New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 911878 link

Starred by 0 users

Issue metadata

Status: Fixed
Owner:
Closed: Dec 28
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 1
Type: Bug



Sign in to add a comment

Crash when canceling BLE connection request

Project Member Reported by khorimoto@chromium.org, Dec 5

Issue description

Just reproduced this:
(1) Start Instant Tethering scan.
(2) Lock screen during scan.

Expected: Locks normally
Actual: Crash

This is a race, so you have to lock the screen *just* at the right time for this to occur.

#0  0x00005a5c6577457a in logging::LogMessage::~LogMessage() () at ../../base/logging.cc:874
#1  0x00005a5c6a036ca9 in cryptauth::weave::BluetoothLowEnergyWeaveClientConnection::ClearQueueAndSendConnectionClose() () at ../../components/cryptauth/ble/bluetooth_low_energy_weave_client_connection.cc:819
#2  0x00005a5c6a036a17 in cryptauth::weave::BluetoothLowEnergyWeaveClientConnection::~BluetoothLowEnergyWeaveClientConnection() () at ../../components/cryptauth/ble/bluetooth_low_energy_weave_client_connection.cc:180
#3  0x00005a5c6a0371be in cryptauth::weave::BluetoothLowEnergyWeaveClientConnection::~BluetoothLowEnergyWeaveClientConnection() () at ../../components/cryptauth/ble/bluetooth_low_energy_weave_client_connection.cc:169                                                                                                                                  
#4  0x00005a5c6a02ce1e in cryptauth::SecureChannel::~SecureChannel() () at ../../components/cryptauth/secure_channel.cc:73
#5  0x00005a5c688cb015 in chromeos::secure_channel::BleConnectionManagerImpl::ProcessPotentialLingeringChannel(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) () at ../../build/cros_cache/chromesdk/tarballs/eve+11244.0.0+target_toolchain/usr/bin/../include/c++/v1/memory:2321
#6  0x00005a5c688cb171 in chromeos::secure_channel::BleConnectionManagerImpl::PerformCancelBleListenerConnectionAttempt(chromeos::secure_channel::DeviceIdPair const&) () at ../../chromeos/services/secure_channel/ble_connection_manager_impl.cc:307
#7  0x00005a5c688e11cc in chromeos::secure_channel::BleConnectionManager::CancelBleListenerConnectionAttempt(chromeos::secure_channel::DeviceIdPair const&) () at ../../chromeos/services/secure_channel/ble_connection_manager.cc:170
#8  0x00005a5c688e3b84 in chromeos::secure_channel::ConnectToDeviceOperation<chromeos::secure_channel::BleInitiatorFailureType>::Cancel() () at ../../chromeos/services/secure_channel/connect_to_device_operation.h:66
#9  0x00005a5c688e5bc5 in chromeos::secure_channel::ConnectionAttemptBase<chromeos::secure_channel::BleListenerFailureType>::~ConnectionAttemptBase() () at ../../chromeos/services/secure_channel/connection_attempt_base.h:61
#10 0x00005a5c688e58ee in chromeos::secure_channel::BleListenerConnectionAttempt::~BleListenerConnectionAttempt() () at ../../chromeos/services/secure_channel/ble_listener_connection_attempt.cc:55                                                                                                                                                       
#11 0x00005a5c688dacde in std::__1::vector<std::__1::pair<chromeos::secure_channel::DeviceIdPair, std::__1::unique_ptr<chromeos::secure_channel::ConnectionAttempt<chromeos::secure_channel::BleInitiatorFailureType>,std::__1::default_delete<chromeos::secure_channel::ConnectionAttempt<chromeos::secure_channel::BleInitiatorFailureType> > > >, std:$
__1::allocator<std::__1::pair<chromeos::secure_channel::DeviceIdPair, std::__1::unique_ptr<chromeos::secure_channel::ConnectionAttempt<chromeos::secure_channel::BleInitiatorFailureType>, std::__1::default_delete<chromeos::secure_channel::ConnectionAttempt<chromeos::secure_channel::BleInitiatorFailureType> > > > > >::erase(std::__1::__wrap_iter<$
td::__1::pair<chromeos::secure_channel::DeviceIdPair, std::__1::unique_ptr<chromeos::secure_channel::ConnectionAttempt<chromeos::secure_channel::BleInitiatorFailureType>, std::__1::default_delete<chromeos::secure_channel::ConnectionAttempt<chromeos::secure_channel::BleInitiatorFailureType> > > > const*>, std::__1::__wrap_iter<std::__1::pair<chr$
meos::secure_channel::DeviceIdPair, std::__1::unique_ptr<chromeos::secure_channel::ConnectionAttempt<chromeos::secure_channel::BleInitiatorFailureType>, std::__1::default_delete<chromeos::secure_channel::ConnectionAttempt<chromeos::secure_channel::BleInitiatorFailureType> > > > const*>) ()
#12 0x00005a5c688d8e27 in chromeos::secure_channel::PendingConnectionManagerImpl::RemoveMapEntriesForFinishedConnectionAttempt(chromeos::secure_channel::ConnectionAttemptDetails const&) () at ../../base/containers/flat_tree.h:824
#13 0x00005a5c688e3ec1 in chromeos::secure_channel::ConnectionAttempt<chromeos::secure_channel::BleInitiatorFailureType>::OnConnectionAttemptFinishedWithoutConnection() () at ../../chromeos/services/secure_channel/connection_attempt.h:125
#14 0x00005a5c688e37e7 in chromeos::secure_channel::ConnectionAttemptBase<chromeos::secure_channel::BleInitiatorFailureType>::OnRequestFinishedWithoutConnection(base::UnguessableToken const&, chromeos::secure_channel::PendingConnectionRequestDelegate::FailedConnectionReason) ()
    at ../../chromeos/services/secure_channel/connection_attempt_base.h:148
#15 0x00005a5c688e953e in chromeos::secure_channel::PendingConnectionRequestBase<chromeos::secure_channel::BleInitiatorFailureType>::OnFinishedWithoutConnection(chromeos::secure_channel::PendingConnectionRequestDelegate::FailedConnectionReason) () at ../../chromeos/services/secure_channel/pending_connection_request.h:64
#16 0x00005a5c688d51d2 in chromeos::secure_channel::ClientConnectionParameters::NotifyConnectionRequestCanceled() () at ../../chromeos/services/secure_channel/client_connection_parameters.cc:63
#17 0x00005a5c658a1f5d in mojo::InterfaceEndpointClient::NotifyError(base::Optional<mojo::DisconnectReason> const&) () at ../../base/callback.h:99
#18 0x00005a5c658a8773 in mojo::internal::MultiplexRouter::ProcessNotifyErrorTask(mojo::internal::MultiplexRouter::Task*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) () at ../../mojo/public/cpp/bindings/lib/multiplex_router.cc:789
#19 0x00005a5c658a59f3 in mojo::internal::MultiplexRouter::ProcessTasks(mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) () at ../../mojo/public/cpp/bindings/lib/multiplex_router.cc:702
#20 0x0000562bb159d40e in void base::internal::Invoker<base::internal::BindState<void (content::FrameInputHandlerImpl::*)(int, int, std::__1::vector<ui::ImeTextSpan, std::__1::allocator<ui::ImeTextSpan> > const&), base::WeakPtr<content::FrameInputHandlerImpl>, int, int, std::__1::vector<ui::ImeTextSpan, std::__1::allocator<ui::ImeTextSpan> > >,
void ()>::RunImpl<void (content::FrameInputHandlerImpl::*)(int, int, std::__1::vector<ui::ImeTextSpan, std::__1::allocator<ui::ImeTextSpan> > const&), std::__1::tuple<base::WeakPtr<content::FrameInputHandlerImpl>, int, int, std::__1::vector<ui::ImeTextSpan, std::__1::allocator<ui::ImeTextSpan> > >, 0ul, 1ul, 2ul, 3ul>(void (content::FrameInputHandlerImpl::*&&)(int, int, std::__1::vector<ui::ImeTextSpan, std::__1::allocator<ui::ImeTextSpan> > const&), std::__1::tuple<base::WeakPtr<content::FrameInputHandlerImpl>, int, int, std::__1::vector<ui::ImeTextSpan, std::__1::allocator<ui::ImeTextSpan> > >&&, std::__1::integer_sequence<unsigned long, 0ul, 1ul, 2ul, 3ul>) ()
    at ../../base/bind_internal.h:516
#21 0x0000562bb4728867 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) () at ../../base/callback.h:99
#22 0x0000562bb4666ec0 in base::MessageLoopImpl::RunTask(base::PendingTask*) () at ../../base/message_loop/message_loop_impl.cc:374
#23 0x0000562bb4667572 in base::MessageLoopImpl::DoWork() () at ../../base/message_loop/message_loop_impl.cc:385
#24 0x0000562bb4724939 in base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) () at ../../base/message_loop/message_pump_libevent.cc:210
#25 0x0000562bb4666995 in base::MessageLoopImpl::Run(bool) () at ../../base/message_loop/message_loop_impl.cc:326
#26 0x0000562bb4690196 in base::RunLoop::Run() () at ../../base/run_loop.cc:102
#27 0x0000562bb41a58c5 in ChromeBrowserMainParts::MainMessageLoopRun(int*) () at ../../chrome/browser/chrome_browser_main.cc:1865
#28 0x0000562bb18c36b4 in content::BrowserMainLoop::RunMainMessageLoopParts() () at ../../content/browser/browser_main_loop.cc:999
#29 0x0000562bb18c60c3 in content::BrowserMainRunnerImpl::Run() () at ../../content/browser/browser_main_runner_impl.cc:165
#30 0x0000562bb18bfe1f in content::BrowserMain(content::MainFunctionParams const&) () at ../../content/browser/browser_main.cc:47
#31 0x0000562bb41961f0 in content::ContentMainRunnerImpl::RunServiceManager(content::MainFunctionParams&, bool) () at ../../content/app/content_main_runner_impl.cc:543
#32 0x0000562bb4196096 in content::ContentMainRunnerImpl::Run(bool) () at ../../content/app/content_main_runner_impl.cc:866
#33 0x0000562bb419d945 in service_manager::Main(service_manager::MainParams const&) () at ../../services/service_manager/embedder/main.cc:472
#34 0x0000562bb4194431 in content::ContentMain(content::ContentMainParams const&) () at ../../content/app/content_main.cc:19
#35 0x0000562bb067d69f in ChromeMain () at ../../chrome/app/chrome_main.cc:102
#36 0x00007928a7f45a94 in __libc_start_main (main=0x562bb067d600 <main>, argc=31, argv=0x7ffe13a28398, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffe13a28388) at ../csu/libc-start.c:308
#37 0x0000562bb067d4c9 in _start ()

 
Status: Started (was: Assigned)
Status: Fixed (was: Started)
This was actually fixed by https://chromium-review.googlesource.com/c/chromium/src/+/1381724.

Sign in to add a comment