[Desktop] Browser crashes while opening OTR window - Follow up to #9825

[kjozwiak]

Description

Brave is still crashing pretty often when opening OTR windows once enabling Speedreader via --enable-features=Speedreader as per #9825 (comment).

Crashes:

• Uploaded Crash Report ID: 3e6f0000-1c55-8704-0000-000000000000
• Uploaded Crash Report ID: 3f6f0000-1c55-8704-0000-000000000000
• Uploaded Crash Report ID: 4a6f0000-1c55-8704-0000-000000000000

[ 00 ] extensions::BraveTorClientUpdater::SetExecutablePath(base::FilePath const&)
[ 01 ] void base::internal::ReplyAdapter<base::FilePath, base::FilePath const&>(base::OnceCallback<void (base::FilePath const&)>, std::__1::unique_ptr<base::FilePath, std::__1::default_delete<base::FilePath> >*)
[ 02 ] base::internal::Invoker<base::internal::BindState<void (*)(base::OnceCallback<void (base::FilePath const&)>, std::__1::unique_ptr<base::FilePath, std::__1::default_delete<base::FilePath> >*), base::OnceCallback<void (base::FilePath const&)>, base::internal::OwnedWrapper<std::__1::unique_ptr<base::FilePath, std::__1::default_delete<base::FilePath> >, std::__1::default_delete<std::__1::unique_ptr<base::FilePath, std::__1::default_delete<base::FilePath> > > > >, void ()>::RunOnce(base::internal::BindStateBase*)
[ 03 ] base::(anonymous namespace)::PostTaskAndReplyRelay::RunReply(base::(anonymous namespace)::PostTaskAndReplyRelay)
[ 04 ] base::internal::Invoker<base::internal::BindState<void (*)(base::(anonymous namespace)::PostTaskAndReplyRelay), base::(anonymous namespace)::PostTaskAndReplyRelay>, void ()>::RunOnce(base::internal::BindStateBase*)
[ 05 ] base::TaskAnnotator::RunTask(char const*, base::PendingTask*)
[ 06 ] base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::sequence_manager::LazyNow*, bool*)
[ 07 ] base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork()
[ 08 ] invocation function for block in base::MessagePumpCFRunLoopBase::RunWorkSource(void*)
[ 09 ] base::mac::CallWithEHFrame(void () block_pointer)
[ 10 ] base::MessagePumpCFRunLoopBase::RunWorkSource(void*)
[ 11 ] 0x7fff38a92de2
[ 12 ] 0x7fff38a92d81
[ 13 ] 0x7fff38a92b9b
[ 14 ] 0x7fff38a918ca
[ 15 ] 0x7fff38a90ece
[ 16 ] RunCurrentEventLoopInMode
[ 17 ] ReceiveNextEventCommon
[ 18 ] _BlockUntilNextEventMatchingListInModeWithFilter
[ 19 ] _DPSNextEvent
[ 20 ] -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:]
[ 21 ] __71-[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:]_block_invoke
[ 22 ] base::mac::CallWithEHFrame(void () block_pointer)
[ 23 ] -[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:]
[ 24 ] -[NSApplication run]
[ 25 ] base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*)
[ 26 ] base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*)
[ 27 ] base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta)
[ 28 ] base::RunLoop::Run()
[ 29 ] ChromeBrowserMainParts::MainMessageLoopRun(int*)
[ 30 ] content::BrowserMainLoop::RunMainMessageLoopParts()
[ 31 ] content::BrowserMainRunnerImpl::Run()
[ 32 ] content::BrowserMain(content::MainFunctionParams const&)
[ 33 ] content::ContentMainRunnerImpl::RunServiceManager(content::MainFunctionParams&, bool)
[ 34 ] content::ContentMainRunnerImpl::Run(bool)
[ 35 ] service_manager::Main(service_manager::MainParams const&)
[ 36 ] content::ContentMain(content::ContentMainParams const&)
[ 37 ] ChromeMain
[ 38 ] main
[ 39 ] start

Steps to Reproduce

1. launch brave using --enable-features=Speedreader
2. once launched, open/close either a Tor or PB window several times

Eventually you'll run into the above crash. Sometimes it takes a few minutes to reproduce. Just keep opening/closing Tor or PB windows.

Actual result:

Crashes the browser as demonstrated above via the stack crash.

Expected result:

Brave should never be crashing.

Reproduces how often:

It's pretty easy to reproduce. Sometimes it takes a few minutes but I managed to reproduce the issue every single time I attempted.

Brave version (brave://version info)

Brave | 1.11.64 Chromium: 83.0.4103.97 (Official Build) dev (64-bit)
-- | --
Revision | 326d148b9655369b86498d9ecca39f63dd2bdd2d-refs/branch-heads/4103@{#657}
OS | macOS Version 10.15.5 (Build 19F101)

Version/Channel Information:

• Can you reproduce this issue with the current release? N/A
• Can you reproduce this issue with the beta channel? Yes
• Can you reproduce this issue with the dev channel? Yes
• Can you reproduce this issue with the nightly channel? Yes

Other Additional Information:

• Does the issue resolve itself when disabling Brave Shields? N/A
• Does the issue resolve itself when disabling Brave Rewards? N/A
• Is the issue reproducible on the latest version of Chrome? N/A

Miscellaneous Information:

CCing @rebron @bsclifton @iefremov

[iefremov]

Reproduced locally without --enable-features=Speedreader, so speedreader is not involved.
STR: (1) clean profile (2) repeteadly hit Option-Cmd-N to open Tor window and then Cmd-W to close it

[4389:775:0618/145803.664659:FATAL:observer_list_internal.h(73)] Check failed: !weak_ptr_.WasInvalidated(). 
0   libbase.dylib                       0x0000000113bede79 base::debug::CollectStackTrace(void**, unsigned long) + 9
1   libbase.dylib                       0x0000000113aa2343 base::debug::StackTrace::StackTrace() + 19
2   libbase.dylib                       0x0000000113ac6139 logging::LogMessage::~LogMessage() + 249
3   libchrome_dll.dylib                 0x000000010a5d1ebf base::ObserverList<extensions::BraveTorClientUpdater::Observer, false, true, base::internal::CheckedObserverAdapter>::Iter::EnsureValidIndex() + 575
4   libchrome_dll.dylib                 0x000000010a5d0d72 extensions::BraveTorClientUpdater::SetExecutablePath(base::FilePath const&) + 562
5   libchrome_dll.dylib                 0x000000010a5d283f base::internal::Invoker<base::internal::BindState<void (extensions::BraveTorClientUpdater::*)(base::FilePath const&), base::WeakPtr<extensions::BraveTorClientUpdater> >, void (base::FilePath const&)>::RunOnce(base::internal::BindStateBase*, base::FilePath const&) + 191
6   libchrome_dll.dylib                 0x000000010a5d2a9e void base::internal::ReplyAdapter<base::FilePath, base::FilePath const&>(base::OnceCallback<void (base::FilePath const&)>, std::__Cr::unique_ptr<base::FilePath, std::__Cr::default_delete<base::FilePath> >*) + 190

[iefremov]

Fixed the description since Speedreader is not involved (cc @kjozwiak )

[GeetaSarvadnya]

Verification passed on

Brave | 1.12.104 Chromium: 84.0.4147.89 (Official Build) dev (64-bit)
-- | --
Revision | 19abfe7bcba9318a0b2a6bc6634a67fc834aa592-refs/branch-heads/4147@{#852}
OS | Windows 10 OS Version 1903 (Build 18362.959)

• Verified the description from the issue and ensured that there is no crash when opening/closing Tor or PB windows.

---

Verification passed on

Brave	1.12.104 Chromium: 84.0.4147.89 (Official Build) dev (64-bit)
Revision	19abfe7bcba9318a0b2a6bc6634a67fc834aa592-refs/branch-heads/4147@{#852}
OS	Ubuntu 18.04 LTS

• Verified the description from the issue and ensured that there is no crash when opening/closing Tor or PB windows.

---

Verified passed with

Brave | 1.12.108 Chromium: 84.0.4147.105 (Official Build) (64-bit)
-- | --
Revision | a6b12dfad6663f13a7e16e9a42a6a4975374096b-refs/branch-heads/4147@{#943}
OS | macOS Version 10.14.6 (Build 18G3020)

• Verified the description from the issue and ensured that there is no crash when opening/closing Tor or PB windows.