Regression:Tab crash is seen when clicked on 'Reload' button of FireShot extension page.
Reported by
shruti.j...@etouch.net,
Nov 12
|
|||
Issue descriptionChrome Version: 72.0.3608.0 Revision 13a876533812d5e196bca2b1c60634dc14a79700-refs/branch-heads/3608@{#1}(64 bit) OS: Windows(7,8,8.1,10) Linux(14.04 LTS) and Mac(10.13.1 , 10.13.6 , 10.14.1) Test URL:https://chrome.google.com/webstore/detail/take-webpage-screenshots/mcbpblocgmgfnpjjppndjkmgjaogfceg/related?utm_source=chrome-ntp-icon Steps to reproduce: 1. Launch chrome and navigate to above URL. 2. Add extension and 'Capture entire page' for screenshot. 3. Bookmark the screenshot page and Remove the extension. 4. Drag the link , click on 'Reload' button and observe. Actual Result : Tab crash is seen when clicked on 'Reload' button of page. Expected Result : Tab should not get crashed when clicked on 'Reload' button of page. Crash ID: Uploaded Crash Report ID 99e78e08a1266d25 (Local Crash ID: 30388e9a-75d8-4bd8-8403-bb2186ded82a) This is a regression issue broken in M-70 and below is the bisect information: Good Build :70.0.3511.0 Bad Build :70.0.3512.0 You are probably looking for a change made after 580669 (known good), but no later than 580670 (first known bad). CHANGELOG URL: The script might not always return single CL as suspect as some perf builds might get missing due to failure. https://chromium.googlesource.com/chromium/src/+log/20fccf32b6f9a1b5afd410407bebf72f4eca2b3e..978c16b82667c84cf6c64c5c917606381267c74d Suspecting:https://chromium.googlesource.com/chromium/src/+/978c16b82667c84cf6c64c5c917606381267c74d @Nasko Oskov :Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner. Kindly refer the attached screencast from drive link: https://drive.google.com/open?id=1uSOH-_FvSWp1-mSArDSYvvBDq_Lgul-d Thank You!
,
Nov 15
I was able to reproduce this crash locally on Canary channel, however I don't think it should be a P1 bug.
,
Nov 16
I've done some debugging to understand what happens. The issue is that once the extension is uninstalled, navigating to its URL is resulting in an error page. Clicking the "Reload" button results in an OpeURL IPC from the renderer process, which fails ShouldAllowOpenURL check and leads to the URL to be rewritten to about:blank. Since we don't allow about:blank to commit in an error page process, we terminate the process due to unexpected commit. Couple of things that need further investigation - the about:blank case should have been handled, since I've fixed similar case in the past. It might be due to OpenURL or due to the network error being ERR_BLOCKED_BY_CLIENT, as this is considered blocked navigation instead of failed one. The other is why should_fork was true, causing the renderer to go the OpenURL route instead of the regular BeginNavigation route.
,
Nov 16
For the should_fork side of things, issue 883549 is relevant here. In particular, there's a test I've listed in my experiment to remove ShouldFork, ExtensionBrowserTest.WindowOpenInvalidExtension, which might also be about this kind of scenario, though I haven't looked closely.
,
Nov 16
|
|||
►
Sign in to add a comment |
|||
Comment 1 by rbasuvula@google.com
, Nov 12