search

brave / brave-browser

Brave browser for Android, iOS, Linux, macOS, Windows.
https://brave.com
Mozilla Public License 2.0
17.53k stars 2.27k forks source link

When using vertical tabs, pinning a tab that is part of a group crashes the browser - follow up to #40201 #40365

Open LaurenWags opened 1 month ago

LaurenWags commented 1 month ago

Description

Found while testing #40201 for uplift

Crash when attempting to pin a tab in a tab group still happens sometimes. When a tab group has 1-2 tabs, I couldn't reproduce the crash with 1.70.57, but it easily reproduced with 1.70.56. However, once my tab group had more tabs (3-4), then the below STR relatively reliably reproduced a crash for me. Not 100%, but the crash was fairly consistent.

Steps to reproduce

  1. Clean profile, close and relaunch to pull griffin
  2. Enable vertical tabs
  3. Create a tab group with ~3 tabs
  4. Pin one of the tabs --> sometimes crashes, sometimes does not crash
  5. If no crash, unpin tab
  6. Re-add to same tab group
  7. Try to pin same tab again --> usually crashes Note, in step 7 I've also tried pinning a different tab in the group, sometimes that caused a crash, sometimes not

Actual result

browser crashes

Expected result

browser should not crash

Reproduces how often

Easily reproduced

Brave version (brave://version info)

Brave   1.70.57 Chromium: 127.0.6533.100 (Official Build) nightly (arm64) 
Revision    988908b19eb78f2e5fe4c65fa0955c5cc7e37086
OS  macOS Version 14.6.1 (Build 23G93)

Channel information

Reproducibility

Miscellaneous information

Crash ID: ffc50300-15c1-690c-0000-000000000000

Call Stack ``` [ 00 ] base::ImmediateCrash() ( immediate_crash.h:176 ) [ 01 ] logging::NotReachedFailure() ( notreached.h:60 ) [ 02 ] content::PrerenderWebContentsDelegate::OpenURLFromTab(content::WebContents*, content::OpenURLParams const&, base::OnceCallback) ( prerender_web_contents_delegate.cc:17 ) [ 03 ] TabStripLayoutHelper::SlotIsCollapsedTab(int) const ( tab_strip_layout_helper.cc:411 ) [ 04 ] TabStripLayoutHelper::CalculateIdealBounds(std::__Cr::optional) ( tab_strip_layout_helper.cc:268 ) [ 05 ] TabStripLayoutHelper::UpdateIdealBounds(int) ( tab_strip_layout_helper.cc:206 ) [ 06 ] TabContainerImpl::UpdateIdealBounds() ( tab_container_impl.cc:1220 ) [ 07 ] TabContainerImpl::AnimateToIdealBounds() ( tab_container_impl.cc:621 ) [ 08 ] CompoundTabContainer::AnimateToIdealBounds() ( compound_tab_container.cc:566 ) [ 09 ] CompoundTabContainer::TransferTabBetweenContainers(int, int) ( compound_tab_container.cc:969 ) [ 10 ] BraveCompoundTabContainer::TransferTabBetweenContainers(int, int) ( brave_compound_tab_container.cc:193 ) [ 11 ] TabStrip::MoveTab(int, int, TabRendererData) ( tab_strip.cc:1156 ) [ 12 ] BrowserTabStripController::OnTabStripModelChanged(TabStripModel*, TabStripModelChange const&, TabStripSelectionChange const&) ( browser_tab_strip_controller.cc:677 ) [ 13 ] TabStripModel::OnChange(TabStripModelChange const&, TabStripSelectionChange const&) ( tab_strip_model.cc:393 ) [ 14 ] TabStripModel::OnChange(TabStripModelChange const&, TabStripSelectionChange const&) ( tab_strip_model.cc:393 ) [ 15 ] TabStripModel::SendMoveNotificationForWebContents(int, int, content::WebContents*, TabStripSelectionChange&) ( tab_strip_model.cc:2783 ) [ 16 ] TabStripModel::MoveTabToIndexImpl(int, int, std::__Cr::optional, bool, bool) ( tab_strip_model.cc:2638 ) [ 17 ] TabStripModel::SetTabsPinned(std::__Cr::vector>, bool) ( tab_strip_model.cc:2876 ) [ 18 ] TabStripModel::ExecuteContextMenuCommand(int, TabStripModel::ContextMenuCommand) ( tab_strip_model.cc:1476 ) [ 19 ] BraveTabStripModel::ExecuteContextMenuCommand(int, TabStripModel::ContextMenuCommand) ( brave_tab_strip_model.cc:70 ) [ 20 ] -[MenuControllerCocoa itemSelected:] ( menu_controller.mm:303 ) [ 21 ] -[MenuControllerCocoa itemSelected:] ( menu_controller.mm:303 ) [ 22 ] 0x191428ff8 [ 23 ] __43-[BrowserCrApplication sendAction:to:from:]_block_invoke ( chrome_browser_application_mac.mm:393 ) [ 24 ] base::apple::CallWithEHFrame(void () block_pointer) [ 25 ] 0x1914f3084 [ 26 ] 0x1914f3084 [ 27 ] 0x191aa3488 [ 28 ] 0x19152b82c [ 29 ] 0x19152b74c [ 30 ] 0x191a99de8 [ 31 ] 0x1918c2c0c [ 32 ] 0x1918c2980 [ 33 ] 0x191ff6c10 [ 34 ] 0x19187b844 [ 35 ] 0x191aa4c90 [ 36 ] 0x191aa9264 [ 37 ] 0x1915a96b8 [ 38 ] ui::ShowContextMenu(NSMenu*, NSEvent*, NSView*, bool, ui::ElementContext) ( menu_utils.mm:83 ) [ 39 ] views::internal::MenuRunnerImplCocoa::RunMenuAt(views::Widget*, views::MenuButtonController*, gfx::Rect const&, views::MenuAnchorPosition, int, gfx::NativeView, std::__Cr::optional, std::__Cr::optional, std::__Cr::allocator>>) ( menu_runner_impl_cocoa.mm:91 ) [ 40 ] views::internal::MenuRunnerImplMac::RunMenuAt(views::Widget*, views::MenuButtonController*, gfx::Rect const&, views::MenuAnchorPosition, int, gfx::NativeView, std::__Cr::optional, std::__Cr::optional, std::__Cr::allocator>>) ( menu_runner_impl_mac.mm:61 ) [ 41 ] views::MenuRunner::RunMenuAt(views::Widget*, views::MenuButtonController*, gfx::Rect const&, views::MenuAnchorPosition, ui::MenuSourceType, gfx::NativeView, std::__Cr::optional, std::__Cr::optional, std::__Cr::allocator>>) ( menu_runner.cc:91 ) [ 42 ] TabStrip::ShowContextMenuForTab(Tab*, gfx::Point const&, ui::MenuSourceType) ( tab_strip.cc:1687 ) [ 43 ] TabStrip::TabContextMenuController::ShowContextMenuForViewImpl(views::View*, gfx::Point const&, ui::MenuSourceType) ( tab_strip.cc:2313 ) [ 44 ] views::ContextMenuController::ShowContextMenuForView(views::View*, gfx::Point const&, ui::MenuSourceType) ( context_menu_controller.cc:29 ) [ 45 ] views::View::ProcessMousePressed(ui::MouseEvent const&) ( view.cc:3555 ) [ 46 ] views::View::ProcessMousePressed(ui::MouseEvent const&) ( view.cc:3555 ) [ 47 ] views::View::OnMouseEvent(ui::MouseEvent*) ( view.cc:1652 ) [ 48 ] ui::EventDispatcher::DispatchEvent(ui::EventHandler*, ui::Event*) ( event_dispatcher.cc:187 ) [ 49 ] ui::EventDispatcherDelegate::DispatchEventToTarget(ui::EventTarget*, ui::Event*) ( event_dispatcher.cc:82 ) [ 50 ] ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget*, ui::Event*) ( event_dispatcher.cc:54 ) [ 51 ] views::internal::RootView::OnMousePressed(ui::MouseEvent const&) ( root_view.cc:498 ) [ 52 ] views::Widget::OnMouseEvent(ui::MouseEvent*) ( widget.cc:1833 ) [ 53 ] views::Widget::OnMouseEvent(ui::MouseEvent*) ( widget.cc:1833 ) [ 54 ] views::NativeWidgetMacNSWindowHost::OnMouseEvent(std::__Cr::unique_ptr>) ( native_widget_mac_ns_window_host.mm:984 ) [ 55 ] -[BridgedContentView mouseEvent:] ( bridged_content_view.mm:656 ) [ 56 ] 0x191dbfbc4 [ 57 ] 0x1913af524 [ 58 ] 0x1913af20c [ 59 ] -[NativeWidgetMacNSWindow sendEvent:] ( native_widget_mac_nswindow.mm:473 ) [ 60 ] 0x191a784ec [ 61 ] __34-[BrowserCrApplication sendEvent:]_block_invoke ( chrome_browser_application_mac.mm:441 ) [ 62 ] base::apple::CallWithEHFrame(void () block_pointer) [ 63 ] 0x1916c5d98 [ 64 ] 0x1916c5d98 [ 65 ] 0x19127601c [ 66 ] base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*) ( message_pump_apple.mm:807 ) [ 67 ] base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*) ( message_pump_apple.mm:161 ) [ 68 ] base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) ( thread_controller_with_message_pump_impl.cc:654 ) [ 69 ] non-virtual thunk to base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) ( run_loop.cc:0 ) [ 70 ] base::RunLoop::Run(base::Location const&) ( run_loop.cc:134 ) [ 71 ] content::BrowserMainLoop::RunMainMessageLoop() ( browser_main_loop.cc:1085 ) [ 72 ] content::BrowserMainRunnerImpl::Run() ( browser_main_runner_impl.cc:160 ) [ 73 ] content::BrowserMain(content::MainFunctionParams) ( browser_main.cc:34 ) [ 74 ] content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) ( content_main.cc:332 ) [ 75 ] content::ContentMain(content::ContentMainParams) ( content_main.cc:345 ) [ 76 ] content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) ( content_main.cc:332 ) [ 77 ] content::ContentMain(content::ContentMainParams) ( content_main.cc:345 ) [ 78 ] ChromeMain ( chrome_main.cc:192 ) [ 79 ] 0x18d5bb150 [ 80 ] 0x18d5bb150 ```

Crash ID: b1c70300-15c1-690c-0000-000000000000

Call Stack ``` [ 00 ] base::ImmediateCrash() ( immediate_crash.h:176 ) [ 01 ] logging::NotReachedFailure() ( notreached.h:60 ) [ 02 ] content::PrerenderWebContentsDelegate::OpenURLFromTab(content::WebContents*, content::OpenURLParams const&, base::OnceCallback) ( prerender_web_contents_delegate.cc:17 ) [ 03 ] TabStripLayoutHelper::SlotIsCollapsedTab(int) const ( tab_strip_layout_helper.cc:411 ) [ 04 ] TabStripLayoutHelper::CalculateIdealBounds(std::__Cr::optional) ( tab_strip_layout_helper.cc:268 ) [ 05 ] TabStripLayoutHelper::UpdateIdealBounds(int) ( tab_strip_layout_helper.cc:206 ) [ 06 ] TabContainerImpl::UpdateIdealBounds() ( tab_container_impl.cc:1220 ) [ 07 ] TabContainerImpl::AnimateToIdealBounds() ( tab_container_impl.cc:621 ) [ 08 ] CompoundTabContainer::AnimateToIdealBounds() ( compound_tab_container.cc:566 ) [ 09 ] CompoundTabContainer::TransferTabBetweenContainers(int, int) ( compound_tab_container.cc:969 ) [ 10 ] BraveCompoundTabContainer::TransferTabBetweenContainers(int, int) ( brave_compound_tab_container.cc:193 ) [ 11 ] TabStrip::MoveTab(int, int, TabRendererData) ( tab_strip.cc:1156 ) [ 12 ] BrowserTabStripController::OnTabStripModelChanged(TabStripModel*, TabStripModelChange const&, TabStripSelectionChange const&) ( browser_tab_strip_controller.cc:677 ) [ 13 ] TabStripModel::OnChange(TabStripModelChange const&, TabStripSelectionChange const&) ( tab_strip_model.cc:393 ) [ 14 ] TabStripModel::OnChange(TabStripModelChange const&, TabStripSelectionChange const&) ( tab_strip_model.cc:393 ) [ 15 ] TabStripModel::SendMoveNotificationForWebContents(int, int, content::WebContents*, TabStripSelectionChange&) ( tab_strip_model.cc:2783 ) [ 16 ] TabStripModel::MoveTabToIndexImpl(int, int, std::__Cr::optional, bool, bool) ( tab_strip_model.cc:2638 ) [ 17 ] TabStripModel::SetTabsPinned(std::__Cr::vector>, bool) ( tab_strip_model.cc:2876 ) [ 18 ] TabStripModel::ExecuteContextMenuCommand(int, TabStripModel::ContextMenuCommand) ( tab_strip_model.cc:1476 ) [ 19 ] BraveTabStripModel::ExecuteContextMenuCommand(int, TabStripModel::ContextMenuCommand) ( brave_tab_strip_model.cc:70 ) [ 20 ] -[MenuControllerCocoa itemSelected:] ( menu_controller.mm:303 ) [ 21 ] -[MenuControllerCocoa itemSelected:] ( menu_controller.mm:303 ) [ 22 ] 0x191428ff8 [ 23 ] __43-[BrowserCrApplication sendAction:to:from:]_block_invoke ( chrome_browser_application_mac.mm:393 ) [ 24 ] base::apple::CallWithEHFrame(void () block_pointer) [ 25 ] 0x1914f3084 [ 26 ] 0x1914f3084 [ 27 ] 0x191aa3488 [ 28 ] 0x19152b82c [ 29 ] 0x19152b74c [ 30 ] 0x191a99de8 [ 31 ] 0x1918c2c0c [ 32 ] 0x1918c2980 [ 33 ] 0x191ff6c10 [ 34 ] 0x19187b844 [ 35 ] 0x191aa4c90 [ 36 ] 0x191aa9264 [ 37 ] 0x1915a96b8 [ 38 ] ui::ShowContextMenu(NSMenu*, NSEvent*, NSView*, bool, ui::ElementContext) ( menu_utils.mm:83 ) [ 39 ] views::internal::MenuRunnerImplCocoa::RunMenuAt(views::Widget*, views::MenuButtonController*, gfx::Rect const&, views::MenuAnchorPosition, int, gfx::NativeView, std::__Cr::optional, std::__Cr::optional, std::__Cr::allocator>>) ( menu_runner_impl_cocoa.mm:91 ) [ 40 ] views::internal::MenuRunnerImplMac::RunMenuAt(views::Widget*, views::MenuButtonController*, gfx::Rect const&, views::MenuAnchorPosition, int, gfx::NativeView, std::__Cr::optional, std::__Cr::optional, std::__Cr::allocator>>) ( menu_runner_impl_mac.mm:61 ) [ 41 ] views::MenuRunner::RunMenuAt(views::Widget*, views::MenuButtonController*, gfx::Rect const&, views::MenuAnchorPosition, ui::MenuSourceType, gfx::NativeView, std::__Cr::optional, std::__Cr::optional, std::__Cr::allocator>>) ( menu_runner.cc:91 ) [ 42 ] TabStrip::ShowContextMenuForTab(Tab*, gfx::Point const&, ui::MenuSourceType) ( tab_strip.cc:1687 ) [ 43 ] TabStrip::TabContextMenuController::ShowContextMenuForViewImpl(views::View*, gfx::Point const&, ui::MenuSourceType) ( tab_strip.cc:2313 ) [ 44 ] views::ContextMenuController::ShowContextMenuForView(views::View*, gfx::Point const&, ui::MenuSourceType) ( context_menu_controller.cc:29 ) [ 45 ] views::View::ProcessMousePressed(ui::MouseEvent const&) ( view.cc:3555 ) [ 46 ] views::View::ProcessMousePressed(ui::MouseEvent const&) ( view.cc:3555 ) [ 47 ] views::View::OnMouseEvent(ui::MouseEvent*) ( view.cc:1652 ) [ 48 ] ui::EventDispatcher::DispatchEvent(ui::EventHandler*, ui::Event*) ( event_dispatcher.cc:187 ) [ 49 ] ui::EventDispatcherDelegate::DispatchEventToTarget(ui::EventTarget*, ui::Event*) ( event_dispatcher.cc:82 ) [ 50 ] ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget*, ui::Event*) ( event_dispatcher.cc:54 ) [ 51 ] views::internal::RootView::OnMousePressed(ui::MouseEvent const&) ( root_view.cc:498 ) [ 52 ] views::Widget::OnMouseEvent(ui::MouseEvent*) ( widget.cc:1833 ) [ 53 ] views::Widget::OnMouseEvent(ui::MouseEvent*) ( widget.cc:1833 ) [ 54 ] views::NativeWidgetMacNSWindowHost::OnMouseEvent(std::__Cr::unique_ptr>) ( native_widget_mac_ns_window_host.mm:984 ) [ 55 ] -[BridgedContentView mouseEvent:] ( bridged_content_view.mm:656 ) [ 56 ] 0x191dbfbc4 [ 57 ] 0x1913af524 [ 58 ] 0x1913af20c [ 59 ] -[NativeWidgetMacNSWindow sendEvent:] ( native_widget_mac_nswindow.mm:473 ) [ 60 ] 0x191a784ec [ 61 ] __34-[BrowserCrApplication sendEvent:]_block_invoke ( chrome_browser_application_mac.mm:441 ) [ 62 ] base::apple::CallWithEHFrame(void () block_pointer) [ 63 ] 0x1916c5d98 [ 64 ] 0x1916c5d98 [ 65 ] 0x19127601c [ 66 ] base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*) ( message_pump_apple.mm:807 ) [ 67 ] base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*) ( message_pump_apple.mm:161 ) [ 68 ] base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) ( thread_controller_with_message_pump_impl.cc:654 ) [ 69 ] non-virtual thunk to base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) ( run_loop.cc:0 ) [ 70 ] base::RunLoop::Run(base::Location const&) ( run_loop.cc:134 ) [ 71 ] content::BrowserMainLoop::RunMainMessageLoop() ( browser_main_loop.cc:1085 ) [ 72 ] content::BrowserMainRunnerImpl::Run() ( browser_main_runner_impl.cc:160 ) [ 73 ] content::BrowserMain(content::MainFunctionParams) ( browser_main.cc:34 ) [ 74 ] content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) ( content_main.cc:332 ) [ 75 ] content::ContentMain(content::ContentMainParams) ( content_main.cc:345 ) [ 76 ] content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) ( content_main.cc:332 ) [ 77 ] content::ContentMain(content::ContentMainParams) ( content_main.cc:345 ) [ 78 ] ChromeMain ( chrome_main.cc:192 ) [ 79 ] 0x18d5bb150 [ 80 ] 0x18d5bb150 ```
bsclifton commented 1 month ago

cc: @sangwoo108