Browser crash when loading site

[srirambv]

Description

Browser crash when loading site

Steps to Reproduce

1. Clean install 0.21.651
2. Visit timesofindia.com in a new tab
3. Browser crash without any logs on console

Actual result:

Expected result:
Should not crash

Reproduces how often:
100%

Brave Version

about:brave info:

Brave	0.21.651
V8	6.5.254.26
rev	32c9686
Muon	5.1.2
OS Release	10.0.16299
Update Channel	Beta
OS Architecture	x64
OS Platform	Microsoft Windows
Node.js	7.9.0
Brave Sync	v1.4.2
libchromiumcontent	65.0.3325.88

Reproducible on current live release:
No

Additional Information

cc: @bridiver @bsclifton

[btlechowski]

Still reproducible in v0.21.654

[srirambv]

Not seeing crash on 0.21.654. Keeping the issue open for investigation.

[srirambv]

Seeing random crash when browsing sites but no console log like before.

[srirambv]

Changing shield setting is also causing crash but not on all sites

[hferreiro]

I can reproduce this on Linux by navigating to http://timesofindia.com. This is the backtrace:

Thread 24 "Chrome_IOThread" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffd5577700 (LWP 28244)]
std::__1::__tree_next_iter<std::__1::__tree_end_node<std::__1::__tree_node_base<void*>*>*, std::__1::__tree_node_base<void*>*> (__x=<optimized out>)
    at ../../buildtools/third_party/libc++/trunk/include/__tree:186
186	        return static_cast<_EndNodePtr>(__tree_min(__x->__right_));
(gdb) bt
#0  std::__1::__tree_next_iter<std::__1::__tree_end_node<std::__1::__tree_node_base<void*>*>*, std::__1::__tree_node_base<void*>*> (__x=<optimized out>)
    at ../../buildtools/third_party/libc++/trunk/include/__tree:186
#1  std::__1::__tree_iterator<std::__1::__value_type<net::URLRequest*, std::__1::unique_ptr<extensions::WebRequestInfo, std::__1::default_delete<extensions::WebRequestInfo> > >, std::__1::__tree_node<std::__1::__value_type<net::URLRequest*, std::__1::unique_ptr<extensions::WebRequestInfo, std::__1::default_delete<extensions::WebRequestInfo> > >, void*>*, long>::operator++ (
    this=<optimized out>) at ../../buildtools/third_party/libc++/trunk/include/__tree:840
#2  std::__1::__tree<std::__1::__value_type<net::URLRequest*, std::__1::unique_ptr<extensions::WebRequestInfo, std::__1::default_delete<extensions::WebRequestInfo> > >, std::__1::__map_value_compare<net::URLRequest*, std::__1::__value_type<net::URLRequest*, std::__1::unique_ptr<extensions::WebRequestInfo, std::__1::default_delete<extensions::WebRequestInfo> > >, std::__1::less<net::URLRequest*>, true>, std::__1::allocator<std::__1::__value_type<net::URLRequest*, std::__1::unique_ptr<extensions::WebRequestInfo, std::__1::default_delete<extensions::WebRequestInfo> > > > >::erase (this=0x304d46d2e498, __p=...) at ../../buildtools/third_party/libc++/trunk/include/__tree:2361
#3  0x00000000030d6fa7 in extensions::AtomExtensionsNetworkDelegate::OnURLRequestDestroyed (this=0x304d467124b0, request=0x304d473c0c00)
    at ../../electron/atom/browser/extensions/atom_extensions_network_delegate.cc:218
#4  0x00000000030bf06d in atom::AtomNetworkDelegate::OnCompleted (this=0x304d467124b0, request=0x304d473c0c00, started=false, net_error=-3)
    at ../../electron/atom/browser/net/atom_network_delegate.cc:398
#5  0x00000000030d6f08 in extensions::AtomExtensionsNetworkDelegate::OnCompleted (this=0x304d467124b0, request=0x304d473c0c00, started=false, net_error=-3)
    at ../../electron/atom/browser/extensions/atom_extensions_network_delegate.cc:207
#6  0x0000000003c1e83a in net::NetworkDelegate::NotifyCompleted (this=0x304d467124b0, request=0x304d473c0c00, started=false, net_error=-3) at ../../net/base/network_delegate.cc:118
#7  0x0000000003df4ea3 in net::URLRequest::NotifyRequestCompleted (this=<optimized out>) at ../../net/url_request/url_request.cc:1141
#8  net::URLRequest::DoCancel (this=0x304d473c0c00, error=<optimized out>, ssl_info=...) at ../../net/url_request/url_request.cc:730
#9  0x0000000003df3360 in net::URLRequest::CancelWithError (this=0x304d46d2e498, error=1188226208) at ../../net/url_request/url_request.cc:690
#10 0x0000000002bbf6e1 in content::ResourceLoader::CancelRequestInternal (this=0x304d471eb2c0, error=-3, from_renderer=<optimized out>)
    at ./../../content/browser/loader/resource_loader.cc:632
#11 0x0000000002bbe46f in content::ResourceLoader::CancelRequest (this=0x304d471eb2c0, from_renderer=true) at ./../../content/browser/loader/resource_loader.cc:261
#12 0x0000000003b6f14c in base::OnceCallback<void ()>::Run() && (this=<optimized out>) at ../../base/callback.h:65
#13 mojo::InterfaceEndpointClient::NotifyError (this=<optimized out>, reason=...) at ../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:326
#14 0x0000000003b76ea2 in mojo::internal::MultiplexRouter::ProcessNotifyErrorTask (this=0x304d490ed600, task=<optimized out>, client_call_behavior=<optimized out>, 
    current_task_runner=<optimized out>) at ../../mojo/public/cpp/bindings/lib/multiplex_router.cc:800
#15 0x0000000003b7537f in mojo::internal::MultiplexRouter::ProcessTasks (this=0x304d490ed600, client_call_behavior=mojo::internal::MultiplexRouter::ALLOW_DIRECT_CLIENT_CALLS, 
    current_task_runner=0x304d4645e910) at ../../mojo/public/cpp/bindings/lib/multiplex_router.cc:713
#16 0x0000000003b7419f in mojo::internal::MultiplexRouter::OnPipeConnectionError (this=0x304d490ed600) at ../../mojo/public/cpp/bindings/lib/multiplex_router.cc:682
#17 0x0000000003b6d524 in base::OnceCallback<void ()>::Run() && (this=<optimized out>) at ../../base/callback.h:65
#18 mojo::Connector::HandleError (this=<optimized out>, force_pipe_reset=<optimized out>, force_async_handler=<optimized out>) at ../../mojo/public/cpp/bindings/lib/connector.cc:539
#19 0x0000000003b8104a in base::RepeatingCallback<void (unsigned int, mojo::HandleSignalsState const&)>::Run(unsigned int, mojo::HandleSignalsState const&) const & (args=..., args=..., 
    this=<optimized out>) at ../../base/callback.h:94
#20 mojo::SimpleWatcher::OnHandleReady (this=0x304d47726960, watch_id=<optimized out>, result=9, state=...) at ../../mojo/public/cpp/system/simple_watcher.cc:276
#21 0x0000000003b81293 in mojo::SimpleWatcher::Context::Notify (this=0x304d49100cc0, result=12365, signals_state=..., flags=1) at ../../mojo/public/cpp/system/simple_watcher.cc:107
#22 0x0000000003b808c1 in mojo::SimpleWatcher::Context::CallNotify (context_value=53108496403648, result=9, signals_state=..., flags=1192734056)
    at ../../mojo/public/cpp/system/simple_watcher.cc:57
#23 0x00000000048c0b7c in mojo::edk::Watch::InvokeCallback (this=0x304d47ff7150, result=9, state=..., flags=1) at ../../mojo/edk/system/watch.cc:78
#24 0x00000000048bd74d in mojo::edk::RequestContext::~RequestContext (this=0x7fffd5576180) at ../../mojo/edk/system/request_context.cc:66
#25 0x00000000048bc6fc in mojo::edk::NodeChannel::OnChannelMessage (this=<optimized out>, payload=<optimized out>, payload_size=<optimized out>, handles=...)
    at ../../mojo/edk/system/node_channel.cc:764
#26 0x00000000048bb12a in mojo::edk::Channel::OnReadComplete (this=0x304d475fa0e0, bytes_read=<optimized out>, next_read_size_hint=0x7fffd5576508) at ../../mojo/edk/system/channel.cc:725
#27 0x00000000048c568f in mojo::edk::(anonymous namespace)::ChannelPosix::OnFileCanReadWithoutBlocking (this=<optimized out>, fd=<optimized out>)
    at ../../mojo/edk/system/channel_posix.cc:312
#28 0x000000000334df39 in base::MessagePumpLibevent::FileDescriptorWatcher::OnFileCanReadWithoutBlocking (this=<optimized out>, fd=<optimized out>, pump=<optimized out>)
    at ./../../base/message_loop/message_pump_libevent.cc:97
#29 base::MessagePumpLibevent::OnLibeventNotification (fd=171, flags=2, context=0x304d470a4980) at ./../../base/message_loop/message_pump_libevent.cc:342
#30 0x000000000361c2fd in event_process_active (base=<optimized out>) at ../../base/third_party/libevent/event.c:381
#31 event_base_loop (base=0x304d46419700, flags=1) at ../../base/third_party/libevent/event.c:521
#32 0x000000000334e234 in base::MessagePumpLibevent::Run (this=0x304d464523c0, delegate=0x304d46136640) at ./../../base/message_loop/message_pump_libevent.cc:257
#33 0x000000000336c725 in base::RunLoop::Run (this=0x7fffd5576af0) at ./../../base/run_loop.cc:130
#34 0x00000000029c4b28 in content::BrowserThreadImpl::IOThreadRun (this=0x304d46d2e498, run_loop=0x304d46d2e4a0) at ./../../content/browser/browser_thread_impl.cc:248
#35 0x00000000029c4d41 in content::BrowserThreadImpl::Run (this=0x304d4618e480, run_loop=0x7fffd5576af0) at ./../../content/browser/browser_thread_impl.cc:283
#36 0x00000000033a4664 in base::Thread::ThreadMain (this=0x304d4618e480) at ./../../base/threading/thread.cc:338
#37 0x00000000033a8a1f in base::(anonymous namespace)::ThreadFunc (params=<optimized out>) at ./../../base/threading/platform_thread_posix.cc:75
#38 0x00007ffff7bbd61b in start_thread () from /lib64/libpthread.so.0
#39 0x00007ffff1cf4c2f in clone () from /lib64/libc.so.6

[hferreiro]

@bridiver this commit seems very relevant: brave/muon@fb67093

Commenting https://github.com/brave/muon/blob/master/atom/browser/net/atom_network_delegate.cc#L398 the site loads, though the error must be elsewhere.

[ltilve]

We think that AtomNetworkdelegate::OnURLRequestDestroyed() shouldn't be called in AtomNetworkdelegate::OnCompleted(). It causes calling AtomExtensionsNetworkDelegate::OnURLRequestDestroyed().
Before brave/muon@fb67093, OnCompleted() just cleanup internal data structure not by calling OnURLRequestDestroyed(). OnURLRequestDestroyed() only should be called by NetworkDelegate::NotifyURLRequestDestroyed().

[ltilve]

Created PR for the crash brave/muon#523

[bsclifton]

Fixed with brave/muon#523