Omnibox autocomplete crash due to invalid GURL |
|||||
Issue descriptionThese crashes are happening when typing in the omnibox in the debug build on Linux. I am not sure what's the best way to repro this, but I printed |spec_| in gurl.cc to see which string is causing the crash. See the stack trace below. Stack trace: [103611:103611:1024/102115.646997:FATAL:gurl.cc(166)] Check failed: false. Trying to get the spec of an invalid URL! spec_=http:/ #0 0x7fa2c5356ccd base::debug::StackTrace::StackTrace() #1 0x7fa2c5053a2a base::debug::StackTrace::StackTrace() #2 0x7fa2c50c559b logging::LogMessage::~LogMessage() #3 0x7fa2c4e790b5 GURL::spec() #4 0x558b6d1e5a59 MatchGURLHash::operator()() #5 0x558b6d1dda96 std::__1::unordered_map<>::operator[]() #6 0x558b6d1d5ced AutocompleteResult::SortAndDedupMatches() #7 0x558b6d1d2408 AutocompleteResult::SortAndCull() #8 0x558b6d5fea89 AutocompleteController::UpdateResult() #9 0x558b6d5fdb7a AutocompleteController::Start() #10 0x558b6d77291c OmniboxController::StartAutocomplete() #11 0x558b6d76818f OmniboxEditModel::StartAutocomplete() #12 0x558b6d76759b OmniboxEditModel::UpdateInput() #13 0x558b6dbf13d3 OmniboxViewViews::UpdatePopup() #14 0x558b6d770858 OmniboxEditModel::OnAfterPossibleChange() #15 0x558b6dbf3021 OmniboxViewViews::OnAfterPossibleChange() #16 0x558b6dbf75bd OmniboxViewViews::OnAfterUserAction() #17 0x7fa2b12e6895 views::Textfield::OnAfterUserAction() #18 0x7fa2b12eec4a views::Textfield::DoInsertChar() #19 0x558b6dbf6341 OmniboxViewViews::DoInsertChar() #20 0x7fa2b12ecf49 views::Textfield::InsertChar() #21 0x7fa2b980414f ui::InputMethodAuraLinux::ProcessKeyEventDone() #22 0x7fa2b980355b ui::InputMethodAuraLinux::DispatchKeyEvent() #23 0x7fa2b6cd81d3 aura::WindowEventDispatcher::PreDispatchKeyEvent() #24 0x7fa2b6cd738a aura::WindowEventDispatcher::PreDispatchEvent() #25 0x7fa2b9842941 ui::EventDispatcherDelegate::DispatchEvent() #26 0x7fa2b98486d9 ui::EventProcessor::OnEventFromSource()
,
Oct 24
I think I had typed part of the URL, and then backspace to delete some parts of it. It's a bit hard to repro :( One thing I know for sure is that it crashes while the user is typing (i.e., before I typed enter or selected anything from the autocomplete options that show up).
,
Oct 29
manukh: Please take a look and see if you can figure out under what circumstances where this might happen. If you have any questions about how these code paths work, I can walk you through it offline.
,
Oct 29
,
Oct 30
seems these steps reliably reproduce the issue: 1. navigate to `google.com` 2. focus the omnibox, it should now say `https://www.google.com` 3. delete the ending `google.com` so that the remaining text is `https://www.` regarding step 3: - deleting by backspacing 1-char-at-a-time causes the issue. - selecting the last 10 characters and pressing backspace/delete once also reproduces the issue. - selecting the last 11 characters `.google.com` and deleting does not cause the issue.
,
Oct 30
typing in `https://www.` and then deleting the inline autocompletion (press delete once) also reproduces the crash
,
Oct 30
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/61d1146d76ddba79ed29fa8ad368494f930cca2d commit 61d1146d76ddba79ed29fa8ad368494f930cca2d Author: manuk <manukh@chromium.org> Date: Tue Oct 30 21:11:14 2018 [Omnibox] Use GURL::possibly_invalid_spec instead of GURL::spec when sorting and deduping matches. Certain omnibox inputs, such as `http:www.` produce matches with invalid urls. Invoking GURL::spec on these invalid GURL's caused a DCHECK to evaluate false and crash the browser. The crash only affects debug builds as the DCHECK is inactive for non-debug builds. Bug: 898554 Change-Id: I89a27f902b77bf6b221c321ab396787e9249a4e6 Reviewed-on: https://chromium-review.googlesource.com/c/1308260 Commit-Queue: manuk hovanesian <manukh@chromium.org> Reviewed-by: Tommy Li <tommycli@chromium.org> Cr-Commit-Position: refs/heads/master@{#604012} [modify] https://crrev.com/61d1146d76ddba79ed29fa8ad368494f930cca2d/components/omnibox/browser/autocomplete_result.cc
,
Oct 30
Can you look closer at what part of the system is generating URLs with invalid specs? This probably shouldn't be happening (not even for the what-you-typed URL suggestion), and it's probably indication of an underlying bug.
,
Oct 30
I agree. I think the CL should be reverted. Left a more detailed comment on the review.
,
Oct 30
Worth noting, as far as I can tell, this (not checking url validity) was the past behavior (before Aug 24), so it's possible whatever is causing invalid urls has existed a long time. I will look into it.
,
Nov 1
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/b5b111f70b97a3a60c14d1c45845a1f12a9da0ad commit b5b111f70b97a3a60c14d1c45845a1f12a9da0ad Author: manuk hovanesian <manukh@chromium.org> Date: Thu Nov 01 16:21:48 2018 Revert "[Omnibox] Use GURL::possibly_invalid_spec instead of GURL::spec when sorting and deduping matches." This reverts commit 61d1146d76ddba79ed29fa8ad368494f930cca2d. Reason for revert: per review comments, there may be a larger underlying reason as to why we we're generating invalid GURL's that should be addressed. Original change's description: > [Omnibox] Use GURL::possibly_invalid_spec instead of GURL::spec when sorting and deduping matches. > > Certain omnibox inputs, such as `http:www.` produce matches with invalid urls. Invoking GURL::spec on these invalid GURL's caused a DCHECK to evaluate false and crash the browser. The crash only affects debug builds as the DCHECK is inactive for non-debug builds. > > Bug: 898554 > Change-Id: I89a27f902b77bf6b221c321ab396787e9249a4e6 > Reviewed-on: https://chromium-review.googlesource.com/c/1308260 > Commit-Queue: manuk hovanesian <manukh@chromium.org> > Reviewed-by: Tommy Li <tommycli@chromium.org> > Cr-Commit-Position: refs/heads/master@{#604012} TBR=krb@chromium.org,tommycli@chromium.org,manukh@chromium.org Change-Id: I3e2dddb8dd218bce805dc93d842f83b7366cf1bb No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: 898554 Reviewed-on: https://chromium-review.googlesource.com/c/1308603 Reviewed-by: Tommy Li <tommycli@chromium.org> Commit-Queue: manuk hovanesian <manukh@chromium.org> Cr-Commit-Position: refs/heads/master@{#604610} [modify] https://crrev.com/b5b111f70b97a3a60c14d1c45845a1f12a9da0ad/components/omnibox/browser/autocomplete_result.cc
,
Nov 12
Triggering the omnibox input `https://www.` after a deletion (e.g. typing in `https://www.x` then pressing backspace) so that inline autocomplete is prevented results in a url-what-you-typed match from the HistoryURL provider with the valid url `https://www./`. For de-duping purposes, we attempt to remove the host `www.` and get the url `https:/`, which is invalid. Maybe someone more familiar knows if, or what part of, the above behavior is expected or should be changed?
,
Nov 12
Removing the "www." for deduping is invalid when that leaves no host components.
,
Nov 13
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/7c10eab1d69f3cdbc406917f0de0209ba36b0d63 commit 7c10eab1d69f3cdbc406917f0de0209ba36b0d63 Author: manuk <manukh@chromium.org> Date: Tue Nov 13 19:50:07 2018 [Omnibox] Avoid removing the `www.` prefix during deduping when doing so would leave no host component. When sorting and deduping matches, match GURLs are stripped (`AutocompleteMatch::GURLToStrippedGURL`). Certain omnibox inputs, such as `http://www.` without inline autocomplete, produce matches with host compoments `www.`. Stripping `www.` in these cases would result in an empty url host component and, therefore, invalid `GURL`. Invoking `GURL::spec` on such invalid URLs would then cause a DCHECK to evaluate false and crash the browser. The crash only affects debug builds as the DCHECK is inactive for non-debug builds. Bug: 898554 Change-Id: I73461c65ba53891d6f3b52bc767c754b02c1ce3e Reviewed-on: https://chromium-review.googlesource.com/c/1331631 Commit-Queue: manuk hovanesian <manukh@chromium.org> Reviewed-by: Tommy Li <tommycli@chromium.org> Cr-Commit-Position: refs/heads/master@{#607709} [modify] https://crrev.com/7c10eab1d69f3cdbc406917f0de0209ba36b0d63/components/omnibox/browser/autocomplete_match.cc [modify] https://crrev.com/7c10eab1d69f3cdbc406917f0de0209ba36b0d63/components/omnibox/browser/autocomplete_match_unittest.cc
,
Nov 13
|
|||||
►
Sign in to add a comment |
|||||
Comment 1 by pkasting@chromium.org
, Oct 24