(No comment was entered for this change.)

The full crash report details can be found at:
http://go/crash/reportdetail?reportid=b929a3c3c4ea352&product=Chrome&version=0.4.154.23&signature=WebCore%3A%3AScrollView%3A%3AcontentsToWindow(WebCore%3A%3AIntPoint+const+%26)-E82C44

Meta information:
Report ID: b929a3c3c4ea352
Report Time: 2008/11/21 16:52:57, Fri
Uptime: 118 sec
Cumulative Uptime: 0 sec
User Email: 
User Comments: 
Product Name: Chrome
Product Version: 0.4.154.23
OS Name: Windows NT
OS Version: 6.0.6001 Service Pack 1
CPU Architecture: x86
CPU Info: GenuineIntel family 6 model 15 stepping 11
plat: Win32
ptype: renderer

Stack Trace:

Thread 1 *CRASHED*
0x69c787e2 [chrome.dll] - scrollviewwin.cpp:648
WebCore::ScrollView::contentsToWindow(WebCore::IntPoint const &)
0x69974bd3 [chrome.dll] - scrollview.h:101
WebCore::ScrollView::contentsToWindow(WebCore::IntRect const &)
0x69e3538e [chrome.dll] - accessiblebase.cpp:445 AccessibleBase::accLocation(long
*,long *,long *,long *,tagVARIANT)
0x69e2a835 [chrome.dll] - glue_accessibility.cc:92
GlueAccessibility::GetAccessibilityInfo(WebView *,ViewMsg_Accessibility_In_Params
const &,ViewHostMsg_Accessibility_Out_Params *)
0x69ac5ccc [chrome.dll] - render_view.cc:2522
RenderView::OnGetAccessibilityInfo(ViewMsg_Accessibility_In_Params const
&,ViewHostMsg_Accessibility_Out_Params *)
0x69ac7762 [chrome.dll] - ipc_message_utils.h:1160
IPC::MessageWithReply<ViewMsg_Accessibility_In_Params,Tuple1<ViewHostMsg_Accessibility_Out_Params
&> >::Dispatch<RenderView,void ( RenderView::*)(ViewMsg_Accessibility_In_Params const
&,ViewHostMsg_Accessibility_Out_Params *)>(IPC::Message const *,RenderView *,void (
RenderView::*)(ViewMsg_Accessibility_In_Params const
&,ViewHostMsg_Accessibility_Out_Params *))
0x69ac0e31 [chrome.dll] - render_view.cc:370
RenderView::OnMessageReceived(IPC::Message const &)
0x69ae00c8 [chrome.dll] - message_router.cc:39
MessageRouter::RouteMessage(IPC::Message const &)
0x69ae009b [chrome.dll] - message_router.cc:30
MessageRouter::OnMessageReceived(IPC::Message const &)
0x69abd52c [chrome.dll] - render_thread.cc:181
RenderThread::OnMessageReceived(IPC::Message const &)
0x69adc747 [chrome.dll] - ipc_sync_channel.cc:118
IPC::SyncChannel::ReceivedSyncMsgQueue::DispatchMessages()
0x69add252 [chrome.dll] - ipc_sync_channel.cc:444 IPC::SyncChannel::WaitForReply(void *)
0x69add1d2 [chrome.dll] - ipc_sync_channel.cc:428
IPC::SyncChannel::SendWithTimeout(IPC::Message *,int)
0x69add09e [chrome.dll] - ipc_sync_channel.cc:394 IPC::SyncChannel::Send(IPC::Message *)
0x69cd8c28 [chrome.dll] - plugin_channel_base.cc:97
PluginChannelBase::Send(IPC::Message *)
0x69ad2318 [chrome.dll] - webplugin_delegate_proxy.cc:255
WebPluginDelegateProxy::Send(IPC::Message *)
0x69ad1e8c [chrome.dll] - webplugin_delegate_proxy.cc:175
WebPluginDelegateProxy::PluginDestroyed()
0x6997e339 [chrome.dll] - webplugin_impl.cc:1032
WebPluginImpl::SetContainer(WebPluginContainer *)
0x6997c398 [chrome.dll] - webplugin_impl.cc:106 WebPluginContainer::~WebPluginContainer()
0x6997c36f [chrome.dll] +0x0002c36f WebPluginContainer::`vector deleting
destructor'(unsigned int)
0x69a89872 [chrome.dll] - renderpart.cpp:56 WebCore::RenderPart::~RenderPart()
0x69a1fe98 [chrome.dll] +0x000cfe98 WebCore::RenderPartObject::`scalar deleting
destructor'(unsigned int)
0x699cee9d [chrome.dll] - renderobject.cpp:2568
WebCore::RenderObject::arenaDelete(WebCore::RenderArena *,void *)
0x69a0cef0 [chrome.dll] - renderwidget.cpp:211
WebCore::RenderWidget::deref(WebCore::RenderArena *)
0x69a0cbcf [chrome.dll] - renderwidget.cpp:102 WebCore::RenderWidget::destroy()
0x699ba0c5 [chrome.dll] - node.cpp:873 WebCore::Node::detach()
0x699eb502 [chrome.dll] - containernode.cpp:637 WebCore::ContainerNode::detach()
0x699eb502 [chrome.dll] - containernode.cpp:637 WebCore::ContainerNode::detach()
0x699eb502 [chrome.dll] - containernode.cpp:637 WebCore::ContainerNode::detach()
0x699eb502 [chrome.dll] - containernode.cpp:637 WebCore::ContainerNode::detach()
0x699eb502 [chrome.dll] - containernode.cpp:637 WebCore::ContainerNode::detach()
0x6999dea5 [chrome.dll] - document.cpp:1350 WebCore::Document::detach()
0x699a4353 [chrome.dll] - frame.cpp:223 WebCore::Frame::setView(WebCore::FrameView *)
0x6997ab2b [chrome.dll] - webframe_impl.cc:1404 WebFrameImpl::CreateFrameView()
0x6996e63f [chrome.dll] - webframeloaderclient_impl.cc:128
WebFrameLoaderClient::makeDocumentView()
0x699917b8 [chrome.dll] - frameloader.cpp:2697
WebCore::FrameLoader::transitionToCommitted(WTF::PassRefPtr<WebCore::CachedPage>)
0x69991563 [chrome.dll] - frameloader.cpp:2592
WebCore::FrameLoader::commitProvisionalLoad(WTF::PassRefPtr<WebCore::CachedPage>)
0x69998fdc [chrome.dll] - documentloader.cpp:311 WebCore::DocumentLoader::commitIfReady()
0x69999027 [chrome.dll] - documentloader.cpp:351
WebCore::DocumentLoader::commitLoad(char const *,int)
0x699e72e7 [chrome.dll] - mainresourceloader.cpp:138
WebCore::MainResourceLoader::addData(char const *,int,bool)
0x699e8420 [chrome.dll] - resourceloader.cpp:236
WebCore::ResourceLoader::didReceiveData(char const *,int,__int64,bool)
0x699e7845 [chrome.dll] - mainresourceloader.cpp:299
WebCore::MainResourceLoader::didReceiveData(char const *,int,__int64,bool)
0x699e8654 [chrome.dll] - resourceloader.cpp:367
WebCore::ResourceLoader::didReceiveData(WebCore::ResourceHandle *,char const *,int,int)
0x6998a11f [chrome.dll] - resource_handle_win.cc:560
WebCore::ResourceHandleInternal::OnReceivedData(char const *,int)
0x69ada688 [chrome.dll] - resource_dispatcher.cc:362
ResourceDispatcher::OnReceivedData(int,void *,int)
0x69ada9fa [chrome.dll] - resource_dispatcher.cc:462
ResourceDispatcher::DispatchMessageW(IPC::Message const &)
0x69ada414 [chrome.dll] - resource_dispatcher.cc:276
ResourceDispatcher::OnMessageReceived(IPC::Message const &)
0x69ac080d [chrome.dll] - render_view.cc:308
RenderView::OnMessageReceived(IPC::Message const &)
0x69ae00c8 [chrome.dll] - message_router.cc:39
MessageRouter::RouteMessage(IPC::Message const &)
0x69ae009b [chrome.dll] - message_router.cc:30
MessageRouter::OnMessageReceived(IPC::Message const &)
0x69abd52c [chrome.dll] - render_thread.cc:181
RenderThread::OnMessageReceived(IPC::Message const &)
0x69b8a71c [chrome.dll] - task.h:312 RunnableMethod<history::HistoryBackend,void (
history::HistoryBackend::*)(std::vector<history::URLRow,std::allocator<history::URLRow>
> const &),Tuple1<std::vector<history::URLRow,std::allocator<history::URLRow> > >
>::Run()
0x6995be4c [chrome.dll] - message_loop.cc:303 MessageLoop::RunTask(Task *)
0x6995be88 [chrome.dll] - message_loop.cc:311
MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const &)
0x6995c07d [chrome.dll] - message_loop.cc:403 MessageLoop::DoWork()
0x699697ed [chrome.dll] - message_pump_default.cc:50
base::MessagePumpDefault::Run(base::MessagePump::Delegate *)
0x6995bb8c [chrome.dll] - message_loop.cc:192 MessageLoop::RunInternal()
0x6995bafb [chrome.dll] - message_loop.cc:175 MessageLoop::RunHandler()
0x6995ba9e [chrome.dll] - message_loop.cc:149 MessageLoop::Run()
0x69de7cec [chrome.dll] - thread.cc:156 base::Thread::ThreadMain()
0x6995d6be [chrome.dll] - platform_thread_win.cc:28 `anonymous
namespace'::ThreadFunc(void *)
0x69efea1f [chrome.dll] - threadex.c:348 _callthreadstartex
0x69efeac4 [chrome.dll] - threadex.c:326 _threadstartex
0x76d74910 [kernel32.dll] +0x00044910 BaseThreadInitThunk
0x7781e4b5 [ntdll.dll] +0x0003e4b5 __RtlUserThreadStart
0x7781e488 [ntdll.dll] +0x0003e488 _RtlUserThreadStart

OK, this one is fairly common in 154.23 (top crasher with 5 clients/5 reports). The 
first Chrome frame on the stack is GlueAccessibility::GetAccessibilityInfo.

This is a renderer crash, so not as worrisome as a browser crash. Of course only 
really, really hardcore fans of Sad Tab like even renderer crashes.

Too bad it's just bubbled up to the top of the list today, or we could have been 
looking into this instead of issue 4559.

It looks like there is a nested message loop on the stack (note: SyncChannel::Send is 
dispatching a task).  I suspect that may result in some WebKit code being re-entered 
that didn't expect to be re-entered.  This may not be the fault of the a11y code as 
other tasks may also lead to badness in this nested scenario.

However, we might decide that we need to just bulletproof the a11y code to handle 
this situation.  Probably it is crashing because it is messing with the old FrameView 
that is being torn down inside the WebCore::Frame::setView call.

(No comment was entered for this change.)

Tied for top crasher in 0.4.154.23

New Revision: 5927

Log:
Don't reenter Webkit, while it waits for outgoing sync calls to complete. This
fixes bug http://code.google.com/p/chromium/issues/detail?id=4582, which is a crash 
in the renderer process, which occurs when the renderer receives a sync message 
requesting accessibility information from the browser, while it waits
for the PluginDestroyed sync call to unwind.

The ViewMsg_GetAccessibilityInfo has a timeout associated with it, which indicates 
that it is ok for the call to fail. We now turn off the unblock flag on the sync 
message which will ensure that it does not reenter Webkit in this scenario.

R=jcampan
Bug=4582

Review URL: http://codereview.chromium.org/12402

Modified:
  trunk/src/chrome/browser/browser_accessibility_manager.cc

The full crash report details can be found at: http://go/crash/reportdetail?
reportid=ae878195ff324cbf&product=Chrome&version=0.4.154.25&signature=WebCore%3A%3ASc
rollView%3A%3AcontentsToWindow(WebCore%3A%3AIntPoint+const+%26)-E88CCD

Merged to release r6055

actually please don't merge this yet, we're still looking into it.

(No comment was entered for this change.)

Assigning to John as he has a fix for this issue.

committed r6098

Merged into release branch r6855

Typo, r6856