Browser crashes upon closing window after viewing an Ad

[tmancey]

Browser crashes upon closing window

Steps to Reproduce

1. Open a new tab with www.imdb.com
2. Open a new incognito window
3. Select the original window
4. Wait until browser state changes to idle
5. Move mouse
6. Tap "View" button on Ad notification
7. Close the original window

Actual result:

Exception is thrown, see call-stack

Expected result:

Exception should not be thrown

Reproduces how often:

Intermittent

Brave version (brave://version info)

Brave Core issues/2912-0.62.x branch, however expect same issue is reproducible on master

Reproducible on current release:

• Does it reproduce on brave-browser dev/beta builds? N/A

Website problems only:

• Does the issue resolve itself when disabling Brave Shields? N/A
• Is the issue reproducible on the latest version of Chrome? N/A

Additional Information

[1047:775:0204/222140.700221:FATAL:delegated_frame_host.cc(364)] Check failed: std::find(surface_ids.begin(), surface_ids.end(), GetCurrentSurfaceId()) != surface_ids.end().
0   libbase.dylib                       0x000000012e60fcf3 base::debug::StackTrace::StackTrace(unsigned long) + 83
1   libbase.dylib                       0x000000012e60fdad base::debug::StackTrace::StackTrace(unsigned long) + 29
2   libbase.dylib                       0x000000012e2fd0fa base::debug::StackTrace::StackTrace() + 26
3   libbase.dylib                       0x000000012e344aae logging::LogMessage::~LogMessage() + 142
4   libbase.dylib                       0x000000012e3438a5 logging::LogMessage::~LogMessage() + 21
5   libcontent.dylib                    0x0000000139ffef85 content::DelegatedFrameHost::EvictDelegatedFrame() + 709
6   libclient.dylib                     0x00000001ab1c437a viz::FrameEvictor::EvictCurrentFrame() + 26
7   libclient.dylib                     0x00000001ab1bdd08 viz::FrameEvictionManager::CullUnlockedFrames(unsigned long) + 248
8   libclient.dylib                     0x00000001ab1be850 viz::FrameEvictionManager::UnlockFrame(viz::FrameEvictionManagerClient*) + 560
9   libclient.dylib                     0x00000001ab1c4346 viz::FrameEvictor::SetVisible(bool) + 134
10  libcontent.dylib                    0x0000000139ffdb36 content::DelegatedFrameHost::WasHidden() + 38
11  libcontent.dylib                    0x0000000139ff7d74 content::BrowserCompositorMac::TransitionToState(content::BrowserCompositorMac::State) + 916
12  libcontent.dylib                    0x0000000139ff7598 content::BrowserCompositorMac::~BrowserCompositorMac() + 104
13  libcontent.dylib                    0x0000000139ff8295 content::BrowserCompositorMac::~BrowserCompositorMac() + 21
14  libcontent.dylib                    0x0000000139ff82d9 content::BrowserCompositorMac::~BrowserCompositorMac() + 25
15  libcontent.dylib                    0x00000001399001af std::__1::default_delete<content::BrowserCompositorMac>::operator()(content::BrowserCompositorMac*) const + 47
16  libcontent.dylib                    0x00000001398f028f std::__1::unique_ptr<content::BrowserCompositorMac, std::__1::default_delete<content::BrowserCompositorMac> >::reset(content::BrowserCompositorMac*) + 95
17  libcontent.dylib                    0x00000001398f3f20 content::RenderWidgetHostViewMac::Destroy() + 160
18  libcontent.dylib                    0x00000001398f3e6f content::RenderWidgetHostViewMac::RenderProcessGone(base::TerminationStatus, int) + 31
19  libcontent.dylib                    0x000000013989f86e content::RenderWidgetHostImpl::RendererExited(base::TerminationStatus, int) + 238
20  libcontent.dylib                    0x000000013987c5bc content::RenderViewHostImpl::RenderProcessExited(content::RenderProcessHost*, content::ChildProcessTerminationInfo const&) + 92
21  libcontent.dylib                    0x00000001397fb7a1 content::RenderProcessHostImpl::ProcessDied(bool, content::ChildProcessTerminationInfo*) + 993
22  libcontent.dylib                    0x00000001397fb296 content::RenderProcessHostImpl::FastShutdownIfPossible(unsigned long, bool) + 326
23  libchrome_dll.dylib                 0x000000010ef3f9b3 TabStripModel::CloseWebContentses(base::span<content::WebContents* const, 18446744073709551615ul>, unsigned int) + 515
24  libchrome_dll.dylib                 0x000000010ef3b0f2 TabStripModel::InternalCloseTabs(base::span<content::WebContents* const, 18446744073709551615ul>, unsigned int) + 658
25  libchrome_dll.dylib                 0x000000010ef3ac5e TabStripModel::CloseAllTabs() + 174
26  libchrome_dll.dylib                 0x000000010ee3c781 Browser::OnWindowClosing() + 353
27  libchrome_dll.dylib                 0x000000010ef8d41e UnloadController::ProcessPendingTabs(bool) + 158
28  libchrome_dll.dylib                 0x000000010ef8ca61 UnloadController::ClearUnloadState(content::WebContents*, bool) + 161
29  libchrome_dll.dylib                 0x000000010ef8c987 UnloadController::CanCloseContents(content::WebContents*) + 55
30  libchrome_dll.dylib                 0x000000010ee40e60 Browser::CloseContents(content::WebContents*) + 112
31  libcontent.dylib                    0x0000000139cf8359 content::WebContentsImpl::Close(content::RenderViewHost*) + 185
32  libcontent.dylib                    0x000000013987c554 content::RenderViewHostImpl::ClosePageIgnoringUnloadEvents() + 68
33  libcontent.dylib                    0x000000013987e405 content::RenderViewHostImpl::OnClosePageACK() + 21
34  libcontent.dylib                    0x0000000139886321 void base::DispatchToMethodImpl<content::RenderViewHostImpl*, void (content::RenderViewHostImpl::*)(), std::__1::tuple<> >(content::RenderViewHostImpl* const&, void (content::RenderViewHostImpl::*)(), std::__1::tuple<>&&, std::__1::integer_sequence<unsigned long>) + 129
35  libcontent.dylib                    0x0000000139886298 void base::DispatchToMethod<content::RenderViewHostImpl*, void (content::RenderViewHostImpl::*)(), std::__1::tuple<> >(content::RenderViewHostImpl* const&, void (content::RenderViewHostImpl::*)(), std::__1::tuple<>&&) + 120
36  libcontent.dylib                    0x00000001398861f7 void IPC::DispatchToMethod<content::RenderViewHostImpl, void (content::RenderViewHostImpl::*)(), void, std::__1::tuple<> >(content::RenderViewHostImpl*, void (content::RenderViewHostImpl::*)(), void*, std::__1::tuple<>&&) + 119
37  libcontent.dylib                    0x000000013987e37d bool IPC::MessageT<ViewHostMsg_ClosePage_ACK_Meta, std::__1::tuple<>, void>::Dispatch<content::RenderViewHostImpl, content::RenderViewHostImpl, void, void (content::RenderViewHostImpl::*)()>(IPC::Message const*, content::RenderViewHostImpl*, content::RenderViewHostImpl*, void*, void (content::RenderViewHostImpl::*)()) + 397
38  libcontent.dylib                    0x000000013987d0ea content::RenderViewHostImpl::OnMessageReceived(IPC::Message const&) + 890
39  libcontent.dylib                    0x00000001397fc0c3 content::RenderProcessHostImpl::OnMessageReceived(IPC::Message const&) + 835
40  libipc.dylib                        0x000000013651c6f5 IPC::ChannelProxy::Context::OnDispatchMessage(IPC::Message const&) + 149
41  libipc.dylib                        0x0000000136522037 void base::internal::FunctorTraits<void (IPC::ChannelProxy::Context::*)(IPC::Message const&), void>::Invoke<void (IPC::ChannelProxy::Context::*)(IPC::Message const&), scoped_refptr<IPC::ChannelProxy::Context> const&, IPC::Message const&>(void (IPC::ChannelProxy::Context::*)(IPC::Message const&), scoped_refptr<IPC::ChannelProxy::Context> const&&&, IPC::Message const&&&) + 151
42  libipc.dylib                        0x0000000136521ed6 void base::internal::InvokeHelper<false, void>::MakeItSo<void (IPC::ChannelProxy::Context::* const&)(IPC::Message const&), scoped_refptr<IPC::ChannelProxy::Context> const&, IPC::Message const&>(void (IPC::ChannelProxy::Context::* const&&&)(IPC::Message const&), scoped_refptr<IPC::ChannelProxy::Context> const&&&, IPC::Message const&&&) + 102
43  libipc.dylib                        0x0000000136521e63 void base::internal::Invoker<base::internal::BindState<void (IPC::ChannelProxy::Context::*)(IPC::Message const&), scoped_refptr<IPC::ChannelProxy::Context>, IPC::Message>, void ()>::RunImpl<void (IPC::ChannelProxy::Context::* const&)(IPC::Message const&), std::__1::tuple<scoped_refptr<IPC::ChannelProxy::Context>, IPC::Message> const&, 0ul, 1ul>(void (IPC::ChannelProxy::Context::* const&&&)(IPC::Message const&), std::__1::tuple<scoped_refptr<IPC::ChannelProxy::Context>, IPC::Message> const&&&, std::__1::integer_sequence<unsigned long, 0ul, 1ul>) + 99
44  libipc.dylib                        0x0000000136521d6c base::internal::Invoker<base::internal::BindState<void (IPC::ChannelProxy::Context::*)(IPC::Message const&), scoped_refptr<IPC::ChannelProxy::Context>, IPC::Message>, void ()>::Run(base::internal::BindStateBase*) + 44
45  libbase.dylib                       0x000000012e2beffc base::OnceCallback<void ()>::Run() && + 92
46  libbase.dylib                       0x000000012e2fe719 base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) + 729
47  libbase.dylib                       0x000000012e3885cc base::MessageLoopImpl::RunTask(base::PendingTask*) + 796
48  libbase.dylib                       0x000000012e3889b9 base::MessageLoopImpl::DeferOrRunPendingTask(base::PendingTask) + 89
49  libbase.dylib                       0x000000012e389467 base::MessageLoopImpl::DoWork() + 455
50  libbase.dylib                       0x000000012e393f02 base::MessagePumpCFRunLoopBase::RunWork() + 98
51  libbase.dylib                       0x000000012e393e8c ___ZN4base24MessagePumpCFRunLoopBase13RunWorkSourceEPv_block_invoke + 28
52  libbase.dylib                       0x000000012e34972a base::mac::CallWithEHFrame(void () block_pointer) + 10
53  libbase.dylib                       0x000000012e393295 base::MessagePumpCFRunLoopBase::RunWorkSource(void*) + 101
54  CoreFoundation                      0x00007fff395f7475 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
55  CoreFoundation                      0x00007fff395f741b __CFRunLoopDoSource0 + 108
56  CoreFoundation                      0x00007fff395daeb5 __CFRunLoopDoSources0 + 195
57  CoreFoundation                      0x00007fff395da45e __CFRunLoopRun + 1219
58  CoreFoundation                      0x00007fff395d9d48 CFRunLoopRunSpecific + 463
59  HIToolbox                           0x00007fff38870ab5 RunCurrentEventLoopInMode + 293
60  HIToolbox                           0x00007fff388707eb ReceiveNextEventCommon + 618
61  HIToolbox                           0x00007fff38870568 _BlockUntilNextEventMatchingListInModeWithFilter + 64
62  AppKit                              0x00007fff36b2b363 _DPSNextEvent + 997
63  AppKit                              0x00007fff36b2a102 -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 1362
64  libchrome_dll.dylib                 0x000000010b1a2f4a __71-[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:]_block_invoke + 106
65  libbase.dylib                       0x000000012e34972a base::mac::CallWithEHFrame(void () block_pointer) + 10
66  libchrome_dll.dylib                 0x000000010b1a2de8 -[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 248
67  AppKit                              0x00007fff36b24165 -[NSApplication run] + 699
68  libbase.dylib                       0x000000012e39556c base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*) + 348
69  libbase.dylib                       0x000000012e392a62 base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*) + 114
70  libbase.dylib                       0x000000012e387e30 base::MessageLoopImpl::Run(bool) + 512
71  libbase.dylib                       0x000000012e4367fd base::RunLoop::Run() + 525
72  libchrome_dll.dylib                 0x000000010b1abfd4 ChromeBrowserMainParts::MainMessageLoopRun(int*) + 340
73  libcontent.dylib                    0x0000000138a057bc content::BrowserMainLoop::RunMainMessageLoopParts() + 332
74  libcontent.dylib                    0x0000000138a15b68 content::BrowserMainRunnerImpl::Run() + 344
75  libcontent.dylib                    0x00000001389ff680 content::BrowserMain(content::MainFunctionParams const&) + 208
76  libcontent.dylib                    0x000000013b252a36 content::RunBrowserProcessMain(content::MainFunctionParams const&, content::ContentMainDelegate*) + 134
77  libcontent.dylib                    0x000000013b2540a4 content::ContentMainRunnerImpl::RunServiceManager(content::MainFunctionParams&, bool) + 1204
78  libcontent.dylib                    0x000000013b253afb content::ContentMainRunnerImpl::Run(bool) + 603
79  libcontent.dylib                    0x000000013b2504c9 content::ContentServiceManagerMainDelegate::RunEmbedderProcess() + 57
80  libembedder.dylib                   0x000000010766a077 service_manager::Main(service_manager::MainParams const&) + 1607
81  libcontent.dylib                    0x000000013b252969 content::ContentMain(content::ContentMainParams const&) + 89
82  libchrome_dll.dylib                 0x0000000107f0996e ChromeMain + 270
83  Brave Browser Development           0x00000001051aec33 main + 659
84  libdyld.dylib                       0x00007fff6681bed9 start + 1

[tmancey]

I can no longer reproduce, closing as expected was fixed by #2970