[CR108] Brave crashes when removing device from the sync chain

[MadhaviSeelam]

Description

Steps to Reproduce

1. Install 1.47.75
2. launch Brave
3. set up a sync chain
4. joined the sync chain from Android
5. also joined from Profile 2 (same machine)
6. click x to remove Android device (or Profile 2)

Actual result:

Brave Crashed
Crash Report ID: | 976c0a00-b002-2209-0000-000000000000

[ 00 ] static void BraveSyncHandler::HandleDeleteDevice(const class base::Value::List & const) ( brave_sync_handler.cc:261 )
[ 01 ] aura::DefaultWindowOcclusionChangeBuilder::~DefaultWindowOcclusionChangeBuilder() ( window_occlusion_change_builder.cc:39 )
[ 02 ] url::Origin::Create(GURL const &) ( origin.cc:62 )
[ 03 ] views::NativeWidgetAura::Close() ( native_widget_aura.cc:634 )
[ 04 ] _tailMerge_esent.dll
[ 05 ] _tailMerge_esent.dll
[ 06 ] _tailMerge_esent.dll
[ 07 ] _tailMerge_esent.dll
[ 08 ] views::NativeWidgetAura::Close() ( native_widget_aura.cc:634 )
[ 09 ] _tailMerge_esent.dll
[ 10 ] _tailMerge_esent.dll
[ 11 ] views::NativeWidgetAura::Close() ( native_widget_aura.cc:634 )
[ 12 ] _tailMerge_esent.dll
[ 13 ] _tailMerge_esent.dll
[ 14 ] views::NativeWidgetAura::Close() ( native_widget_aura.cc:634 )
[ 15 ] views::NativeWidgetAura::Close() ( native_widget_aura.cc:634 )
[ 16 ] views::NativeWidgetAura::Close() ( native_widget_aura.cc:634 )
[ 17 ] url::Origin::operator<(url::Origin const &) ( origin.cc:256 )
[ 18 ] views::NativeWidgetAura::Close() ( native_widget_aura.cc:634 )
[ 19 ] std::Cr::basic_string<char,std::Cr::char_traits<char>,std::Cr::allocator<char> >::compare<std::Cr::basic_string_view<char,std::Cr::char_traits<char> > >(std::Cr::basic_string_view<char,std::Cr::char_traits<char> > const &) ( string:3909 )
[ 20 ] content::`anonymous namespace'::WebUIConfigMapWebUIControllerFactory::UseWebUIForURL(A0xA57CB5C5::BrowserContext *,GURL const &) ( webui_config_map.cc:41 )
[ 21 ] static class std::Cr::__tree_iterator<std::Cr::__value_type<std::Cr::basic_string<char,std::Cr::char_traits<char>,std::Cr::allocator<char> >,ExtensionFunctionRegistry::FactoryEntry>,std::Cr::__tree_node<std::Cr::__value_type<std::Cr::basic_string<char,std::Cr::char_traits<char>,std::Cr::allocator<char> >,ExtensionFunctionRegistry::FactoryEntry>,void *> *,long long> std::Cr::__tree<std::Cr::__value_type<std::Cr::basic_string<char,std::Cr::char_traits<char>,std::Cr::allocator<char> >,ExtensionFunctionRegistry::FactoryEntry>,std::Cr::__map_value_compare<std::Cr::basic_string<char,std::Cr::char_traits<char>,std::Cr::allocator<char> >,std::Cr::__value_type<std::Cr::basic_string<char,std::Cr::char_traits<char>,std::Cr::allocator<char> >,ExtensionFunctionRegistry::FactoryEntry>,std::Cr::less<std::Cr::basic_string<char,std::Cr::char_traits<char>,std::Cr::allocator<char> > >,1>,std::Cr::allocator<std::Cr::__value_type<std::Cr::basic_string<char,std::Cr::char_traits<char>,std::Cr::allocator<char> >,ExtensionFunctionRegistry::FactoryEntry> > >::find<std::Cr::basic_string<char,std::Cr::char_traits<char>,std::Cr::allocator<char> > >(const class std::Cr::basic_string<char,std::Cr::char_traits<char>,std::Cr::allocator<char> > & const) ( __tree:2470 )
[ 22 ] static void base::internal::Invoker<base::internal::BindState<void ((anonymous namespace)::AdblockDOMHandler::*)(const base::Value::List &),base::internal::UnretainedWrapper<(anonymous namespace)::AdblockDOMHandler,base::RawPtrBanDanglingIfSupported> >,void (const base::Value::List &)>::Run(const class base::Value::List & const) ( bind_internal.h:877 )
[ 23 ] views::NativeWidgetAura::Close() ( native_widget_aura.cc:634 )
[ 24 ] static void base::RepeatingCallback<void (CastDeviceEntryView *)>::Run(class CastDeviceEntryView *) ( callback.h:268 )
[ 25 ] content::WebUIImpl::ProcessWebUIMessage(GURL const &,std::Cr::basic_string<char,std::Cr::char_traits<char>,std::Cr::allocator<char> > const &,base::Value::List) ( web_ui_impl.cc:239 )
[ 26 ] content::ChildProcessSecurityPolicyImpl::HasWebUIBindings(int) ( child_process_security_policy_impl.cc:1468 )
[ 27 ] base::EndsWith(base::BasicStringPiece<char,std::Cr::char_traits<char> >,base::BasicStringPiece<char,std::Cr::char_traits<char> >,base::CompareCase) ( string_util.cc:277 )
[ 28 ] content::WebUIImpl::Send(std::Cr::basic_string<char,std::Cr::char_traits<char>,std::Cr::allocator<char> > const &,base::Value::List) ( web_ui_impl.cc:118 )
[ 29 ] _tailMerge_esent.dll
[ 30 ] static void allocator_shim::internal::PartitionFree(const struct allocator_shim::AllocatorDispatch *, void *, void *) ( allocator_shim_default_dispatch_to_partition_alloc.cc:441 )
[ 31 ] absl::variant_internal::VisitIndicesSwitch<8>::Run<absl::variant_internal::VariantStateBaseDestructorNontrivial<absl::monostate,bool,int,base::Value::DoubleStorage,std::Cr::basic_string<char,std::Cr::char_traits<char>,std::Cr::allocator<char> >,std::Cr::vector<unsigned char,std::Cr::allocator<unsigned char> >,base::Value::Dict,base::Value::List>::Destroyer>(absl::variant_internal::VariantStateBaseDestructorNontrivial<absl::monostate,bool,int,base::Value::DoubleStorage,std::Cr::basic_string<char,std::Cr::char_traits<char>,std::Cr::allocator<char> >,std::Cr::vector<unsigned char,std::Cr::allocator<unsigned char> >,base::Value::Dict,base::Value::List>::Destroyer &&,unsigned __int64) ( variant.h:429 )
[ 32 ] base::Value::List::Append(base::Value &&) ( values.cc:943 )
[ 33 ] absl::variant_internal::VisitIndicesSwitch<8>::Run<absl::variant_internal::VariantStateBaseDestructorNontrivial<absl::monostate,bool,int,base::Value::DoubleStorage,std::Cr::basic_string<char,std::Cr::char_traits<char>,std::Cr::allocator<char> >,std::Cr::vector<unsigned char,std::Cr::allocator<unsigned char> >,base::Value::Dict,base::Value::List>::Destroyer>(absl::variant_internal::VariantStateBaseDestructorNontrivial<absl::monostate,bool,int,base::Value::DoubleStorage,std::Cr::basic_string<char,std::Cr::char_traits<char>,std::Cr::allocator<char> >,std::Cr::vector<unsigned char,std::Cr::allocator<unsigned char> >,base::Value::Dict,base::Value::List>::Destroyer &&,unsigned __int64) ( variant.h:429 )
[ 34 ] mojo::StructTraits<mojo_base::mojom::ListValueDataView,base::Value::List>::Read(mojo_base::mojom::ListValueDataView,base::Value::List *) ( values_mojom_traits.cc:42 )
[ 35 ] _tailMerge_esent.dll
[ 36 ] content::mojom::WebUIHostStubDispatch::Accept(content::mojom::WebUIHost *,mojo::Message *) ( web_ui.mojom.cc:204 )
[ 37 ] mojo_base::mojom::internal::ListValue_Data::Validate(void const *,mojo::internal::ValidationContext *) ( values.mojom-shared.cc:190 )
[ 38 ] mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message *) ( interface_endpoint_client.cc:930 )
[ 39 ] mojo::internal::ValidateRequestGeneric(mojo::Message *,char const *,base::span<std::Cr::pair<unsigned int,mojo::internal::GenericValidationInfo> const ,-1>) ( generated_code_util.cc:98 )
[ 40 ] _tailMerge_esent.dll
[ 41 ] _tailMerge_esent.dll
[ 42 ] mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message *) ( interface_endpoint_client.cc:689 )
[ 43 ] _tailMerge_esent.dll

Expected result:

Brave should not crash

Reproduces how often:

Easily

Brave version (brave://version info)

Brave	1.47.75 Chromium: 108.0.5359.40 (Official Build) nightly (64-bit)
Revision	280b5fcaab3e877562b06cfaf2eb51121e13c3b9-refs/branch-heads/5359@{#689}
OS	Windows 11 Version 21H2 (Build 22000.1219)

Version/Channel Information:

• Can you reproduce this issue with the current release? No
• Can you reproduce this issue with the beta channel? No
• Can you reproduce this issue with the nightly channel? Yes

Other Additional Information:

• Does the issue resolve itself when disabling Brave Shields?
• Does the issue resolve itself when disabling Brave Rewards?
• Is the issue reproducible on the latest version of Chrome?

Miscellaneous Information:

@mkarolin @rebron

[GeetaSarvadnya]

Reproduced on Windows 10 x64 - 1.47.75

[GeetaSarvadnya]

The issue doesn't reproduce in Windows 10x64 - 1.47.72 Chromium: 107.0.5304.110 version but it's reproducible in 1.47.75 Chromium: 108.0.5359.40 Looks like CR 108 Chromium bump issue.

[MadhaviSeelam]

Verification PASSED using

Brave | 1.46.123 Chromium: 108.0.5359.48 (Official Build) beta (64-bit)
-- | --
Revision | 18ceeca0d99318e70c00d2e04d88aa55488b5c63-refs/branch-heads/5359@{#854}
OS | Windows 11 Version 21H2 (Build 22000.1219)

Verified using original STR from the description #26811 (comment)

Confirmed no crashes occurred when devices (Android and Profile 2) were removed from the Sync chain

Sync chain	removed Profile 2	removed Android device

[stephendonner]

Verified PASSED using

Brave	1.46.126 Chromium: 108.0.5359.48 (Official Build) beta (x86_64)
Revision	18ceeca0d99318e70c00d2e04d88aa55488b5c63-refs/branch-heads/5359@{#854}
OS	macOS Version 11.7.1 (Build 20G918)

After verifying #26805 (comment), I played around with Delete / X and experienced no crashes