Brave crashed when creating new profiles on Nightly w/ Chromium 107

[MadhaviSeelam]

Description

Steps to Reproduce

1. Install 1.46.58
2. Launch Brave
3. Click Hamburger menu>>Create a new profile

Actual result:

Brave crashed

  Crash from Friday, October 14, 2022 at 9:33:44 AM
Status:	Uploaded
Uploaded Crash Report ID:	5c8d0100-580a-fd08-0000-000000000000
Upload Time:	Friday, October 14, 2022 at 9:48:55 AM

[ 00 ] 0x7ffba50bb03c
[ 01 ] 0x7ffba5360306
[ 02 ] 0x7ffbb0a72ae8
[ 03 ] 0x7ffba53601f1
[ 04 ] 0x7ffba4008578
[ 05 ] 0x7ffbb03ebf70
[ 06 ] 0x7ffba8ee6fb3
[ 07 ] 0x7ffba8b1cc7d
[ 08 ] 0x7ffbb0a72ae8
[ 09 ] 0x7ffba8ee6fb3
[ 10 ] 0x7ffbb03ebf70

Expected result:

No crashes

Reproduces how often:

Easily

Brave version (brave://version info)

Brave | 1.46.58 Chromium: 107.0.5304.36 (Official Build) nightly (64-bit)
-- | --
Revision | 2f9c7a5a1fe357d87e9bc07c65cca9136b3651c5-refs/branch-heads/5304@{#671}
OS | Windows 11 Version 21H2 (Build 22000.1098)

Version/Channel Information:

• Can you reproduce this issue with the current release? No
• Can you reproduce this issue with the beta channel? No
• Can you reproduce this issue with the nightly channel? Yes

Other Additional Information:

• Does the issue resolve itself when disabling Brave Shields?
• Does the issue resolve itself when disabling Brave Rewards?
• Is the issue reproducible on the latest version of Chrome?

Miscellaneous Information:

@emerick @rebron

[emerick]

The BookmarkUndoService is null which leads to this crash. It seems like this occurs because the profile picker uses the system profile, but not sure.

@simonhong not sure if you might know, but do we need to allow the BookmarkUndoService to run under the system profile? When I made that change it stopped the crash, but I'm not sure if that change is necessary (nor why it isn't necessary for upstream).

Call stack on Windows:

>	chrome.dll!base::raw_ptr<bookmarks::BookmarkModel,base::internal::RawPtrNoOpImpl>::operator bool() Line 1005	C++
 	chrome.dll!BookmarkUndoService::Start(bookmarks::BookmarkModel * model) Line 350	C++
 	chrome.dll!`anonymous namespace'::BuildBookmarkModel(content::BrowserContext * context) Line 44	C++
 	chrome.dll!BookmarkModelFactory::BuildServiceInstanceFor(content::BrowserContext * context) Line 105	C++
 	keyed_service_content.dll!BrowserContextKeyedServiceFactory::BuildServiceInstanceFor(void * context) Line 94	C++
 	keyed_service_core.dll!KeyedServiceFactory::GetServiceForContext(void * context, bool create) Line 93	C++
 	keyed_service_content.dll!BrowserContextKeyedServiceFactory::GetServiceForBrowserContext(content::BrowserContext * context, bool create) Line 57	C++
 	chrome.dll!BookmarkModelFactory::GetForBrowserContext(content::BrowserContext * context) Line 54	C++
 	chrome.dll!`anonymous namespace'::BuildHistoryService(content::BrowserContext * context) Line 23	C++
 	chrome.dll!HistoryServiceFactory::BuildServiceInstanceFor(content::BrowserContext * context) Line 100	C++
 	keyed_service_content.dll!BrowserContextKeyedServiceFactory::BuildServiceInstanceFor(void * context) Line 94	C++
 	keyed_service_core.dll!KeyedServiceFactory::GetServiceForContext(void * context, bool create) Line 93	C++
 	keyed_service_content.dll!BrowserContextKeyedServiceFactory::GetServiceForBrowserContext(content::BrowserContext * context, bool create) Line 57	C++
 	chrome.dll!HistoryServiceFactory::GetForProfile(Profile * profile, ServiceAccessType sat) Line 46	C++
 	chrome.dll!ukm::UkmBackgroundRecorderService::UkmBackgroundRecorderService(Profile * profile) Line 21	C++
 	chrome.dll!ukm::UkmBackgroundRecorderFactory::BuildServiceInstanceFor(content::BrowserContext * context) Line 83	C++
 	keyed_service_content.dll!BrowserContextKeyedServiceFactory::BuildServiceInstanceFor(void * context) Line 94	C++
 	keyed_service_core.dll!KeyedServiceFactory::GetServiceForContext(void * context, bool create) Line 93	C++
 	keyed_service_content.dll!BrowserContextKeyedServiceFactory::GetServiceForBrowserContext(content::BrowserContext * context, bool create) Line 57	C++
 	chrome.dll!ukm::UkmBackgroundRecorderFactory::GetForProfile(Profile * profile) Line 68	C++
 	chrome.dll!ContentIndexProviderImpl::ContentIndexProviderImpl(Profile * profile) Line 112	C++
 	chrome.dll!ContentIndexProviderFactory::BuildServiceInstanceFor(content::BrowserContext * context) Line 38	C++
 	keyed_service_content.dll!BrowserContextKeyedServiceFactory::BuildServiceInstanceFor(void * context) Line 94	C++
 	keyed_service_core.dll!KeyedServiceFactory::GetServiceForContext(void * context, bool create) Line 93	C++
 	keyed_service_content.dll!BrowserContextKeyedServiceFactory::GetServiceForBrowserContext(content::BrowserContext * context, bool create) Line 57	C++
 	chrome.dll!ContentIndexProviderFactory::GetForProfile(Profile * profile) Line 16	C++
 	chrome.dll!ProfileImpl::GetContentIndexProvider() Line 1370	C++
 	content.dll!content::ContentIndexContextImpl::ContentIndexContextImpl(content::BrowserContext * browser_context, scoped_refptr<content::ServiceWorkerContextWrapper> service_worker_context) Line 20	C++
 	content.dll!base::MakeRefCounted<content::ContentIndexContextImpl,base::raw_ptr<content::BrowserContext,base::internal::RawPtrNoOpImpl> &,scoped_refptr<content::ServiceWorkerContextWrapper> &>(base::raw_ptr<content::BrowserContext,base::internal::RawPtrNoOpImpl> & args, scoped_refptr<content::ServiceWorkerContextWrapper> & args) Line 136	C++
 	content.dll!content::StoragePartitionImpl::Initialize(content::StoragePartitionImpl * fallback_for_blob_urls) Line 1271	C++
 	content.dll!content::StoragePartitionImplMap::Get(const content::StoragePartitionConfig & partition_config, bool can_create) Line 354	C++
 	content.dll!content::BrowserContext::GetStoragePartition(const content::StoragePartitionConfig & storage_partition_config, bool can_create) Line 138	C++
 	content.dll!content::BrowserContext::GetDefaultStoragePartition() Line 190	C++
 	chrome.dll!PageContentAnnotationsServiceFactory::BuildServiceInstanceFor(content::BrowserContext * context) Line 104	C++
 	keyed_service_content.dll!BrowserContextKeyedServiceFactory::BuildServiceInstanceFor(void * context) Line 94	C++
 	keyed_service_core.dll!KeyedServiceFactory::GetServiceForContext(void * context, bool create) Line 93	C++
 	keyed_service_content.dll!BrowserContextKeyedServiceFactory::CreateServiceNow(void * context) Line 127	C++
 	keyed_service_core.dll!DependencyManager::CreateContextServices(void * context, bool is_testing_context) Line 91	C++
 	keyed_service_content.dll!BrowserContextDependencyManager::DoCreateBrowserContextServices(content::BrowserContext * context, bool is_testing_context) Line 47	C++
 	keyed_service_content.dll!BrowserContextDependencyManager::CreateBrowserContextServices(content::BrowserContext * context) Line 32	C++
 	chrome.dll!ProfileImpl::OnLocaleReady(Profile::CreateMode create_mode) Line 1149	C++
 	chrome.dll!ProfileImpl::OnPrefsLoaded(Profile::CreateMode create_mode, bool success) Line 1190	C++
 	chrome.dll!base::internal::FunctorTraits<void (ProfileImpl::*)(Profile::CreateMode, bool),void>::Invoke<void (ProfileImpl::*)(Profile::CreateMode, bool),ProfileImpl *,Profile::CreateMode,bool>(void(ProfileImpl::*)(Profile::CreateMode, bool) method, ProfileImpl * && receiver_ptr, Profile::CreateMode && args, bool && args) Line 624	C++
 	chrome.dll!base::internal::InvokeHelper<0,void>::MakeItSo<void (ProfileImpl::*)(Profile::CreateMode, bool),ProfileImpl *,Profile::CreateMode,bool>(void(ProfileImpl::*)(Profile::CreateMode, bool) && functor, ProfileImpl * && args, Profile::CreateMode && args, bool && args) Line 801	C++
 	chrome.dll!base::internal::Invoker<base::internal::BindState<void (ProfileImpl::*)(Profile::CreateMode, bool),base::internal::UnretainedWrapper<ProfileImpl>,Profile::CreateMode>,void (bool)>::RunImpl<void (ProfileImpl::*)(Profile::CreateMode, bool),std::Cr::tuple<base::internal::UnretainedWrapper<ProfileImpl>,Profile::CreateMode>,0,1>(void(ProfileImpl::*)(Profile::CreateMode, bool) && functor, std::Cr::tuple<base::internal::UnretainedWrapper<ProfileImpl>,Profile::CreateMode> && bound, std::Cr::integer_sequence<unsigned long long,0,1>, bool && unbound_args) Line 882	C++
 	chrome.dll!base::internal::Invoker<base::internal::BindState<void (ProfileImpl::*)(Profile::CreateMode, bool),base::internal::UnretainedWrapper<ProfileImpl>,Profile::CreateMode>,void (bool)>::RunOnce(base::internal::BindStateBase * base, bool unbound_args) Line 843	C++
 	prefs.dll!base::OnceCallback<void (bool)>::Run(bool args) Line 146	C++
 	prefs.dll!PrefNotifierImpl::OnInitializationCompleted(bool succeeded) Line 125	C++
 	prefs.dll!PrefValueStore::CheckInitializationCompleted() Line 310	C++
 	prefs.dll!PrefValueStore::OnInitializationCompleted(PrefValueStore::PrefStoreType type, bool succeeded) Line 293	C++
 	prefs.dll!PrefValueStore::PrefStoreKeeper::OnInitializationCompleted(bool succeeded) Line 47	C++
 	policy_component.dll!policy::ConfigurationPolicyPrefStore::OnPolicyServiceInitialized(policy::PolicyDomain domain) Line 108	C++
 	policy_component.dll!policy::PolicyServiceImpl::MaybeNotifyPolicyDomainStatusChange(const std::Cr::vector<policy::PolicyDomain,std::Cr::allocator<policy::PolicyDomain>> & updated_domains) Line 489	C++
 	policy_component.dll!policy::PolicyServiceImpl::MergeAndTriggerUpdates() Line 434	C++
 	policy_component.dll!base::internal::FunctorTraits<void (policy::PolicyServiceImpl::*)(),void>::Invoke<void (policy::PolicyServiceImpl::*)(),base::WeakPtr<policy::PolicyServiceImpl>>(void(policy::PolicyServiceImpl::*)() method, base::WeakPtr<policy::PolicyServiceImpl> && receiver_ptr) Line 624	C++
 	policy_component.dll!base::internal::InvokeHelper<1,void>::MakeItSo<void (policy::PolicyServiceImpl::*)(),base::WeakPtr<policy::PolicyServiceImpl>>(void(policy::PolicyServiceImpl::*)() && functor, base::WeakPtr<policy::PolicyServiceImpl> && weak_ptr) Line 824	C++
 	policy_component.dll!base::internal::Invoker<base::internal::BindState<void (policy::PolicyServiceImpl::*)(),base::WeakPtr<policy::PolicyServiceImpl>>,void ()>::RunImpl<void (policy::PolicyServiceImpl::*)(),std::Cr::tuple<base::WeakPtr<policy::PolicyServiceImpl>>,0>(void(policy::PolicyServiceImpl::*)() && functor, std::Cr::tuple<base::WeakPtr<policy::PolicyServiceImpl>> && bound, std::Cr::integer_sequence<unsigned long long,0>) Line 882	C++
 	policy_component.dll!base::internal::Invoker<base::internal::BindState<void (policy::PolicyServiceImpl::*)(),base::WeakPtr<policy::PolicyServiceImpl>>,void ()>::RunOnce(base::internal::BindStateBase * base) Line 843	C++
 	base.dll!base::OnceCallback<void ()>::Run() Line 146	C++
 	base.dll!base::TaskAnnotator::RunTaskImpl(base::PendingTask & pending_task) Line 135	C++
 	base.dll!base::TaskAnnotator::RunTask<`lambda at ../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:442:29'>(perfetto::StaticString event_name, base::PendingTask & pending_task, base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl::<lambda_0> && args) Line 73	C++
 	base.dll!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow * continuation_lazy_now) Line 440	C++
 	base.dll!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() Line 297	C++
 	base.dll!base::MessagePumpForUI::DoRunLoop() Line 214	C++
 	base.dll!base::MessagePumpWin::Run(base::MessagePump::Delegate * delegate) Line 79	C++
 	base.dll!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool application_tasks_allowed, base::TimeDelta timeout) Line 602	C++
 	base.dll!base::RunLoop::Run(const base::Location & location) Line 141	C++
 	content.dll!content::BrowserMainLoop::RunMainMessageLoop() Line 1048	C++
 	content.dll!content::BrowserMainRunnerImpl::Run() Line 158	C++
 	content.dll!content::BrowserMain(content::MainFunctionParams parameters) Line 30	C++
 	content.dll!content::RunBrowserProcessMain(content::MainFunctionParams main_function_params, content::ContentMainDelegate * delegate) Line 698	C++
 	content.dll!content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams main_params, bool start_minimal_browser) Line 1232	C++
 	content.dll!content::ContentMainRunnerImpl::Run() Line 1091	C++
 	content.dll!content::RunContentProcess(content::ContentMainParams params, content::ContentMainRunner * content_main_runner) Line 342	C++
 	content.dll!content::ContentMain(content::ContentMainParams params) Line 370	C++
 	chrome.dll!ChromeMain(HINSTANCE__ * instance, sandbox::SandboxInterfaceInfo * sandbox_info, __int64 exe_entry_point_ticks) Line 182	C++
 	brave.exe!MainDllLoader::Launch(HINSTANCE__ * instance, base::TimeTicks exe_entry_point_ticks) Line 162	C++
 	brave.exe!wWinMain(HINSTANCE__ * instance, HINSTANCE__ * prev, wchar_t *, int) Line 395	C++

[emerick]

Seems to be caused by this upstream change. In particular, the BookmarkUndoService is no longer created for system profiles.

https://chromium-review.googlesource.com/c/chromium/src/+/3868533

[LaurenWags]

Adding QA/Blocked until Chromium 107 is uplifted to 1.45.x.

[kjozwiak]

The above requires 1.45.106 for 1.45.x verification 👍

[LaurenWags]

Verified with

Brave | 1.45.106 Chromium: 107.0.5304.36 (Official Build) (x86_64)
-- | --
Revision | 2f9c7a5a1fe357d87e9bc07c65cca9136b3651c5-refs/branch-heads/5304@{#671}
OS | macOS Version 12.6 (Build 21G115)

Verified STR from #26044 (comment).
Confirmed no crash when creating a new profile.
Confirmed able to create a second profile and use it to navigate to sites.
Confirmed able to close and relaunch Brave with 2 profiles, no issues relaunching.

Example	Example

[MadhaviSeelam]

Verification PASSED using

Brave | 1.45.106 Chromium: 107.0.5304.36 (Official Build) (64-bit)
-- | --
Revision | 2f9c7a5a1fe357d87e9bc07c65cca9136b3651c5-refs/branch-heads/5304@{#671}
OS | Windows 11 Version 21H2 (Build 22000.1098)

• Verified using original STR in the description
• Confirmed no crash when creating a new profile.
• Confirmed able to create a multiple profiles and use it to navigate to sites, import bookmarks and sync functionality worked as expected
• Confirmed able to close and relaunch Brave with multiple profiles, no issues relaunching.

Ex1	Ex2	Ex3

[btlechowski]

Verification passed on

Brave	1.45.108 Chromium: 107.0.5304.36 (Official Build) (64-bit)
Revision	2f9c7a5a1fe357d87e9bc07c65cca9136b3651c5-refs/branch-heads/5304@{#671}
OS	Ubuntu 18.04 LTS

Verified STR from #26044 (comment).
Confirmed no crash when creating a new profile.
Confirmed able to create a second profile and use it to navigate to sites.
Confirmed able to close and relaunch Brave with 2 profiles, no issues relaunching.

Example	Example