Intermittent crash in Beta when watching youtube in Picture-in-Picture

[aseren]

IMPORTANT: Your crash has already been automatically reported to our crash system. Please file this bug only if you can provide more information about it.

Brave Version: 1.63.131 Chromium: 121.0.6167.85
Operating System: Mac OS X 14.3.0

URL (if applicable) where crash occurred:
youtube.com with Floating Player - Picture in Picture extension installed.

Can you reproduce this crash?

What steps will reproduce this crash? (If it's not reproducible, what were you doing just before the crash?)

1. Install Floating Player - Picture in Picture
2. Open some video on youtube
3. Watch it in Picure-in-Picture mode
4. At some point the crash occured

DO NOT CHANGE BELOW THIS LINE
Crash ID: crash/d6570e00-802f-5e0b-0000-000000000000

[rebron]

cc: @sangwoo108

[sangwoo108]

[ 00 ] VideoOverlayWindowViews::GetWorkAreaForWindow() const ( video_overlay_window_views.cc:678 )
[ 01 ] VideoOverlayWindowViews::OnDisplayMetricsChanged(display::Display const&, unsigned int) ( video_overlay_window_views.cc:651 )
[ 02 ] display::DisplayChangeNotifier::NotifyDisplaysChanged(std::__Cr::vector<display::Display, std::__Cr::allocator<display::Display>> const&, std::__Cr::vector<display::Display, std::__Cr::allocator<display::Display>> const&) ( display_change_notifier.cc:80 )
[ 03 ] display::(anonymous namespace)::ScreenMac::OnNSScreensMayHaveChanged() ( screen_mac.mm:489 )
[ 04 ] display::(anonymous namespace)::ScreenMac::OnNSScreensMayHaveChanged() ( screen_mac.mm:489 )
[ 05 ] 0x183d004e8
[ 06 ] 0x183d94628
[ 07 ] 0x183d94570
[ 08 ] 0x183ccf168
[ 09 ] 0x184dc3f4c
[ 10 ] 0x1882a0a50
[ 11 ] 0x1882a0328
[ 12 ] 0x187616c94
[ 13 ] 0x1876166ac
[ 14 ] 0x18e2f7b58
[ 15 ] 0x18a07b6f0
[ 16 ] 0x189355668
[ 17 ] 0x1896eb9cc
[ 18 ] 0x1896eb8c8
[ 19 ] 0x183a7acb4
[ 20 ] 0x183a7c90c
[ 21 ] 0x183a8afa4
[ 22 ] 0x183a8abbc
[ 23 ] 0x183d4cea0
[ 24 ] 0x183d0a75c
[ 25 ] 0x183d09938
[ 26 ] 0x18e2d2444
[ 27 ] 0x18e2d2280
[ 28 ] 0x18e2d1fd8
[ 29 ] 0x1874e8ecc
[ 30 ] 0x187cd3ee8
[ 31 ] __71-[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:]_block_invoke ( chrome_browser_application_mac.mm:244 )
[ 32 ] base::apple::CallWithEHFrame(void () block_pointer)
[ 33 ] 0x1874dc378
[ 34 ] 0x1874dc378
[ 35 ] base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*) ( message_pump_apple.mm:805 )
[ 36 ] base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*) ( message_pump_apple.mm:156 )
[ 37 ] base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) ( thread_controller_with_message_pump_impl.cc:640 )
[ 38 ] non-virtual thunk to base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) ( run_loop.cc:0 )
[ 39 ] base::RunLoop::Run(base::Location const&) ( run_loop.cc:134 )
[ 40 ] content::BrowserMainRunnerImpl::Run() ( browser_main_runner_impl.cc:159 )
[ 41 ] content::BrowserMain(content::MainFunctionParams) ( browser_main.cc:34 )
[ 42 ] content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) ( content_main_runner_impl.cc:706 )
[ 43 ] content::ContentMainRunnerImpl::Run() ( content_main_runner_impl.cc:1138 )
[ 44 ] content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) ( content_main.cc:334 )
[ 45 ] content::ContentMain(content::ContentMainParams) ( content_main.cc:347 )
[ 46 ] content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) ( content_main.cc:334 )
[ 47 ] content::ContentMain(content::ContentMainParams) ( content_main.cc:347 )
[ 48 ] ChromeMain ( chrome_main.cc:194 )
[ 49 ] 0x1838ad0dc
[ 50 ] 0x1838ad0dc

[sangwoo108]

I'm using mac too but I can't reproduce it. The call stack looks upstream code but not sure what happened 🤔

[aseren]

The crash is intermittent, I got 2 of them.

[sangwoo108]

This seems to happen even when it's not in PIP. Double clicking youtube videos to enter fullscreen caused crashes on my Nightly version.

os: mac m1 sonoma 14.1.2 (23B92)

[sangwoo108]

It's still hard to figure out what/how to cause the crash. I'm suspecting GetController() returns dangling pointer, but not sure why it's happening.

[3097:259:0219/112048.058474:ERROR:video_overlay_window_views.cc(684)] native_widget: 0
[3097:259:0219/112048.058522:ERROR:video_overlay_window_views.cc(685)] IsVisible(): 0
[3097:259:0219/112048.058533:ERROR:video_overlay_window_views.cc(686)] GetNativeWindow(): 0
[3097:259:0219/112048.058541:ERROR:video_overlay_window_views.cc(687)] GetController(): 1
Received signal 11 SEGV_ACCERR 000000000000
0   libbase.dylib                       0x0000000103957588 base::debug::CollectStackTrace(void const**, unsigned long) + 28
1   libbase.dylib                       0x000000010393fae4 base::debug::StackTrace::StackTrace() + 24
2   libbase.dylib                       0x0000000103957460 base::debug::(anonymous namespace)::StackDumpSignalHandler(int, __siginfo*, void*) + 1208
3   libsystem_platform.dylib            0x000000018081ba24 _sigtramp + 56
4   libchrome_dll.dylib                 0x00000001109d788c VideoOverlayWindowViews::GetWorkAreaForWindow() const + 484
5   libchrome_dll.dylib                 0x00000001109d8650 non-virtual thunk to VideoOverlayWindowViews::OnDisplayMetricsChanged(display::Display const&, unsigned int) + 104
6   libui_display.dylib                 0x00000001058ebb00 display::DisplayChangeNotifier::NotifyDisplaysChanged(std::__Cr::vector<display::Display, std::__Cr::allocator<display::Display>> const&, std::__Cr::vector<display::Display, std::__Cr::allocator<display::Display>> const&) + 1276
7   libui_display.dylib                 0x00000001058fddb0 display::(anonymous namespace)::ScreenMac::OnNSScreensMayHaveChanged() + 200
8   CoreFoundation                      0x00000001808be80c __CFNOTIFICATIONCENTER_IS_CALLING_OUT_TO_AN_OBSERVER__ + 128

[strikekat]

I've also been getting issues related to YT video playback starting a few days ago, although I'm just using a stable build.
I haven't noted any issues specifically with PiP mode which I use quite frequently, but switching to fullscreen video as described above has caused the browser to immediately silently exit several times now, although the browser does recognize a crash occurred when next started.
I also cannot consistently repro the crash unfortunately.

MacOS: 14.3.1 (MBP M1 Max)
Brave Version 1.63.162 Chromium: 122.0.6261.69 (Official Build) (arm64)
Edit: updated to Version 1.63.165 Chromium: 122.0.6261.94 (Official Build) (arm64), but just happened again..

Possibly related? #36407

[Haravikk]

Seems reasonable that this is related to #36407; I originally thought the issue was video related in my case as well but I'm increasingly unsure as I've experienced issues with Brave crashing both with and without active, idle or even recent video content, so it seems more like it's just application switching related.

If it is the same crash then it's not YouTube or extension specific; I'm encountering on two different machines both running fairly basic Brave installs (only extension is a password manager, nothing particularly unusual in settings that I can think of).

Very infuriating that the crash is silent though, as it's not generating any kind of log that I can find anywhere, despite Brave knowing it wasn't closed properly (asks to restore tabs when re-opened). And very intermittent in its behaviour (I've gone an entire day without any crash despite multiple videos and lots of switching, other times it's happened 4 or 5 times in an hour).

I first noticed the issue in version 1.63.162 Chromium: 122.0.6261.69 (Official Build) (x86_64) in main releases, the main release immediately before that (1.63.161?) exhibited no such problem. The only change listed between the two was upgrading Chromium, anyone know if this is affecting Chrome or other Chromium browsers? Could it be sandboxing/helper process related?

[sangwoo108]

Sorry for the troubles folks. As far as I can tell, the code is upstream part but ours could affect it. I'm still trying to figure out what happened and check if we can patch it.

[sangwoo108]

I think I found the steps to reproduce

1. Open a youtube video and enter pip and exit the pip
2. Open another tab and close the tab used for step 1
3. Open another video in the newly opened tab, and enter fullscreen for the video

[strikekat]

Wow, yup, confirmed for me - I just tried those steps several times in a row and it crashed every time. Almost assuredly that's what's happening to me, as I do both PiP and fullscreen, and occasionally open multiple YT tabs.

[sangwoo108]

Thanks for checking, our code seem to affect that. Sorry for finding this too late. I'll fix it as soon as possible

[bsclifton]

Seems reasonable that this is related to #36407

@Haravikk I think you're exactly right!

We'll make sure to uplift. Thanks @sangwoo108 for the fix 😄

[kjozwiak]

Even though the above is a bit tricky to reproduce, going to label it as QA/Test-All-Platforms so we can at least verify it on macOS & Win as some of the reports are coming from Win as well. I couldn't reproduce the issue on Win though but double checked/ensured that it wasn't crashing with 1.65.63 Chromium: 122.0.6261.111 which has the fix as per brave/brave-core#22468 (comment).

[kjozwiak]

The above requires 1.63.171 or higher for 1.63.x verification 👍

[LaurenWags]

Verified with

Brave	1.63.174 Chromium: 122.0.6261.128 (Official Build) (arm64) 
Revision	0d369d4e1dfee7bcea82774079dc8cd658746c98
OS	macOS Version 14.4 (Build 23E214)

Reproduced the crash using STR from brave/brave-core#22468 and Google's Picture in Picture extension with 1.63.169 Chromium: 122.0.6261.111:

Using the same STR/Cases, ensured that Brave wasn't crashing when running through 1.63.174 Chromium: 122.0.6261.128.

[stephendonner]

Verified PASSED using

Brave | 1.63.174 Chromium: 122.0.6261.128 (Official Build) (x86_64)
-- | --
Revision | 0d369d4e1dfee7bcea82774079dc8cd658746c98
OS | macOS Version 11.7.10 (Build 20G1427)

Reproduced the crash using STR from brave/brave-core#22468 and Google's Picture in Picture extension with 1.63.169 Chromium: 122.0.6261.111:

Using the same STR/Cases, ensured that Brave wasn't crashing when running through 1.63.174 Chromium: 122.0.6261.128

[btlechowski]

Verified with

Brave	1.63.174 Chromium: 122.0.6261.128 (Official Build) (64-bit)
Revision	0d369d4e1dfee7bcea82774079dc8cd658746c98
OS	Linux

I was unable to reproduce the issue

Verified 10 times with brave/brave-core#22468 that no crash occurred.

[MadhaviSeelam]

Verification PASSED using

Brave | 1.63.174 Chromium: 122.0.6261.128 (Official Build) (64-bit)
-- | --
Revision | 0d369d4e1dfee7bcea82774079dc8cd658746c98
OS | Windows 11 Version 23H2 (Build 22631.3155)

Couldn't reproduce the issue in 1.63.131 Chromium: 121.0.6167.85 or 1.65.59 Chromium 122.0.6261.94

Verified using brave/brave-core#22468 (comment) and confirm no crash occurred.