When using vertical tabs, pinning a tab that is part of a group crashes the browser

[Brave-Matt]

Description

This crash is consistently reproducible. Having vertical tabs enabled and attempting to pin a tab that is already part of a group crashes the browser instantly:

Screen.Recording.2024-08-01.at.9.33.32.AM.mov

Crash report (release):
3f120400-ea85-600c-0000-000000000000

Crash report (Beta):
230b0400-ea85-600c-0000-000000000000
5c0e0400-ea85-600c-0000-000000000000

Steps to reproduce

1. Enable vertical tabs in the browser
2. Ensure you have at least one tab group created
3. Attempt to pin one of those tabs

Actual result

Browser crashes

Expected result

Browser should not crash

Reproduces how often

Easily reproduced

Brave version (brave://version info)

v1.68.134

Channel information

• release (stable)
• beta
• nightly

Reproducibility

• with Brave Shields disabled
• with Brave Rewards disabled
• in the latest version of Chrome

Miscellaneous information

User report:
https://community.brave.com/t/crash-occurs-when-using-vertical-tabs-and-attempting-to-pin-a-tab-thats-part-of-a-group/559848/4

[bsclifton]

Backtrace:
https://brave.sp.backtrace.io/p/brave/debug?filters=JTVCJTVCJTIyX2RlbGV0ZWQlMjIlMkMlMjJlcXVhbCUyMiUyQyUyMjAlMjIlNUQlMkMlNUIlMjJfcnhpZCUyMiUyQyUyMmVxdWFsJTIyJTJDJTIyNDdlODA0MDAtZWE4NS02MDBjLTAwMDAtMDAwMDAwMDAwMDAwJTIyJTVEJTVE&fingerprint=239c3a8c98a77f5d90a8f9a1637b93ea2445849c1818bfa9edfa8e10c51d5999&debug=(%22817bcfe%22,0,0)

Call stack:

[ 00 ] ImmediateCrash() ( immediate_crash.h:176 )
[ 01 ] CheckFailure() ( check.h:212 )
[ 02 ] base::internal::ShouldNeverRun<std::__Cr::vector<mojo::StructPtr<brave_wallet::mojom::BlockchainToken>,std::__Cr::allocator<mojo::StructPtr<brave_wallet::mojom::BlockchainToken> > > >(std::__Cr::vector<mojo::StructPtr<brave_wallet::mojom::BlockchainToken>,std::__Cr::allocator<mojo::StructPtr<brave_wallet::mojom::BlockchainToken> > >) ( brave_player_action_icon_view.cc:87 )
[ 03 ] base::raw_ref<const TabContainerController,1>::operator->() ( raw_ref.h:206 )
[ 04 ] TabStripLayoutHelper::SlotIsCollapsedTab(int) ( tab_strip_layout_helper.cc:410 )
[ 05 ] operator new(unsigned __int64) ( new_scalar.cpp:36 )
[ 06 ] TabStripLayoutHelper::CalculateIdealBounds(std::__Cr::optional<int>) ( tab_strip_layout_helper.cc:272 )
[ 07 ] TabStripLayoutHelper::UpdateIdealBounds(int) ( tab_strip_layout_helper.cc:209 )
[ 08 ] base::internal::RawPtrBackupRefImpl<1,0>::ReportIfDangling(cc::TileManager *) ( raw_ptr_backup_ref_impl.h:430 )
[ 09 ] base::raw_ptr<cc::TileManager,1>::ReportIfDangling() ( raw_ptr.h:993 )
[ 10 ] base::internal::UnretainedWrapper<cc::TileManager,base::unretained_traits::MayNotDangle,0>::GetInternal(base::raw_ptr<cc::TileManager,1> const &) ( bind_internal.h:172 )
[ 11 ] base::internal::UnretainedWrapper<cc::TileManager,base::unretained_traits::MayNotDangle,0>::get() ( bind_internal.h:154 )
[ 12 ] base::BindUnwrapTraits<base::internal::UnretainedWrapper<cc::TileManager,base::unretained_traits::MayNotDangle,0> >::Unwrap(base::internal::UnretainedWrapper<cc::TileManager,base::unretained_traits::MayNotDangle,0> const &) ( bind_internal.h:1953 )
[ 13 ] Unwrap(base::internal::UnretainedWrapper<cc::TileManager,base::unretained_traits::MayNotDangle,0> const &) ( bind_internal.h:435 )
[ 14 ] base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (cc::TileManager::*const &)(),cc::TileManager *>,void,0>::MakeItSo(() const &,std::__Cr::tuple<base::internal::UnretainedWrapper<cc::TileManager,base::unretained_traits::MayNotDangle,0> > const &) ( bind_internal.h:930 )
[ 15 ] base::internal::Invoker<base::internal::FunctorTraits<void (cc::TileManager::*const &)(),cc::TileManager *>,base::internal::BindState<1,1,0,void (cc::TileManager::*)(),base::internal::UnretainedWrapper<cc::TileManager,base::unretained_traits::MayNotDangle,0> >,void ()>::RunImpl(() const &,std::__Cr::tuple<base::internal::UnretainedWrapper<cc::TileManager,base::unretained_traits::MayNotDangle,0> > const &,std::__Cr::integer_sequence<unsigned long long,0>) ( bind_internal.h:1067 )
[ 16 ] base::internal::Invoker<base::internal::FunctorTraits<void (cc::TileManager::*const &)(),cc::TileManager *>,base::internal::BindState<1,1,0,void (cc::TileManager::*)(),base::internal::UnretainedWrapper<cc::TileManager,base::unretained_traits::MayNotDangle,0> >,void ()>::Run(base::internal::BindStateBase *) ( bind_internal.h:980 )
[ 17 ] base::RepeatingCallback<int ()>::Run() ( callback.h:344 )
[ 18 ] TabContainerImpl::AnimateToIdealBounds() ( tab_container_impl.cc:622 )
[ 19 ] ui::AXNodeData::AddIntAttribute(ax::mojom::IntAttribute,int) ( ax_node_data.cc:525 )
[ 20 ] CompoundTabContainer::AnimateToIdealBounds() ( compound_tab_container.cc:567 )
[ 21 ] TabContainerImpl::AddTabToViewModel(Tab *,int,TabPinned) ( tab_container_impl.cc:264 )
[ 22 ] CompoundTabContainer::TransferTabBetweenContainers(int,int) ( compound_tab_container.cc:969 )
[ 23 ] BraveCompoundTabContainer::TransferTabBetweenContainers(int,int) ( brave_compound_tab_container.cc:196 )
[ 24 ] TabStrip::MoveTab(int,int,TabRendererData) ( tab_strip.cc:1158 )
[ 25 ] GURL::GURL(GURL const &) ( gurl.cc:30 )
[ 26 ] favicon::ShouldThemifyFaviconForEntry(content::NavigationEntry *) ( favicon_utils.cc:28 )
[ 27 ] operator==(absl::container_internal::raw_hash_set<absl::container_internal::FlatHashMapPolicy<const void *,std::__Cr::unique_ptr<base::SupportsUserData::Data,std::__Cr::default_delete<base::SupportsUserData::Data> > >,absl::container_internal::HashEq<const void *,void>::Hash,absl::container_internal::HashEq<const void *,void>::Eq,std::__Cr::allocator<std::__Cr::pair<const void *const,std::__Cr::unique_ptr<base::SupportsUserData::Data,std::__Cr::default_delete<base::SupportsUserData::Data> > > > >::iterator const &,absl::container_internal::raw_hash_set<absl::container_internal::FlatHashMapPolicy<const void *,std::__Cr::unique_ptr<base::SupportsUserData::Data,std::__Cr::default_delete<base::SupportsUserData::Data> > >,absl::container_internal::HashEq<const void *,void>::Hash,absl::container_internal::HashEq<const void *,void>::Eq,std::__Cr::allocator<std::__Cr::pair<const void *const,std::__Cr::unique_ptr<base::SupportsUserData::Data,std::__Cr::default_delete<base::SupportsUserData::Data> > > > >::iterator const &) ( raw_hash_set.h:2476 )
[ 28 ] operator!=(absl::container_internal::raw_hash_set<absl::container_internal::FlatHashMapPolicy<const void *,std::__Cr::unique_ptr<base::SupportsUserData::Data,std::__Cr::default_delete<base::SupportsUserData::Data> > >,absl::container_internal::HashEq<const void *,void>::Hash,absl::container_internal::HashEq<const void *,void>::Eq,std::__Cr::allocator<std::__Cr::pair<const void *const,std::__Cr::unique_ptr<base::SupportsUserData::Data,std::__Cr::default_delete<base::SupportsUserData::Data> > > > >::iterator const &,absl::container_internal::raw_hash_set<absl::container_internal::FlatHashMapPolicy<const void *,std::__Cr::unique_ptr<base::SupportsUserData::Data,std::__Cr::default_delete<base::SupportsUserData::Data> > >,absl::container_internal::HashEq<const void *,void>::Hash,absl::container_internal::HashEq<const void *,void>::Eq,std::__Cr::allocator<std::__Cr::pair<const void *const,std::__Cr::unique_ptr<base::SupportsUserData::Data,std::__Cr::default_delete<base::SupportsUserData::Data> > > > >::iterator const &) ( raw_hash_set.h:2481 )
[ 29 ] base::SupportsUserData::GetUserData(void const *) ( supports_user_data.cc:51 )
[ 30 ] 0x6f632e6576617262
[ 31 ] __libcpp_operator_delete(void *) ( new:279 )
[ 32 ] __do_deallocate_handle_size(void *,unsigned __int64) ( new:301 )
[ 33 ] __libcpp_deallocate(void *,unsigned __int64,unsigned __int64) ( new:316 )
[ 34 ] std::__Cr::allocator<web_app::TabbedModeScopeMatcher>::deallocate(web_app::TabbedModeScopeMatcher *,unsigned __int64) ( allocator.h:133 )
[ 35 ] std::__Cr::allocator_traits<std::__Cr::allocator<web_app::TabbedModeScopeMatcher> >::deallocate(std::__Cr::allocator<web_app::TabbedModeScopeMatcher> &,web_app::TabbedModeScopeMatcher *,unsigned __int64) ( allocator_traits.h:312 )
[ 36 ] std::__Cr::vector<web_app::TabbedModeScopeMatcher,std::__Cr::allocator<web_app::TabbedModeScopeMatcher> >::__destroy_vector::operator()() ( vector:493 )

[bsclifton]

Code was showing in Backtrace as crashing due to calls in Brave Player - but that was a red herring. With that code removed, it crashes due to CHECK in compound tab container

[59600:22588:0801/162022.120:FATAL:compound_tab_container.cc(65)] NOTREACHED hit.
        base::debug::CollectStackTrace [0x00007FFC4E6691E2+18] (C:\bb3\src\base\debug\stack_trace_win.cc:333)
        base::debug::StackTrace::StackTrace [0x00007FFC4E64A5BD+61] (C:\bb3\src\base\debug\stack_trace.cc:237)
        logging::LogMessage::Flush [0x00007FFC4E50DC04+244] (C:\bb3\src\base\logging.cc:715)
        logging::LogMessage::~LogMessage [0x00007FFC4E50DAA9+25] (C:\bb3\src\base\logging.cc:703)
        logging::`anonymous namespace'::NotReachedLogMessage::~NotReachedLogMessage [0x00007FFC4E4E5415+149] (C:\bb3\src\base\check.cc:143)
        logging::NotReachedNoreturnError::~NotReachedNoreturnError [0x00007FFC4E4E4DFB+11] (C:\bb3\src\base\check.cc:396)
        `anonymous namespace'::PinnedTabContainerController::IsGroupCollapsed [0x00007FFBC85F90F2+66] (C:\bb3\src\chrome\browser\ui\views\tabs\compound_tab_container.cc:65)
        TabStripLayoutHelper::SlotIsCollapsedTab [0x00007FFBC85B540E+270] (C:\bb3\src\chrome\browser\ui\views\tabs\tab_strip_layout_helper.cc:410)
        TabStripLayoutHelper::CalculateIdealBounds [0x00007FFBC85B4AE2+562] (C:\bb3\src\chrome\browser\ui\views\tabs\tab_strip_layout_helper.cc:268)
        TabStripLayoutHelper::UpdateIdealBounds [0x00007FFBC85B4DAA+106] (C:\bb3\src\chrome\browser\ui\views\tabs\tab_strip_layout_helper.cc:207)
        TabContainerImpl::AnimateToIdealBounds [0x00007FFBC85E6082+130] (C:\bb3\src\chrome\browser\ui\views\tabs\tab_container_impl.cc:622)
        CompoundTabContainer::AnimateToIdealBounds [0x00007FFBC85F590F+127] (C:\bb3\src\chrome\browser\ui\views\tabs\compound_tab_container.cc:567)
        CompoundTabContainer::TransferTabBetweenContainers [0x00007FFBC85F8278+808] (C:\bb3\src\chrome\browser\ui\views\tabs\compound_tab_container.cc:969)
        BraveCompoundTabContainer::TransferTabBetweenContainers [0x00007FFBC6A757C1+65] (C:\bb3\src\brave\browser\ui\views\tabs\brave_compound_tab_container.cc:195)
        CompoundTabContainer::MoveTab [0x00007FFBC85F34C4+740] (C:\bb3\src\chrome\browser\ui\views\tabs\compound_tab_container.cc:304)
        TabStrip::MoveTab [0x00007FFBC85BA756+310] (C:\bb3\src\chrome\browser\ui\views\tabs\tab_strip.cc:1158)
        BrowserTabStripController::OnTabStripModelChanged [0x00007FFBC85FBA0E+302] (C:\bb3\src\chrome\browser\ui\views\tabs\browser_tab_strip_controller.cc:677)
        TabStripModel::OnChange [0x00007FFBC874370C+588] (C:\bb3\src\chrome\browser\ui\tabs\tab_strip_model.cc:392)
        TabStripModel::MoveTabToIndexImpl [0x00007FFBC8745FD5+629] (C:\bb3\src\chrome\browser\ui\tabs\tab_strip_model.cc:2638)
        TabStripModel::SetTabsPinned [0x00007FFBC87525AA+202] (C:\bb3\src\chrome\browser\ui\tabs\tab_strip_model.cc:2870)
        TabStripModel::ExecuteContextMenuCommand [0x00007FFBC8750D25+2133] (C:\bb3\src\chrome\browser\ui\tabs\tab_strip_model.cc:1478)
        BrowserTabStripController::ExecuteCommandForTab [0x00007FFBC85FA4A9+89] (C:\bb3\src\chrome\browser\ui\views\tabs\browser_tab_strip_controller.cc:248)
        BraveTabContextMenuContents::ExecuteCommand [0x00007FFBC6A80BE0+112] (C:\bb3\src\brave\browser\ui\views\tabs\brave_tab_context_menu_contents.cc:151)
        ui::SimpleMenuModel::ActivatedAt [0x00007FFC49594C72+178] (C:\bb3\src\ui\base\models\simple_menu_model.cc:551)
        views::MenuModelAdapter::ExecuteCommand [0x00007FFC3AF6CC40+96] (C:\bb3\src\ui\views\controls\menu\menu_model_adapter.cc:179)
        views::internal::MenuRunnerImpl::OnMenuClosed [0x00007FFC3AF6E27E+590] (C:\bb3\src\ui\views\controls\menu\menu_runner_impl.cc:241)
        views::MenuController::ExitMenu [0x00007FFC3AF54143+115] (C:\bb3\src\ui\views\controls\menu\menu_controller.cc:3236)
        views::MenuController::ReallyAccept [0x00007FFC3AF5A763+115] (C:\bb3\src\ui\views\controls\menu\menu_controller.cc:1938)
        views::MenuController::Accept [0x00007FFC3AF560DB+155] (C:\bb3\src\ui\views\controls\menu\menu_controller.cc:1918)
        views::MenuController::OnMouseReleased [0x00007FFC3AF55D7F+1167] (C:\bb3\src\ui\views\controls\menu\menu_controller.cc:926)
        views::Widget::OnMouseEvent [0x00007FFC3B03D73A+954] (C:\bb3\src\ui\views\widget\widget.cc:1856)
        views::DesktopNativeWidgetAura::OnMouseEvent [0x00007FFC3B09777D+253] (C:\bb3\src\ui\views\widget\desktop_aura\desktop_native_widget_aura.cc:1340)
        ui::EventDispatcher::ProcessEvent [0x00007FFC6016746F+463] (C:\bb3\src\ui\events\event_dispatcher.cc:136)
        ui::EventDispatcherDelegate::DispatchEvent [0x00007FFC60167073+211] (C:\bb3\src\ui\events\event_dispatcher.cc:54)
        ui::EventProcessor::OnEventFromSource [0x00007FFC60168FE5+805] (C:\bb3\src\ui\events\event_processor.cc:21)
        ui::EventSource::DeliverEventToSink [0x00007FFC6016A56B+75] (C:\bb3\src\ui\events\event_source.cc:119)
        ui::EventSource::SendEventToSinkFromRewriter [0x00007FFC6016A456+454] (C:\bb3\src\ui\events\event_source.cc:153)
        ui::EventSource::SendEventToSink [0x00007FFC6016A280+16] (C:\bb3\src\ui\events\event_source.cc:113)
        views::DesktopWindowTreeHostWin::HandleMouseEvent [0x00007FFC3B09ED80+64] (C:\bb3\src\ui\views\widget\desktop_aura\desktop_window_tree_host_win.cc:1061)
        views::HWNDMessageHandler::HandleMouseEventInternal [0x00007FFC3B062DBB+1531] (C:\bb3\src\ui\views\win\hwnd_message_handler.cc:3284)
        views::HWNDMessageHandler::_ProcessWindowMessage [0x00007FFC3B061666+310] (C:\bb3\src\ui\views\win\hwnd_message_handler.h:0)
        views::HWNDMessageHandler::OnWndProc [0x00007FFC3B06132C+268] (C:\bb3\src\ui\views\win\hwnd_message_handler.cc:1085)
        gfx::WindowImpl::WndProc [0x00007FFC4C34FCD1+161] (C:\bb3\src\ui\gfx\win\window_impl.cc:310)
        base::win::WrappedWindowProc<&gfx::WindowImpl::WndProc> [0x00007FFC4C34F29F+15] (C:\bb3\src\base\win\wrapped_window_proc.h:77)
        DispatchMessageW [0x00007FFCC27F89A1+1857]
        DispatchMessageW [0x00007FFCC27F8461+513]
        base::MessagePumpForUI::ProcessMessageHelper [0x00007FFC4E67B5B0+784] (C:\bb3\src\base\message_loop\message_pump_win.cc:615)
        base::MessagePumpForUI::ProcessNextWindowsMessage [0x00007FFC4E67A7C8+408] (C:\bb3\src\base\message_loop\message_pump_win.cc:579)
        base::MessagePumpForUI::DoRunLoop [0x00007FFC4E67A435+165] (C:\bb3\src\base\message_loop\message_pump_win.cc:245)
        base::MessagePumpWin::Run [0x00007FFC4E679578+136] (C:\bb3\src\base\message_loop\message_pump_win.cc:84)
        base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run [0x00007FFC4E5E3237+679] (C:\bb3\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:654)
        base::RunLoop::Run [0x00007FFC4E56E103+467] (C:\bb3\src\base\run_loop.cc:136)
        content::BrowserMainLoop::RunMainMessageLoop [0x00007FFC1D59EF82+210] (C:\bb3\src\content\browser\browser_main_loop.cc:1087)
        content::BrowserMainRunnerImpl::Run [0x00007FFC1D5A1F3E+46] (C:\bb3\src\content\browser\browser_main_runner_impl.cc:161)
        content::BrowserMain [0x00007FFC1D59B810+208] (C:\bb3\src\content\browser\browser_main.cc:34)
        content::RunBrowserProcessMain [0x00007FFC1E9B7C4E+398] (C:\bb3\src\content\app\content_main_runner_impl.cc:721)
        content::ContentMainRunnerImpl::RunBrowser [0x00007FFC1E9B9673+723] (C:\bb3\src\content\app\content_main_runner_impl.cc:1302)
        content::ContentMainRunnerImpl::Run [0x00007FFC1E9B9247+695] (C:\bb3\src\content\app\content_main_runner_impl.cc:1158)
        content::RunContentProcess [0x00007FFC1E9B71C5+1573] (C:\bb3\src\content\app\content_main.cc:332)
        content::ContentMain [0x00007FFC1E9B7386+134] (C:\bb3\src\content\app\content_main.cc:345)
        ChromeMain [0x00007FFBC4761370+816] (C:\bb3\src\chrome\app\chrome_main.cc:192)
        MainDllLoader::Launch [0x00007FF64A15247D+925] (C:\bb3\src\chrome\app\main_dll_loader_win.cc:181)
        wWinMain [0x00007FF64A151969+2377] (C:\bb3\src\chrome\app\chrome_exe_main_win.cc:350)
        __scrt_common_main_seh [0x00007FF64A214526+262] (D:\agent\_work\10\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288)
        BaseThreadInitThunk [0x00007FFCC24B257D+29]
        RtlUserThreadStart [0x00007FFCC332AF28+40]

[bsclifton]

Thanks for grabbing @sangwoo108 😄

[bsclifton]

Note for QA - you'll need version 1.70.57 or higher to test this on Nightly

[LaurenWags]

Added QA/Blocked since this is being requested for uplift, we will test on version it is uplifted to.

[LaurenWags]

Requires 1.68.139 or higher to test 👍🏻

[GeetaSarvadnya]

Verification PASSED on

Brave | 1.68.141 Chromium: 127.0.6533.120 (Official Build) (64-bit)
-- | --
Revision | b3f23500b575d50584510ea1814ef440d30741a8
OS | Windows 10 Version 22H2 (Build 19045.4651)

The issue is reproducible on 1.68.137 Chromium: 127.0.6533.100

Upgraded the profile to 1.68.141 and pinned a tab/site from the tab group and ensured Brave didn't crash