Crash in Brave Browser Framework!(anonymous namespace)::OnWrite

Description

Browser was idle for ~30min and once I clicked on the window, it crashed with the following:

• https://stats.brave.com/dashboard#crash/5d8d9e247d65f2001fead1a6

Thread 0 (crashed)
 0  Brave Browser Framework!(anonymous namespace)::OnWrite(std::__1::unique_ptr<(anonymous namespace)::WriteData, std::__1::default_delete<(anonymous namespace)::WriteData> >, unsigned int) [brave_proxying_url_loader_factory.cc : 47 + 0xd]
    rax = 0x0000000000000000   rdx = 0x0000000000000000
    rcx = 0x0000000000000000   rbx = 0x00007ffeee273670
    rsi = 0x00007ffeee273670   rdi = 0x00007fc598c29c08
    rbp = 0x00007ffeee2737e0   rsp = 0x00007ffeee273670
     r8 = 0x000000000000001d    r9 = 0x0000000000000000
    r10 = 0x0000000000000000   r11 = 0x0000000000000206
    r12 = 0x00007fc59f417990   r13 = 0x00007ffeee273828
    r14 = 0x0000000000000000   r15 = 0x00007ffeee273888
    rip = 0x0000000104eea6ce
    Found by: given as instruction pointer in context
 1  Brave Browser Framework!base::internal::Invoker >, unsigned int), std::__1::unique_ptr<(anonymous namespace)::WriteData, std::__1::default_delete<(anonymous namespace)::WriteData> > >, void (unsigned int)>::RunOnce(base::internal::BindStateBase*, unsigned int) [bind_internal.h : 399 + 0x2]
    rbp = 0x00007ffeee273810   rsp = 0x00007ffeee2737f0
    rip = 0x0000000104eeb9b5
    Found by: previous frame's frame pointer
 2  Brave Browser Framework! [callback.h : 98 + 0x6]
    rbp = 0x00007ffeee273870   rsp = 0x00007ffeee273820
    rip = 0x0000000106619b71
    Found by: previous frame's frame pointer
 3  Brave Browser Framework!base::internal::Invoker, mojo::ScopedHandleBase, unsigned int), base::WeakPtr, base::OnceCallback >, void (mojo::ScopedHandleBase, unsigned int)>::RunOnce(base::internal::BindStateBase*, mojo::ScopedHandleBase&&, unsigned int) [bind_internal.h : 499 + 0x6]
    rbp = 0x00007ffeee2738c0   rsp = 0x00007ffeee273880
    rip = 0x000000010661a351
    Found by: previous frame's frame pointer
 4  Brave Browser Framework!base::internal::Invoker, unsigned int)>, mojo::ScopedHandleBase, unsigned int>, void ()>::RunOnce(base::internal::BindStateBase*) [callback.h : 98 + 0x6]
    rbp = 0x00007ffeee2738e0   rsp = 0x00007ffeee2738d0
    rip = 0x000000010661a092
    Found by: previous frame's frame pointer
 5  Brave Browser Framework! [callback.h : 98 + 0x3]
    rbp = 0x00007ffeee273990   rsp = 0x00007ffeee2738f0
    rip = 0x00000001064374ef
    Found by: previous frame's frame pointer
 6  Brave Browser Framework!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::sequence_manager::LazyNow*, bool*) [thread_controller_with_message_pump_impl.cc : 365 + 0x13]
    rbp = 0x00007ffeee273af0   rsp = 0x00007ffeee2739a0
    rip = 0x00000001064470dd
    Found by: previous frame's frame pointer
 7  Brave Browser Framework!non-virtual thunk to base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() [thread_controller_with_message_pump_impl.cc : 265 + 0xb]
    rbp = 0x00007ffeee273b40   rsp = 0x00007ffeee273b00
    rip = 0x0000000106447549
    Found by: previous frame's frame pointer
 8  Brave Browser Framework!base::MessagePumpCFRunLoopBase::RunWork() [message_pump_mac.mm : 489 + 0x6]
    rbp = 0x00007ffeee273b70   rsp = 0x00007ffeee273b50
    rip = 0x00000001063f6343
    Found by: previous frame's frame pointer
 9  Brave Browser Framework!base::mac::CallWithEHFrame(void () block_pointer) + 0xa
    rbp = 0x00007ffeee273b80   rsp = 0x00007ffeee273b80
    rip = 0x00000001063eb75a
    Found by: previous frame's frame pointer

Steps to Reproduce

• ??? (not sure, can’t reproduce)

Actual result:

Browser crashed.

Expected result:

Browser shouldn’t be crashing.

Reproduces how often:

• N/A (don’t have STR and I’m not sure how easy this issue is to reproduce)

Brave version (brave://version info)

Brave	0.69.129 Chromium: 77.0.3865.90 (Official Build) (64-bit)
Revision	58c425ba843df2918d9d4b409331972646c393dd-refs/branch-heads/3865@{#830}
OS	macOS Version 10.14.6 (Build 18G95)

Version/Channel Information:

• Can you reproduce this issue with the current release? not sure (can't reproduce)
• Can you reproduce this issue with the beta channel? not sure (can't reproduce)
• Can you reproduce this issue with the dev channel? not sure (can't reproduce)
• Can you reproduce this issue with the nightly channel? not sure (can't reproduce)

Other Additional Information:

• Does the issue resolve itself when disabling Brave Shields? N/A
• Does the issue resolve itself when disabling Brave Rewards? N/A
• Is the issue reproducible on the latest version of Chrome? N/A

Miscellaneous Information:

CCing @bsclifton

[bsclifton]

This does look to be fixed! Haven’t seen any occurrences with 0.69.132 😄

[bsclifton]

Fixes for this have been implemented - let’s keep this open and watch how things go with 0.69.x 😄