Browser crashes when ad notification clicked on

[maikelmclauflin]

Description

brave crashes after clicking on notification for ad

Steps to Reproduce

1. wait for ad to show
2. click on notification
3. repeat until crash

still investigating about what may cause crash. could be

1. multiple profiles open / cross opening ad
2. certain tabs open

Actual result:

brave crashes

Expected result:

brave should open tab

Reproduces how often:

Brave version (brave://version info)

Version 0.60.13 Chromium: 72.0.3626.53 (Official Build) dev (64-bit)

Website problems only:

• Does the issue resolve itself when disabling Brave Shields?
• Is the issue reproducible on the latest version of Chrome?

Additional Information

[bridiver]

Can you make sure the crash report is submitted in chrome://crashes and post the remote crash id?

[kjozwiak]

@maikelmclauflin once you submit the crash report, you should see something similar to the following:

Once you receive a Uploaded Crash Report ID after submitting, @bridiver can take a look 👍

[kevinlawler]

Neither Michael nor I can repro on latest. It's possible this was fixed by some large passes which fixed other bugs. Closing for now, we can re-open if this reappears or we get a better handle on what's causing it.

[bridiver]

@kevinlawler I think it was also a result of the dom distiller issues and was likely fixed by this https://github.com/brave/brave-core/pull/1361/files

[srirambv]

Marking issue to 0.61.x since brave/brave-core#1361 is assigned to 0.61.x. @bridiver does the fix require QA verification?

[cndouglas]

Just ran into this crash. I clicked "View" on a Brave Rewards ad, and the entire browser crashed. I had one private window with one tab open at the time it crashed.

Brave | 0.61.2 Chromium: 72.0.3626.71 (Official Build) dev(64-bit)
Revision | f52ccad2a6a3c65fc9e0c591a517ceab1198dac0-refs/branch-heads/3626@{#763}
OS | Mac OS X

From brave://crashes:
Uploaded Crash Report ID 6d4f2c9b58bdd1a6 (Local Crash ID: f1445443-5e45-40d1-8d37-2497c510857e)
Crash report captured on Tuesday, January 29, 2019 at 9:06:48 PM, uploaded on Tuesday, January 29, 2019 at 9:06:49 PM

Crash log:
Crash.txt

[cndouglas]

It just crashed again when I had one private window with one tab open. It did not crash when I had one normal window with one tab open.

So, STR:

1. Turn on Brave Rewards ads. Change "Maximum number of ads displayed" to "5 per hour" to shorten the amount of time you have to wait.
2. Open a private window
3. Close any other normal windows.
4. Wait for an ad to appear.
5. Click the View button on the notification.

[maikelmclauflin]

that's interesting. mine is happening with no private tabs.

[tmancey]

@bridiver @maikelmclauflin @liunkae I can recreate in a regular tabm here is the de-symbolicated crash log:

0   libbase.dylib                       0x00000001127dccf3 base::debug::StackTrace::StackTrace(unsigned long) + 83
1   libbase.dylib                       0x00000001127dcdad base::debug::StackTrace::StackTrace(unsigned long) + 29
2   libbase.dylib                       0x00000001124ca0fa base::debug::StackTrace::StackTrace() + 26
3   libbase.dylib                       0x00000001127dcb41 base::debug::(anonymous namespace)::StackDumpSignalHandler(int, __siginfo*, void*) + 1393
4   libsystem_platform.dylib            0x00007fff66a06b3d _sigtramp + 29
5   ???                                 0xd4c394895c440008 0x0 + 15331260874178691080
6   libchrome_dll.dylib                 0x00000001167418b2 unsigned long std::__1::__hash_table<std::__1::__hash_value_type<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, std::__1::__unordered_map_hasher<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::__hash_value_type<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, std::__1::hash<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, true>, std::__1::__unordered_map_equal<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::__hash_value_type<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, std::__1::equal_to<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, true>, std::__1::allocator<std::__1::__hash_value_type<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > >::__count_unique<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) const + 50
7   libchrome_dll.dylib                 0x000000011673df6d std::__1::unordered_map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::hash<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, std::__1::equal_to<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > >::count(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) const + 29
8   libchrome_dll.dylib                 0x000000011673f052 brave_shields::HTTPSEverywhereService::GetHTTPSURLFromCacheOnly(GURL const*, unsigned long long const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >&) + 242
9   libchrome_dll.dylib                 0x00000001167eb09e brave::OnBeforeURLRequest_HttpsePreFileWork(base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>) + 798
10  libchrome_dll.dylib                 0x00000001167f75e2 int base::internal::FunctorTraits<int (*)(base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>), void>::Invoke<int (* const&)(base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>), base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo> >(int (* const&&&)(base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>), base::RepeatingCallback<void ()> const&&&, std::__1::shared_ptr<brave::BraveRequestInfo>&&) + 98
11  libchrome_dll.dylib                 0x00000001167f7567 int base::internal::InvokeHelper<false, int>::MakeItSo<int (* const&)(base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>), base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo> >(int (* const&&&)(base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>), base::RepeatingCallback<void ()> const&&&, std::__1::shared_ptr<brave::BraveRequestInfo>&&) + 71
12  libchrome_dll.dylib                 0x00000001167f750b int base::internal::Invoker<base::internal::BindState<int (*)(base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>)>, int (base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>)>::RunImpl<int (* const&)(base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>), std::__1::tuple<> const&>(int (* const&&&)(base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>), std::__1::tuple<> const&&&, std::__1::integer_sequence<unsigned long>, base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>&&) + 75
13  libchrome_dll.dylib                 0x00000001167f742e base::internal::Invoker<base::internal::BindState<int (*)(base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>)>, int (base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>)>::Run(base::internal::BindStateBase*, base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>&&) + 94
14  libchrome_dll.dylib                 0x00000001167ee637 base::RepeatingCallback<int (base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>)>::Run(base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>) const & + 103
15  libchrome_dll.dylib                 0x00000001167ec96b BraveNetworkDelegateBase::RunNextCallback(net::URLRequest*, std::__1::shared_ptr<brave::BraveRequestInfo>) + 715
16  libchrome_dll.dylib                 0x00000001167f33eb void base::internal::FunctorTraits<void (BraveNetworkDelegateBase::*)(net::URLRequest*, std::__1::shared_ptr<brave::BraveRequestInfo>), void>::Invoke<void (BraveNetworkDelegateBase::*)(net::URLRequest*, std::__1::shared_ptr<brave::BraveRequestInfo>), BraveNetworkDelegateBase*, net::URLRequest* const&, std::__1::shared_ptr<brave::BraveRequestInfo> const&>(void (BraveNetworkDelegateBase::*)(net::URLRequest*, std::__1::shared_ptr<brave::BraveRequestInfo>), BraveNetworkDelegateBase*&&, net::URLRequest* const&&&, std::__1::shared_ptr<brave::BraveRequestInfo> const&&&) + 203
17  libchrome_dll.dylib                 0x00000001167f325b void base::internal::InvokeHelper<false, void>::MakeItSo<void (BraveNetworkDelegateBase::* const&)(net::URLRequest*, std::__1::shared_ptr<brave::BraveRequestInfo>), BraveNetworkDelegateBase*, net::URLRequest* const&, std::__1::shared_ptr<brave::BraveRequestInfo> const&>(void (BraveNetworkDelegateBase::* const&&&)(net::URLRequest*, std::__1::shared_ptr<brave::BraveRequestInfo>), BraveNetworkDelegateBase*&&, net::URLRequest* const&&&, std::__1::shared_ptr<brave::BraveRequestInfo> const&&&) + 123
18  libchrome_dll.dylib                 0x00000001167f31b2 void base::internal::Invoker<base::internal::BindState<void (BraveNetworkDelegateBase::*)(net::URLRequest*, std::__1::shared_ptr<brave::BraveRequestInfo>), base::internal::UnretainedWrapper<BraveNetworkDelegateBase>, net::URLRequest*, std::__1::shared_ptr<brave::BraveRequestInfo> >, void ()>::RunImpl<void (BraveNetworkDelegateBase::* const&)(net::URLRequest*, std::__1::shared_ptr<brave::BraveRequestInfo>), std::__1::tuple<base::internal::UnretainedWrapper<BraveNetworkDelegateBase>, net::URLRequest*, std::__1::shared_ptr<brave::BraveRequestInfo> > const&, 0ul, 1ul, 2ul>(void (BraveNetworkDelegateBase::* const&&&)(net::URLRequest*, std::__1::shared_ptr<brave::BraveRequestInfo>), std::__1::tuple<base::internal::UnretainedWrapper<BraveNetworkDelegateBase>, net::URLRequest*, std::__1::shared_ptr<brave::BraveRequestInfo> > const&&&, std::__1::integer_sequence<unsigned long, 0ul, 1ul, 2ul>) + 146
19  libchrome_dll.dylib                 0x00000001167f306c base::internal::Invoker<base::internal::BindState<void (BraveNetworkDelegateBase::*)(net::URLRequest*, std::__1::shared_ptr<brave::BraveRequestInfo>), base::internal::UnretainedWrapper<BraveNetworkDelegateBase>, net::URLRequest*, std::__1::shared_ptr<brave::BraveRequestInfo> >, void ()>::Run(base::internal::BindStateBase*) + 44
20  libchrome_dll.dylib                 0x000000011495c1fd base::RepeatingCallback<void ()>::Run() const & + 61
21  libchrome_dll.dylib                 0x00000001167e8b53 brave::OnBeforeURLRequestDispatchOnIOThread(base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>) + 659
22  libchrome_dll.dylib                 0x00000001167e9b92 void base::internal::FunctorTraits<void (*)(base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>), void>::Invoke<void (* const&)(base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>), base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo> const&>(void (* const&&&)(base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>), base::RepeatingCallback<void ()> const&&&, std::__1::shared_ptr<brave::BraveRequestInfo> const&&&) + 98
23  libchrome_dll.dylib                 0x00000001167e9b27 void base::internal::FunctorTraits<base::internal::IgnoreResultHelper<void (*)(base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>)>, void>::Invoke<base::internal::IgnoreResultHelper<void (*)(base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>)> const&, base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo> const&>(base::internal::IgnoreResultHelper<void (*)(base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>)> const&&&, base::RepeatingCallback<void ()> const&&&, std::__1::shared_ptr<brave::BraveRequestInfo> const&&&) + 71
24  libchrome_dll.dylib                 0x00000001167e9a77 void base::internal::InvokeHelper<false, void>::MakeItSo<base::internal::IgnoreResultHelper<void (*)(base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>)> const&, base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo> const&>(base::internal::IgnoreResultHelper<void (*)(base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>)> const&&&, base::RepeatingCallback<void ()> const&&&, std::__1::shared_ptr<brave::BraveRequestInfo> const&&&) + 71
25  libchrome_dll.dylib                 0x00000001167e9a23 void base::internal::Invoker<base::internal::BindState<base::internal::IgnoreResultHelper<void (*)(base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>)>, base::RepeatingCallback<void ()>, std::__1::shared_ptr<brave::BraveRequestInfo> >, void ()>::RunImpl<base::internal::IgnoreResultHelper<void (*)(base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>)> const&, std::__1::tuple<base::RepeatingCallback<void ()>, std::__1::shared_ptr<brave::BraveRequestInfo> > const&, 0ul, 1ul>(base::internal::IgnoreResultHelper<void (*)(base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>)> const&&&, std::__1::tuple<base::RepeatingCallback<void ()>, std::__1::shared_ptr<brave::BraveRequestInfo> > const&&&, std::__1::integer_sequence<unsigned long, 0ul, 1ul>) + 99
26  libchrome_dll.dylib                 0x00000001167e992c base::internal::Invoker<base::internal::BindState<base::internal::IgnoreResultHelper<void (*)(base::RepeatingCallback<void ()> const&, std::__1::shared_ptr<brave::BraveRequestInfo>)>, base::RepeatingCallback<void ()>, std::__1::shared_ptr<brave::BraveRequestInfo> >, void ()>::Run(base::internal::BindStateBase*) + 44
27  libbase.dylib                       0x000000011248bffc base::OnceCallback<void ()>::Run() && + 92
28  libbase.dylib                       0x000000011271de12 base::(anonymous namespace)::PostTaskAndReplyRelay::RunReply(base::(anonymous namespace)::PostTaskAndReplyRelay) + 354
29  libbase.dylib                       0x000000011271e9dd void base::internal::FunctorTraits<void (*)(base::(anonymous namespace)::PostTaskAndReplyRelay), void>::Invoke<void (*)(base::(anonymous namespace)::PostTaskAndReplyRelay), base::(anonymous namespace)::PostTaskAndReplyRelay>(void (*&&)(base::(anonymous namespace)::PostTaskAndReplyRelay), base::(anonymous namespace)::PostTaskAndReplyRelay&&) + 77
30  libbase.dylib                       0x000000011271e922 void base::internal::InvokeHelper<false, void>::MakeItSo<void (*)(base::(anonymous namespace)::PostTaskAndReplyRelay), base::(anonymous namespace)::PostTaskAndReplyRelay>(void (*&&)(base::(anonymous namespace)::PostTaskAndReplyRelay), base::(anonymous namespace)::PostTaskAndReplyRelay&&) + 50
31  libbase.dylib                       0x000000011271e8c2 void base::internal::Invoker<base::internal::BindState<void (*)(base::(anonymous namespace)::PostTaskAndReplyRelay), base::(anonymous namespace)::PostTaskAndReplyRelay>, void ()>::RunImpl<void (*)(base::(anonymous namespace)::PostTaskAndReplyRelay), std::__1::tuple<base::(anonymous namespace)::PostTaskAndReplyRelay>, 0ul>(void (*&&)(base::(anonymous namespace)::PostTaskAndReplyRelay), std::__1::tuple<base::(anonymous namespace)::PostTaskAndReplyRelay>&&, std::__1::integer_sequence<unsigned long, 0ul>) + 66
32  libbase.dylib                       0x000000011271e7ee base::internal::Invoker<base::internal::BindState<void (*)(base::(anonymous namespace)::PostTaskAndReplyRelay), base::(anonymous namespace)::PostTaskAndReplyRelay>, void ()>::RunOnce(base::internal::BindStateBase*) + 62
33  libbase.dylib                       0x000000011248bffc base::OnceCallback<void ()>::Run() && + 92
34  libbase.dylib                       0x00000001124cb719 base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) + 729
35  libbase.dylib                       0x00000001125555cc base::MessageLoopImpl::RunTask(base::PendingTask*) + 796
36  libbase.dylib                       0x00000001125559b9 base::MessageLoopImpl::DeferOrRunPendingTask(base::PendingTask) + 89
37  libbase.dylib                       0x0000000112556467 base::MessageLoopImpl::DoWork() + 455
38  libbase.dylib                       0x00000001128287d6 base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) + 134
39  libbase.dylib                       0x0000000112554e30 base::MessageLoopImpl::Run(bool) + 512
40  libbase.dylib                       0x00000001126037fd base::RunLoop::Run() + 525
41  libbase.dylib                       0x000000011272c2c9 base::Thread::Run(base::RunLoop*) + 393
42  libcontent.dylib                    0x0000000143550975 content::BrowserProcessSubThread::IOThreadRun(base::RunLoop*) + 53
43  libcontent.dylib                    0x000000014355084b content::BrowserProcessSubThread::Run(base::RunLoop*) + 331
44  libbase.dylib                       0x000000011272ca43 base::Thread::ThreadMain() + 1107
45  libbase.dylib                       0x0000000112803220 base::(anonymous namespace)::ThreadFunc(void*) + 192
46  libsystem_pthread.dylib             0x00007fff66a0f305 _pthread_body + 126
47  libsystem_pthread.dylib             0x00007fff66a1226f _pthread_start + 70
48  libsystem_pthread.dylib             0x00007fff66a0e415 thread_start + 13
[end of stack trace]
Segmentation fault: 11```

[tmancey]

Which appears to be related to Brave Shields 8 libchrome_dll.dylib 0x000000011673f052 brave_shields::HTTPSEverywhereService::GetHTTPSURLFromCacheOnly(GURL const*, unsigned long long const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >&) + 242 9

[bridiver]

@maikelmclauflin stack dump without symbols isn't useful. Please go to chrome://crashes and post the crash id

[bridiver]

brave/brave-core#1546 fixes an issue with httpse that is likely the cause of the stack trace that @tmancey posted. There was definitely a problem in httpse, but not sure if it is the full fix for this or not

[maikelmclauflin]

hey @bridiver here are the links: https://stats.brave.com/dashboard#crash/5c4b3d0d7eec89001f81e3a0 https://stats.brave.com/dashboard#crash/5c4b2e42d80b31001f402e2f https://stats.brave.com/dashboard#crash/5c477e94e70c50001f3c0bb9 https://stats.brave.com/dashboard#crash/5c4763cbe70c50001f3b277a https://stats.brave.com/dashboard#crash/5c3fd51a5d2553001f118da6 https://stats.brave.com/dashboard#crash/5c3f4e8535ed13001fd23713

[srirambv]

@bridiver @tmancey could you please add a test plan if this requires QA verification?

[kjozwiak]

@bridiver @tmancey should we use the STR/Test Case from #3208 to verify this as they seem related? Is there any particular cases QA should go through?

[btlechowski]

Verification passed on

Brave	0.60.29 Chromium: 72.0.3626.96 (Official Build) beta (64-bit)
Revision	84098ee7ef8622a9defc2ef043cd8930b617b10e-refs/branch-heads/3626@{#836}
OS	Windows 7

I have been clicking on ads notifications through the weekend. No crashes.