Crash during drag&drop

[hethsron]

Hello

Our product integrates CEF in osr mode
A crash has been reported by a tool that collects automatically some data (stack, minidump) when a CoreDump occurs. This CD is present on different versions of CEF we’ve integrated up to now, 94 and 97 at least.
This crash happens time to time to different customers (we’ve received about 20 occurences) but we’ve never succeded to reproduce it at dev team.

The stack of the crash, based on CEF 94.2453 is

WeakPtrFactory<net::DnsConfigService>::GetWeakPtr+ 0x19 [o:\base\memory\weak_ptr.h (328) ]
CefBrowserPlatformDelegateOsr::DragTargetDragEnter+ 0xd4 [o:\cef\libcef\browser\osr\browser_platform_delegate_osr.cc (300) ]
AlloyBrowserHostImpl::DragTargetDragEnter+ 0x99 [o:\cef\libcef\browser\alloy\alloy_browser_host_impl.cc (974) ]
base::TaskAnnotator::RunTask+ 0x17e [o:\base\task\common\task_annotator.cc (178) ]
…

The unhandled exception based on the minidump is : 0xC0000005: Access violation reading location 0x0000000000000800.

The call that causes the crash
current_rwh_for_drag_ =
web_contents->GetInputEventRouter()
->GetRenderWidgetHostAtPoint(
web_contents->GetRenderViewHost()->GetWidget()->GetView(),
gfx::PointF(client_pt), &transformed_pt)
->GetWeakPtr();

I suppose the scenario is obviously about Drag&Drop and the returned object of call to GetRenderWidgetHostAtPoint in method CefBrowserPlatformDelegateOsr::DragTargetDragEnter is invalid but not sure at all.

Does someone has any idea about this crash ?

[magreenblatt]

Looks like a null dereference. Maybe GetRenderWidgetHostAtPoint is returning nullptr.

[aligre]

Hello Marshall,

Thanks for the answer

"Maybe GetRenderWidgetHostAtPoint is returning nullptr." : do you know a scenario that can lead to such case ?

Also, what do you think of preventing the crash thanks to an immediate return in CefBrowserPlatformDelegateOsr::DragTargetDragEnter if GetRenderWidgetHostAtPoint is returning null.
Something like below :

Code: Select all

  RenderWidgetHostImpl * local_current_rwh_for_drag =
      web_contents->GetInputEventRouter()
          ->GetRenderWidgetHostAtPoint(
              web_contents->GetRenderViewHost()->GetWidget()->GetView(),
              gfx::PointF(client_pt), &transformed_pt);
  if (!local_current_rwh_for_drag)
    return;
  current_rvh_for_drag_ = local_current_rwh_for_drag->GetWeakPtr();

[magreenblatt]

do you know a scenario that can lead to such case ?

Sorry, I don't know.

what do you think of preventing the crash thanks to an immediate return in CefBrowserPlatformDelegateOsr::DragTargetDragEnter if GetRenderWidgetHostAtPoint is returning null.

That sounds reasonable, if it fixes the crash. Can you try it and report back?

[hethsron]

Hello Marshall,

Thanks for this advice. We will try to implement this fix and let you know as soon as possible if it fix this behavior.