browser crashes when attaching photo in gmail

[Bill Filler]

build 154

- Save the attached photo in the bug into your ~Pictures directory on the phone
- Open gmail in the browser (or as a webbapp, doesn't make a different)
- Compose a new gmail message
- press the attach button
- select the photo under test in the gallery
- the browser is shown briefly then crashes

NOTE:
the browser only seems to crash with a bunch of photos that I copied to the device, all of their size is 2.1mb. So it may be size related. Or noticing now the orientation of the photo appears rotated when viewing on the desktop, so maybe something about the orientation? Photos taken with the camera work fine.

[Bill Filler (bfiller)]

this is error in browser log before the crash:

[0728/131359:ERROR:render_process_host_impl.cc(1437)] bad message 65594 terminating renderer.

[Olivier Tilloy (osomon)]

This is the backtrace of the webbrowser-app crash:

#0 content::RenderWidgetHostImpl::WasHidden (this=0x0)
    at ../../../../third_party/chromium/src/content/browser/renderer_host/render_widget_host_impl.cc:506
#1 0xadada442 in oxide::RenderWidgetHostView::WasHidden (this=0xb7d262a8)
    at ../../../../shared/browser/oxide_render_widget_host_view.cc:192
#2 0xadada61e in oxide::RenderWidgetHostView::~RenderWidgetHostView (
    this=0xb7d262a8, __in_chrg=<optimized out>)
    at ../../../../shared/browser/oxide_render_widget_host_view.cc:548
#3 0xadada750 in oxide::RenderWidgetHostView::~RenderWidgetHostView (
    this=0xb7d262a8, __in_chrg=<optimized out>)
    at ../../../../shared/browser/oxide_render_widget_host_view.cc:549
#4 0xaf1bd4d6 in content::RenderWidgetHostImpl::RendererExited (
    this=this@entry=0xb7c7b670,
    status=base::TERMINATION_STATUS_PROCESS_WAS_KILLED,
    exit_code=exit_code@entry=15)
    at ../../../../third_party/chromium/src/content/browser/renderer_host/render_widget_host_impl.cc:1210
#5 0xaf1b22a8 in content::RenderViewHostImpl::OnRenderProcessGone (
    this=0xb7c7b668, status=2, exit_code=15)
    at ../../../../third_party/chromium/src/content/browser/renderer_host/render_view_host_impl.cc:1139
#6 0xaf1b8d4e in DispatchToMethod<content::RenderViewHostImpl, void (content::RenderViewHostImpl::*)(int, int), int, int> (arg=..., method=
    (void (content::RenderViewHostImpl::*)(content::RenderViewHostImpl * const, int, int)) 0xaf1b227d <content::RenderViewHostImpl::OnRenderProcessGone(int, int)>, obj=0xb7c7b668) at ../../../../third_party/chromium/src/base/tuple.h:555
#7 Dispatch<content::RenderViewHostImpl, content::RenderViewHostImpl, void, void (content::RenderViewHostImpl::*)(int, int)> (sender=<optimized out>,
    parameter=0x0, func=
    (void (content::RenderViewHostImpl::*)(content::RenderViewHostImpl * const, int, int)) 0xaf1b227d <content::RenderViewHostImpl::OnRenderProcessGone(int, int)>, obj=0xb7c7b668, msg=0xbeeceef4)
    at ../../../../third_party/chromium/src/content/common/view_messages.h:1075
#8 content::RenderViewHostImpl::OnMessageReceived (this=0xb7c7b668, msg=...)
    at ../../../../third_party/chromium/src/content/browser/renderer_host/render_view_host_impl.cc:977
#9 0xaf1b1036 in content::RenderProcessHostImpl::ProcessDied (
    this=0xb7c4a138, already_dead=<optimized out>)
    at ../../../../third_party/chromium/src/content/browser/renderer_host/render_process_host_impl.cc:1939
#10 0xadb1dab6 in Run (this=0xbeecf060)
    at ../../../../third_party/chromium/src/base/callback.h:401
#11 base::MessageLoop::RunTask (this=this@entry=0xb7a29430, pending_task=...)
    at ../../../../third_party/chromium/src/base/message_loop/message_loop.cc:450
#12 0xadb1e046 in base::MessageLoop::DeferOrRunPendingTask (
    this=this@entry=0xb7a29430, pending_task=...)
    at ../../../../third_party/chromium/src/base/message_loop/message_loop.cc:462
#13 0xadb1fe74 in base::MessageLoop::DoWork (this=0xb7a29430)
    at ../../../../third_party/chromium/src/base/message_loop/message_loop.cc:576
#14 0xadabbc9c in oxide::qt::MessagePump::customEvent (this=0xb7a288a0,
    event=<optimized out>)
    at ../.....

[Chris Coulson (chrisccoulson)]

The browser crash is bug 1337338, but the real problem here is that the renderer is terminated because it sent a message that can't be serialized (from comment 2):

[0728/131359:ERROR:render_process_host_impl.cc(1437)] bad message 65594 terminating renderer.

Message 65594 is OxideHostMsg_GetUserAgentOverride. My guess is that the renderer is sending a URL that exceeds 2*1024*1024 characters, which is the limit at which the GURL ParamTraits specialization will fail to serialize the url parameter required for determining the navigator.userAgent override for the page

[Chris Coulson (chrisccoulson)]

With Oxide 1.1.1 in the phablet-team PPA, this is no longer a browser crash (but the original problem that causes the renderer to crash is still there)