New issue
Advanced search Search tips

Issue 898554 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Nov 13
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 3
Type: Bug



Sign in to add a comment

Omnibox autocomplete crash due to invalid GURL

Project Member Reported by tbansal@chromium.org, Oct 24

Issue description

These crashes are happening when typing in the omnibox in the debug build on Linux.

I am not sure what's the best way to repro this, but I printed |spec_| in gurl.cc to see which string is causing the crash. See the stack trace below.

Stack trace:

[103611:103611:1024/102115.646997:FATAL:gurl.cc(166)] Check failed: false. Trying to get the spec of an invalid URL! spec_=http:/
#0 0x7fa2c5356ccd base::debug::StackTrace::StackTrace()
#1 0x7fa2c5053a2a base::debug::StackTrace::StackTrace()
#2 0x7fa2c50c559b logging::LogMessage::~LogMessage()
#3 0x7fa2c4e790b5 GURL::spec()
#4 0x558b6d1e5a59 MatchGURLHash::operator()()
#5 0x558b6d1dda96 std::__1::unordered_map<>::operator[]()
#6 0x558b6d1d5ced AutocompleteResult::SortAndDedupMatches()
#7 0x558b6d1d2408 AutocompleteResult::SortAndCull()
#8 0x558b6d5fea89 AutocompleteController::UpdateResult()
#9 0x558b6d5fdb7a AutocompleteController::Start()
#10 0x558b6d77291c OmniboxController::StartAutocomplete()
#11 0x558b6d76818f OmniboxEditModel::StartAutocomplete()
#12 0x558b6d76759b OmniboxEditModel::UpdateInput()
#13 0x558b6dbf13d3 OmniboxViewViews::UpdatePopup()
#14 0x558b6d770858 OmniboxEditModel::OnAfterPossibleChange()
#15 0x558b6dbf3021 OmniboxViewViews::OnAfterPossibleChange()
#16 0x558b6dbf75bd OmniboxViewViews::OnAfterUserAction()
#17 0x7fa2b12e6895 views::Textfield::OnAfterUserAction()
#18 0x7fa2b12eec4a views::Textfield::DoInsertChar()
#19 0x558b6dbf6341 OmniboxViewViews::DoInsertChar()
#20 0x7fa2b12ecf49 views::Textfield::InsertChar()
#21 0x7fa2b980414f ui::InputMethodAuraLinux::ProcessKeyEventDone()
#22 0x7fa2b980355b ui::InputMethodAuraLinux::DispatchKeyEvent()
#23 0x7fa2b6cd81d3 aura::WindowEventDispatcher::PreDispatchKeyEvent()
#24 0x7fa2b6cd738a aura::WindowEventDispatcher::PreDispatchEvent()
#25 0x7fa2b9842941 ui::EventDispatcherDelegate::DispatchEvent()
#26 0x7fa2b98486d9 ui::EventProcessor::OnEventFromSource()

 
So, you had typed "http:/" when it crashed?
I think I had typed part of the URL, and then backspace to delete some parts of it. It's a bit hard to repro :(
One thing I know for sure is that it crashes while the user is typing (i.e., before I typed enter or selected anything from the autocomplete options that show up).
Cc: jdonnelly@chromium.org
Owner: manukh@chromium.org
manukh: Please take a look and see if you can figure out under what circumstances where this might happen. If you have any questions about how these code paths work, I can walk you through it offline.
Status: Assigned (was: Untriaged)
Status: Started (was: Assigned)
seems these steps reliably reproduce the issue:

1. navigate to `google.com`
2. focus the omnibox, it should now say `https://www.google.com`
3. delete the ending `google.com` so that the remaining text is `https://www.`

regarding step 3:

- deleting by backspacing 1-char-at-a-time causes the issue.

- selecting the last 10 characters and pressing backspace/delete once also reproduces the issue.

- selecting the last 11 characters `.google.com` and deleting does not cause the issue.


typing in `https://www.` and then deleting the inline autocompletion (press delete once) also reproduces the crash
Project Member

Comment 7 by bugdroid1@chromium.org, Oct 30

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/61d1146d76ddba79ed29fa8ad368494f930cca2d

commit 61d1146d76ddba79ed29fa8ad368494f930cca2d
Author: manuk <manukh@chromium.org>
Date: Tue Oct 30 21:11:14 2018

[Omnibox] Use GURL::possibly_invalid_spec instead of GURL::spec when sorting and deduping matches.

Certain omnibox inputs, such as `http:www.` produce matches with invalid urls. Invoking GURL::spec on these invalid GURL's caused a DCHECK to evaluate false and crash the browser. The crash only affects debug builds as the DCHECK is inactive for non-debug builds.

Bug:  898554 
Change-Id: I89a27f902b77bf6b221c321ab396787e9249a4e6
Reviewed-on: https://chromium-review.googlesource.com/c/1308260
Commit-Queue: manuk hovanesian <manukh@chromium.org>
Reviewed-by: Tommy Li <tommycli@chromium.org>
Cr-Commit-Position: refs/heads/master@{#604012}
[modify] https://crrev.com/61d1146d76ddba79ed29fa8ad368494f930cca2d/components/omnibox/browser/autocomplete_result.cc

Can you look closer at what part of the system is generating URLs with invalid specs?  This probably shouldn't be happening (not even for the what-you-typed URL suggestion), and it's probably indication of an underlying bug.
I agree.  I think the CL should be reverted.  Left a more detailed comment on the review.
Worth noting, as far as I can tell, this (not checking url validity) was the past behavior (before Aug 24), so it's possible whatever is causing invalid urls has existed a long time.

I will look into it.
Project Member

Comment 11 by bugdroid1@chromium.org, Nov 1

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b5b111f70b97a3a60c14d1c45845a1f12a9da0ad

commit b5b111f70b97a3a60c14d1c45845a1f12a9da0ad
Author: manuk hovanesian <manukh@chromium.org>
Date: Thu Nov 01 16:21:48 2018

Revert "[Omnibox] Use GURL::possibly_invalid_spec instead of GURL::spec when sorting and deduping matches."

This reverts commit 61d1146d76ddba79ed29fa8ad368494f930cca2d.

Reason for revert: per review comments, there may be a larger underlying reason as to why we we're generating invalid GURL's that should be addressed.

Original change's description:
> [Omnibox] Use GURL::possibly_invalid_spec instead of GURL::spec when sorting and deduping matches.
> 
> Certain omnibox inputs, such as `http:www.` produce matches with invalid urls. Invoking GURL::spec on these invalid GURL's caused a DCHECK to evaluate false and crash the browser. The crash only affects debug builds as the DCHECK is inactive for non-debug builds.
> 
> Bug:  898554 
> Change-Id: I89a27f902b77bf6b221c321ab396787e9249a4e6
> Reviewed-on: https://chromium-review.googlesource.com/c/1308260
> Commit-Queue: manuk hovanesian <manukh@chromium.org>
> Reviewed-by: Tommy Li <tommycli@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#604012}

TBR=krb@chromium.org,tommycli@chromium.org,manukh@chromium.org

Change-Id: I3e2dddb8dd218bce805dc93d842f83b7366cf1bb
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug:  898554 
Reviewed-on: https://chromium-review.googlesource.com/c/1308603
Reviewed-by: Tommy Li <tommycli@chromium.org>
Commit-Queue: manuk hovanesian <manukh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#604610}
[modify] https://crrev.com/b5b111f70b97a3a60c14d1c45845a1f12a9da0ad/components/omnibox/browser/autocomplete_result.cc

Triggering the omnibox input `https://www.` after a deletion (e.g. typing in `https://www.x` then pressing backspace) so that inline autocomplete is prevented results in a url-what-you-typed match from the HistoryURL provider with the valid url `https://www./`. For de-duping purposes, we attempt to remove the host `www.` and get the url `https:/`, which is invalid.

Maybe someone more familiar knows if, or what part of, the above behavior is expected or should be changed?

Removing the "www." for deduping is invalid when that leaves no host components.
Project Member

Comment 14 by bugdroid1@chromium.org, Nov 13

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7c10eab1d69f3cdbc406917f0de0209ba36b0d63

commit 7c10eab1d69f3cdbc406917f0de0209ba36b0d63
Author: manuk <manukh@chromium.org>
Date: Tue Nov 13 19:50:07 2018

[Omnibox] Avoid removing the `www.` prefix during deduping when doing so would leave no host component.

When sorting and deduping matches, match GURLs are stripped (`AutocompleteMatch::GURLToStrippedGURL`). Certain omnibox inputs, such as `http://www.` without inline autocomplete, produce matches with host compoments `www.`. Stripping `www.` in these cases would result in an empty url host component and, therefore, invalid `GURL`. Invoking `GURL::spec` on such invalid URLs would then cause a DCHECK to evaluate false and crash the browser. The crash only affects debug builds as the DCHECK is inactive for non-debug builds.

Bug:  898554 
Change-Id: I73461c65ba53891d6f3b52bc767c754b02c1ce3e
Reviewed-on: https://chromium-review.googlesource.com/c/1331631
Commit-Queue: manuk hovanesian <manukh@chromium.org>
Reviewed-by: Tommy Li <tommycli@chromium.org>
Cr-Commit-Position: refs/heads/master@{#607709}
[modify] https://crrev.com/7c10eab1d69f3cdbc406917f0de0209ba36b0d63/components/omnibox/browser/autocomplete_match.cc
[modify] https://crrev.com/7c10eab1d69f3cdbc406917f0de0209ba36b0d63/components/omnibox/browser/autocomplete_match_unittest.cc

Status: Fixed (was: Started)

Sign in to add a comment