Framework -memory:2607 )	extensions::Extension::location() const
0x000000010e47c123	(Google Chrome Framework -standard_management_policy_provider.cc:36 )	extensions::(anonymous namespace)::AdminPolicyIsModifiable(extensions::Extension const*, extensions::Extension const*, std::__1::basic_string<unsigned short, base::string16_internals::string16_char_traits, std::__1::allocator<unsigned short> >*)
0x000000010ad057f2	(Google Chrome Framework -management_policy.cc:94 )	extensions::ManagementPolicy::ExtensionMayModifySettings(extensions::Extension const*, extensions::Extension const*, std::__1::basic_string<unsigned short, base::string16_internals::string16_char_traits, std::__1::allocator<unsigned short> >*) const
0x000000010e43b9c2	(Google Chrome Framework -extension_service.cc:766 )	extensions::ExtensionService::DisableExtensionWithSource(extensions::Extension const*, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, extensions::disable_reason::DisableReason)
0x000000010add61b2	(Google Chrome Framework -management_api.cc:477 )	extensions::ManagementSetEnabledFunction::Run()
0x000000010acbea54	(Google Chrome Framework -extension_function.cc:451 )	ExtensionFunction::RunWithValidation()
0x000000010acc08ca	(Google Chrome Framework -extension_function_dispatcher.cc:464 )	extensions::ExtensionFunctionDispatcher::DispatchWithCallbackInternal(ExtensionHostMsg_Request_Params const&, content::RenderFrameHost*, int, base::RepeatingCallback<void (ExtensionFunction::ResponseType, base::ListValue const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, extensions::functions::HistogramValue)> const&)
0x000000010acc0672	(Google Chrome Framework -extension_function_dispatcher.cc )	extensions::ExtensionFunctionDispatcher::Dispatch(ExtensionHostMsg_Request_Params const&, content::RenderFrameHost*, int)
0x000000010ace27e5	(Google Chrome Framework -ipc_message_templates.h:64 )	bool IPC::MessageT<ExtensionHostMsg_Request_Meta, std::__1::tuple<ExtensionHostMsg_Request_Params>, void>::Dispatch<extensions::ExtensionWebContentsObserver, extensions::ExtensionWebContentsObserver, content::RenderFrameHost, void (extensions::ExtensionWebContentsObserver::*)(content::RenderFrameHost*, ExtensionHostMsg_Request_Params const&)>(IPC::Message const*, extensions::ExtensionWebContentsObserver*, extensions::ExtensionWebContentsObserver*, content::RenderFrameHost*, void (extensions::ExtensionWebContentsObserver::*)(content::RenderFrameHost*, ExtensionHostMsg_Request_Params const&))
0x000000010ace2740	(Google Chrome Framework -extension_web_contents_observer.cc:248 )	extensions::ExtensionWebContentsObserver::OnMessageReceived(IPC::Message const&, content::RenderFrameHost*)
0x000000010e40f548	(Google Chrome Framework -chrome_extension_web_contents_observer.cc:105 )	extensions::ChromeExtensionWebContentsObserver::OnMessageReceived(IPC::Message const&, content::RenderFrameHost*)
0x000000010aaf6cc2	(Google Chrome Framework -web_contents_impl.cc:890 )	content::WebContentsImpl::OnMessageReceived(content::RenderFrameHostImpl*, IPC::Message const&)
0x000000010a82601c	(Google Chrome Framework -render_frame_host_impl.cc:1206 )	content::RenderFrameHostImpl::OnMessageReceived(IPC::Message const&)
0x000000010c78e1da	(Google Chrome Framework -ipc_channel_proxy.cc:320 )	IPC::ChannelProxy::Context::OnDispatchMessage(IPC::Message const&)
0x000000010c131759	(Google Chrome Framework -callback.h:99 )	base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*)
0x000000010c14cf7e	(Google Chrome Framework -message_loop.cc:434 )	base::MessageLoop::RunTask(base::PendingTask*)
0x000000010c14d2d2	(Google Chrome Framework -message_loop.cc:445 )	base::MessageLoop::DoWork()
0x000000010c14f549	(Google Chrome Framework -message_pump_mac.mm:455 )	base::MessagePumpCFRunLoopBase::RunWork()
0x000000010c1413b9	(Google Chrome Framework + 0x0272c3b9 )	base::mac::CallWithEHFrame(void () block_pointer)
0x000000010c14eeae	(Google Chrome Framework -message_pump_mac.mm:431 )	base::MessagePumpCFRunLoopBase::RunWorkSource(void*)
0x00007fff3031fa10	(CoreFoundation + 0x000a3a10 )	__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__
0x00007fff303d942b	(CoreFoundation + 0x0015d42b )	__CFRunLoopDoSource0
0x00007fff3030246f	(CoreFoundation + 0x0008646f )	__CFRunLoopDoSources0
0x00007fff303018ec	(CoreFoundation + 0x000858ec )	__CFRunLoopRun
0x00007fff30301152	(CoreFoundation + 0x00085152 )	CFRunLoopRunSpecific
0x00007fff2f5ebd95	(HIToolbox + 0x0002fd95 )	RunCurrentEventLoopInMode
0x00007fff2f5ebb05	(HIToolbox + 0x0002fb05 )	ReceiveNextEventCommon
0x00007fff2f5eb883	(HIToolbox + 0x0002f883 )	_BlockUntilNextEventMatchingListInModeWithFilter
0x00007fff2d89ca72	(AppKit + 0x00041a72 )	_DPSNextEvent
0x00007fff2e032e33	(AppKit + 0x007d7e33 )	-[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:]
0x000000010bd3051f	(Google Chrome Framework -chrome_browser_application_mac.mm:255 )	__71-[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:]_block_invoke
0x000000010c1413b9	(Google Chrome Framework + 0x0272c3b9 )	base::mac::CallWithEHFrame(void () block_pointer)
0x000000010bd30453	(Google Chrome Framework -chrome_browser_application_mac.mm:254 )	-[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:]
0x00007fff2d891884	(AppKit + 0x00036884 )	-[NSApplication run]
0x000000010c14fe0b	(Google Chrome Framework -message_pump_mac.mm:808 )	base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*)
0x000000010c14e98d	(Google Chrome Framework -message_pump_mac.mm:184 )	base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*)
0x000000010c1719a4	(Google Chrome Framework -run_loop.cc:102 )	<name omitted>
0x000000010bd36c3c	(Google Chrome Framework -chrome_browser_main.cc:2023 )	ChromeBrowserMainParts::MainMessageLoopRun(int*)
0x000000010a6b8083	(Google Chrome Framework -browser_main_loop.cc:995 )	content::BrowserMainLoop::RunMainMessageLoopParts()
0x000000010a6ba6b1	(Google Chrome Framework -browser_main_runner_impl.cc:165 )	content::BrowserMainRunnerImpl::Run()
0x000000010a6b4e0a	(Google Chrome Framework -browser_main.cc:47 )	content::BrowserMain(content::MainFunctionParams const&)
0x000000010bcec11a	(Google Chrome Framework -content_main_runner_impl.cc:541 )	content::ContentMainRunnerImpl::Run(bool)
0x000000010d9fd8dc	(Google Chrome Framework -main.cc:472 )	service_manager::Main(service_manager::MainParams const&)
0x000000010bceb303	(Google Chrome Framework -content_main.cc:19 )	content::ContentMain(content::ContentMainParams const&)
0x0000000109a17eae	(Google Chrome Framework -chrome_main.cc:102 )	ChromeMain
0x00000001030b0dcd	(Google Chrome -chrome_exe_main_mac.cc:101 )	main
0x00007fff58144014	(libdyld.dylib + 0x00001014 )	start
0x00007fff58144014	(libdyld.dylib + 0x00001014 )	start
Owner: isandrk@chromium.org
gentle ping to check if we have any update?
Hi, I haven't taken a look at this yet, but will soon (next couple of days).
 Issue 903485  has been merged into this issue.
Labels: Hotlist-DesktopUIChecked Hotlist-DesktopUIValid
***Mass UI Triage***

Just to update: 
Still we are able to reproduce the issue on latest canary #72.0.3610.0 on Mac(10.13.1, 10.13.4, 10.14.2) and Windows(7,8,8.1,10) OS. 

@isandrk: Could you please take a look into this issue.

Thank you.
Labels: -Pri-1 Pri-2
NextAction: 2019-01-09
Adjusting the priority and setting up a reminder for myself to take a look when I'm back.
The NextAction date has arrived: 2019-01-09
It seems there's a work-around for this (clicking on the RELOAD button on the main extensions page).

dpapad, tentatively assigning to you to find the right owner (since you wrote a lot of code here [1]).

The problem is that when the extension is terminated, the main extensions page UI correctly replaces the ON/OFF button with a RELOAD button, but the same is not done for the detailed extensions page (page you get when you click on Details).


[1] https://chromium.googlesource.com/chromium/src/+blame/HEAD/chrome/browser/resources/md_extensions/detail_view.html
Cc: isandrk@chromium.org
Owner: dpa...@chromium.org
Cc: rdevlin....@chromium.org kelvinjiang@chromium.org dpa...@chromium.org
Components: UI>Browser>ExtensionsManagement
Owner: ----
Status: Available (was: Assigned)
Cc: -kelvinjiang@chromium.org
Labels: -Pri-2 Pri-1
Owner: kelvinjiang@chromium.org
Status: Assigned (was: Available)
If this is still a reproducible crash by clicking on a UI element, that seems bad.  Raising priority appropriately.

Kelvin, do you think you'd be able to take a look at this and see if it still reproduces?
Tested using the Dark Reader extension, definitely crashes, will take a look.

Sign in to add a comment