Exiting brave://adblock crashes webview

[Maxime-J]

Brave Version: 1.19.86 Chromium: 88.0.4324.96
Operating System: Windows NT 10.0.19042

URL (if applicable) where crash occurred:
brave://adblock
Can you reproduce this crash?
yes

What steps will reproduce this crash? (If it's not reproducible, what were you doing just before the crash?)

1. Go to brave://adblock, either via URL bar or menu
2. From that tab, go to any other website
   => RESULT_CODE_KILLED_BAD_MESSAGE crash

DO NOT CHANGE BELOW THIS LINE
Crash ID: crash/aa360100-604d-b505-0000-000000000000

[kjozwiak]

Thanks for the report @Maxime-J 👍 I managed to reproduce the issue using the following build:

Brave | 1.21.28 Chromium: 88.0.4324.96 (Official Build) nightly (64-bit)
-- | --
Revision | 68dba2d8a0b149a1d3afac56fa74648032bcf46b-refs/branch-heads/4324@{#1784}
OS | Windows 10 OS Version 2009 (Build 19042.746)

STR/Case

• launch Brave and visit brave://adblock
• in the same tab, visit another website (https://videocardz.com in this case)

Example:

[ryanbr]

cc: @antonok-edm

[antonok-edm]

Also able to reproduce in Release and Nightly on Linux.

I see this error in the console when the crash occurs:

[ERROR:bad_message.cc(26)] Terminating renderer for bad IPC message, reason 193

Navigating to another brave:// internal page does not crash.

Navigating to other schemes (e.g. file://) still crashes.

The error appears to correspond to RVH_WEB_UI_BINDINGS_MISMATCH.

[iefremov]

Example dump (the browser process only does DumpWithoutCrashing, while renderer crashes, but there is no renderer dump)
https://brave.sp.backtrace.io/p/brave/debug?filters=(_rxid%3D%2282460000-9cc8-c705-0000-000000000000%22%2C(ver%2Cregex%2C%228%5B5%7C6%7C7%7C8%7C9%5D.*%22)%2Cptype%3Dbrowser)&fingerprint=d0ac1d11f0319c90f64afc2a70d9f4d939a8f626de16505956bda322e48e1878&debug=(c2b2c7,0,0)

[ 00 ] crash_reporter::DumpWithoutCrashing()
[ 01 ] base::debug::DumpWithoutCrashing()
[ 02 ] content::RenderProcessHostImpl::ShutdownForBadMessage(content::RenderProcessHost::CrashReportMode)
[ 03 ] BraveAdblockUI::CustomizeWebUIProperties(content::RenderFrameHost*)
[ 04 ] BraveAdblockUI::UpdateWebUIProperties()
[ 05 ] content::WebContentsImpl::RenderViewReady(content::RenderViewHost*)
[ 06 ] content::(anonymous namespace)::RenderProcessHostIsReadyObserver::CallTask()

@simonhong I think calling UpdateWebUIProperties() as we do now is not 100% correct. And given that the only implementaiton is BraveAdblockUI and it is buggy, maybe we can just simplify and remove UpdateWebUIProperties()?

[simonhong]

@rebron How about disable stats showing in adblock page?
This crash comes from updating blocked stats in adblock page. I think it's redundant because NTP shows same number.

[iefremov]

Thanks @simonhong :)

[btlechowski]

Verification passed on

Brave	1.20.101 Chromium: 88.0.4324.152 (Official Build) (64-bit)
Revision	6579930fc53b4dc589c042bec9d0a3778326974d-refs/branch-heads/4324@{#2106}
OS	Ubuntu 18.04 LTS

Verified test plan from brave/brave-core#7811

Reproduced on 1.19.92:

Verified no crash on 1.20.101

---

Verification passed on

Brave | 1.20.101 Chromium: 88.0.4324.152 (Official Build) (64-bit)
-- | --
Revision | 6579930fc53b4dc589c042bec9d0a3778326974d-refs/branch-heads/4324@{#2106}
OS | Windows 10 OS Version 2004 (Build 19041.746)

• Verified the test plan from Fix renderer crash from adblock page(removed stats from adblock webui) brave-core#7811
  Reproduced the issue in 1.19.92
  

• Verified the test plan in Normal/PT/TOR tabs and ensured there is no webview crash in 1.20.101,

---

Verified passed with

Brave | 1.20.102 Chromium: 88.0.4324.152 (Official Build) (x86_64)
-- | --
Revision | 6579930fc53b4dc589c042bec9d0a3778326974d-refs/branch-heads/4324@{#2106}
OS | macOS Version 10.15.7 (Build 19H512)

Verified test plan from brave/brave-core#7811 (comment)
Verified STR from #13775 (comment)
Confirmed no crash when navigating away from brave://adblock