Issue 529971 in chromium: Crash in ProfileDownloader::StartFetchingImage()

[chro...@googlecode.com]

Status: Assigned
Owner: anthon...@chromium.org
CC: rog...@chromium.org, osh...@chromium.org, abod...@chromium.org
Labels: Type-Bug Pri-1 Cr-UI-Browser-Profiles OS-Chrome OS-Linux

New issue 529971 by afak...@chromium.org: Crash in
ProfileDownloader::StartFetchingImage()
https://code.google.com/p/chromium/issues/detail?id=529971

There's a segmentation fault crash on CrOs on linux at this line:

if (delegate_->IsPreSignin()) {

This CL https://codereview.chromium.org/1326273003 is apparently the cause.

The ProfileDownloader object was destructed during FetchImageData() in
particular when this scoped_ptr is destroyed here
https://code.google.com/p/chromium/codesearch#chromium/src/chrome/browser/chromeos/login/users/avatar/user_image_manager_impl.cc&q=chromeos::UserImageManagerImpl::OnProfileDownloadSuccess&sq=package:chromium&l=767

Here's a helpful stack trace.

+++++++++++++++++++++++++++
void ProfileDownloader::StartFetchingImage()
| +++++++++++++++++++++++++++
| void ProfileDownloader::FetchImageData()
| | +++++++++++++++++++++++++++
| | virtual ProfileDownloader::~ProfileDownloader()
| | ---------------------------
| ---------------------------
delegate_ = 0xcdcdcdcdcdcdcdcd
delegate_->IsPreSignin() = Segmentation Violation:
ST is:
#0 0x2afae995d87e base::debug::StackTrace::StackTrace()
#1 0x2afad94f4491 HandleSegmenationFault()
#2 0x2afaf0fcc340 <unknown>
#3 0x2afad94f66e9 ProfileDownloader::StartFetchingImage()
#4 0x2afad94f81d6 ProfileDownloader::OnGetTokenSuccess()
#5 0x2afad9db2917 OAuth2TokenService::RequestImpl::InformConsumer()
#6 0x2afad9db31e7 OAuth2TokenService::Fetcher::InformWaitingRequests()
#7 0x2afad9db342d
OAuth2TokenService::Fetcher::InformWaitingRequestsAndDelete()
#8 0x2afad9db33f5 OAuth2TokenService::Fetcher::OnGetTokenSuccess()
#9 0x2afad9dc8b35 OAuth2AccessTokenFetcher::FireOnGetTokenSuccess()
#10 0x2afad9db1470 OAuth2AccessTokenFetcherImpl::OnGetTokenSuccess()
#11 0x2afad9db0d0b OAuth2AccessTokenFetcherImpl::EndGetAccessToken()
#12 0x2afad9db15b7 OAuth2AccessTokenFetcherImpl::OnURLFetchComplete()
#13 0x2afae0168e35 net::URLFetcherCore::InformDelegateFetchIsComplete()
#14 0x2afae0168d16 net::URLFetcherCore::OnCompletedURLRequest()
#15 0x2afadff55229 base::internal::RunnableAdapter<>::Run()
#16 0x2afae016cf81
_ZN4base8internal12InvokeHelperILb0EvNS0_15RunnableAdapterIMN3net14URLFetcherCoreEFvNS_9TimeDeltaEEEENS0_8TypeListIJRKPS4_RKS5_EEEE8MakeItSoES8_SC_SE_
#17 0x2afae016cf31
_ZN4base8internal7InvokerINS_13IndexSequenceIJLm0ELm1EEEENS0_9BindStateINS0_15RunnableAdapterIMN3net14URLFetcherCoreEFvNS_9TimeDeltaEEEEFvPS7_S8_ENS0_8TypeListIJSC_S8_EEEEENSE_IJNS0_12UnwrapTraitsISC_EENSH_IS8_EEEEENS0_12InvokeHelperILb0EvSB_NSE_IJRKSC_RKS8_EEEEEFvvEE3RunEPNS0_13BindStateBaseE
#18 0x2afae99456ce base::Callback<>::Run()
#19 0x2afae9962e57 base::debug::TaskAnnotator::RunTask()
#20 0x2afae99c7904 base::MessageLoop::RunTask()
#21 0x2afae99c7b78 base::MessageLoop::DeferOrRunPendingTask()
#22 0x2afae99c7d42 base::MessageLoop::DoWork()
#23 0x2afae9927f2c base::MessagePumpGlib::HandleDispatch()
#24 0x2afae99285f1 base::(anonymous namespace)::WorkSourceDispatch()
#25 0x2afaf07e1e04 g_main_context_dispatch
#26 0x2afaf07e2048 <unknown>
#27 0x2afaf07e20ec g_main_context_iteration
#28 0x2afae992802f base::MessagePumpGlib::Run()
#29 0x2afae99c737a base::MessageLoop::RunHandler()
#30 0x2afae9a21084 base::RunLoop::Run()
#31 0x2afadc7a8167 ChromeBrowserMainParts::MainMessageLoopRun()
#32 0x2afae153f434 content::BrowserMainLoop::RunMainMessageLoopParts()
#33 0x2afae1546fa5 content::BrowserMainRunnerImpl::Run()
#34 0x2afae1539b78 content::BrowserMain()
#35 0x2afae13b44f6 content::RunNamedProcessTypeMain()
#36 0x2afae13b63ed content::ContentMainRunnerImpl::Run()
#37 0x2afae13b3c62 content::ContentMain()
#38 0x2afad8fb5cf2 ChromeMain
#39 0x2afad8fb5ca2 main
#40 0x2afaf11fbec5 __libc_start_main
#41 0x2afad8fb5b84 <unknown>

--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings

[chro...@googlecode.com]

Updates:
Cc: anthon...@chromium.org e...@chromium.org mler...@chromium.org
no...@chromium.org

Comment #1 on issue 529971 by afak...@chromium.org: Crash in
ProfileDownloader::StartFetchingImage()
https://code.google.com/p/chromium/issues/detail?id=529971

(No comment was entered for this change.)