Browser becomes inactive with get property error

[srirambv]

Description

Browser becomes unresponsive with get property error

Test plan / Steps to Reproduce

1. Visit goatdee.net
2. Click on any link that is listed on the page, opens up in the same tab
3. Wait till the ad countdown finishes
4. Click on the close advertisment button a new tab opens. You may be able to close it
5. Click on Install Flash link, another tab opens in background and browser becomes unresponsive
6. Context menu doesn't work, cant open a new tab, cant close any tabs, only way is to restart the browser

Actual result:
Browser becomes inactive. Unable to open new tab or switch tab. Browser console shows this error

Expected result:
Browser should be active

Reproduces how often:
100%

Brave Version

about:brave info:

Brave	0.22.721
V8	6.6.346.32
rev	bfe7cdd
Muon	6.0.12
OS Release	10.0.17134
Update Channel	Release
OS Architecture	x64
OS Platform	Microsoft Windows
Node.js	7.9.0
Brave Sync	v1.4.2
libchromiumcontent	66.0.3359.170

Reproducible on current live release:
Yes

Additional Information

cc: @btlechowski @kjozwiak @LaurenWags to keep an eye on this on mac/Linux
Edit: found steps and updated the issue
cc: @bsclifton

[btlechowski]

Reproduced on Ubuntu 17.10 v0.22.721

The browser becomes unresponsive after step 4.

[kjozwiak]

Reproducible under macOS 10.13.4 as well using the STR @srirambv mentioned above.

• 0.22.721 bfe7cdd - Reproducible using the above STR
• 0.22.714 fa2fbca - Reproducible using the above STR
• 0.22.669 6cda2e8 - Couldn't reproduce the issue using the above STR

Seems like it regressed somewhere between 0.22.669 & 0.22.714. @bsclifton even though it's not a recent regression, can we investigate and see if we could add this into the next release? Maybe the C67 release? It's a pretty bad issue where it renders the entire browser unusable.

[bsclifton]

@kjozwiak SGTM 👍

[bsclifton]

This is a pretty crazy issue- great find/STR, @srirambv!

Here's what I'm seeing after doing some investigating:

• ad countdown happens
• click the X to hide the ad banner; new tab opens
• sometimes I need to go back to the original tab and click where the countdown was
• problem happens: over 90 tabs are created! this includes web contents, etc. I suspect these are popups
• during the web contents add, the code exits out:
  

  browser-laptop/app/browser/tabs.js

  Lines 464 to 467 in 9b102d8

  	if (userGesture === false) {
  	e.preventDefault()
  	return
  	}

• web contents still exists but there is no frame associated with this
• frameStateUtil.findNonPinnedDisplayIndexForTabId gets fired somehow for this web contents / tab (which doesn't have a frame) and causes the reported console error pictured. Specifically, the object is undefined (and not an Immutable object containing frame data) so there is no get method

[bridiver]

@srirambv - "Click on any link which opens in a new tab" - please be very specific in the instructions. I don't know which links open in a new tab so now I'm just trying to click through a bunch of them.

[srirambv]

@bridiver updated the steps. All links listed on the page does the same hence mentioned as Click on any link

[bridiver]

I pushed a fix for this to C67, but I recommend that anyone trying to repro this use a vm snapshot. This site is loaded with malware.

[bridiver]

@srirambv I was confused because none of the links opened in a new tab, but in general I think it's best to specify a specific link so there is no ambiguity.

[bsclifton]

Fixed with brave/muon@117fe11 (needs verification when new Muon build available)

[srirambv]

Verified on Windows x64 using

• 0.22.806 0d30970
• muon 7.0.3
• libchromiumcontent 67.0.3396.62

Verified on Ubuntu 17.10 x64

• 0.22.806 0d30970
• Muon 7.0.3
• libchromiumcontent 67.0.3396.62

Verified on macOS x64 using the following build:

• 0.22.807 2d4f6e8
• muon: 7.0.4
• libchromiumcontent: 67.0.3396.71