Brave crashed after relaunch once split view is enabled

[MadhaviSeelam]

Description

Found while verifying #43802 (comment). Could not reproduce the issue

Steps to reproduce

1. Install 1.76.55
2. Launch Brave and relaunch
3. open few tabs and enable vertical tab view
4. enable split view via tab context menu
5. click Swap tab positions via Split view menu button
6. closed & relaunched Brave

Actual result

Crash happened

Status:	Uploaded
Uploaded Crash Report ID:	33db1a00-6cbf-590d-0000-000000000000
Upload Time:	Tuesday, February 11, 2025 at 2:09:14 PM

EXCEPTION_ILLEGAL_INSTRUCTION in std::__Cr::vector<views::ChildLayout,std::__Cr::allocator<views::ChildLayout> >::__construct_one_at_end
[ 00 ] std::__Cr::vector<views::ChildLayout,std::__Cr::allocator<views::ChildLayout> >::__construct_one_at_end(views::View * &,bool &&,gfx::Rect &&,views::SizeBounds &&) ( vector.h:732 )
[ 01 ] views::View::GetMirroredRect(gfx::Rect const &) ( view.cc:888 )
[ 02 ] SplitViewLayoutManager::CalculateProposedLayout(views::SizeBounds const &) ( split_view_layout_manager.cc:0 )
[ 03 ] views::LayoutManagerBase::Layout(views::View *) ( layout_manager_base.cc:118 )
[ 04 ] views::View::Layout(base::NonCopyablePassKey<views::View>) ( view.cc:921 )
[ 05 ] views::View::LayoutSuperclass(SplitView *) ( view.h:1895 )
[ 06 ] SplitView::Layout(base::NonCopyablePassKey<views::View>) ( split_view.cc:194 )
[ 07 ] base::SampleVectorBase::GetBucketIndex(int) ( sample_vector.cc:404 )
[ 08 ] views::View::LayoutImmediately() ( view.cc:3515 )
[ 09 ] views::View::SetBoundsRect(gfx::Rect const &) ( view.cc:459 )
[ 10 ] BrowserViewLayout::LayoutContentsContainerView(int,int) ( browser_view_layout.cc:742 )
[ 11 ] BraveBrowserViewLayout::LayoutContentsContainerView(int,int) ( brave_browser_view_layout.cc:225 )
[ 12 ] BrowserViewLayout::Layout(views::View *) ( browser_view_layout.cc:454 )
[ 13 ] BraveBrowserViewLayout::Layout(views::View *) ( brave_browser_view_layout.cc:103 )
[ 14 ] views::View::Layout(base::NonCopyablePassKey<views::View>) ( view.cc:921 )
[ 15 ] views::View::LayoutSuperclass(BrowserView *) ( view.h:1895 )
[ 16 ] BrowserView::Layout(base::NonCopyablePassKey<views::View>) ( browser_view.cc:4560 )
[ 17 ] views::View::LayoutSuperclass(BraveBrowserView *) ( view.h:1895 )
[ 18 ] BraveBrowserView::Layout(base::NonCopyablePassKey<views::View>) ( brave_browser_view.cc:969 )
[ 19 ] base::SampleVectorBase::GetBucketIndex(int) ( sample_vector.cc:404 )
[ 20 ] views::View::LayoutImmediately() ( view.cc:3515 )
[ 21 ] views::View::SetBoundsRect(gfx::Rect const &) ( view.cc:459 )
[ 22 ] views::NonClientFrameView::Layout(base::NonCopyablePassKey<views::View>) ( non_client_view.cc:132 )
[ 23 ] views::View::LayoutSuperclass(BrowserFrameViewWin *) ( view.h:1895 )
[ 24 ] BrowserFrameViewWin::Layout(base::NonCopyablePassKey<views::View>) ( browser_frame_view_win.cc:486 )
[ 25 ] base::SampleVectorBase::GetBucketIndex(int) ( sample_vector.cc:404 )
[ 26 ] views::View::LayoutImmediately() ( view.cc:3515 )
[ 27 ] views::View::SetBoundsRect(gfx::Rect const &) ( view.cc:459 )
[ 28 ] views::NonClientView::Layout(base::NonCopyablePassKey<views::View>) ( non_client_view.cc:300 )
[ 29 ] base::SampleVectorBase::GetBucketIndex(int) ( sample_vector.cc:404 )
[ 30 ] views::View::LayoutImmediately() ( view.cc:3515 )
[ 31 ] views::View::SetBoundsRect(gfx::Rect const &) ( view.cc:459 )
[ 32 ] views::LayoutManagerBase::ApplyLayout(views::ProposedLayout const &) ( layout_manager_base.cc:234 )
[ 33 ] views::View::Layout(base::NonCopyablePassKey<views::View>) ( view.cc:911 )
[ 34 ] views::View::LayoutImmediately() ( view.cc:3515 )
[ 35 ] views::View::SetBoundsRect(gfx::Rect const &) ( view.cc:459 )
[ 36 ] views::View::SetSize(gfx::Size const &) ( view.cc:500 )
[ 37 ] views::Widget::OnNativeWidgetSizeChanged(gfx::Size const &) ( widget.cc:1894 )
[ 38 ] views::DesktopNativeWidgetAura::OnHostResized(aura::WindowTreeHost *) ( desktop_native_widget_aura.cc:1558 )
[ 39 ] __invoke((aura::WindowTreeHost *) &,aura::WindowTreeHostObserver &,aura::WindowTreeHost * const &) ( invoke.h:103 )
[ 40 ] invoke((aura::WindowTreeHost *) &,aura::WindowTreeHostObserver &,aura::WindowTreeHost * const &) ( invoke.h:29 )
[ 41 ] base::ObserverList<aura::WindowTreeHostObserver,0,1,base::internal::UncheckedObserverAdapter<0,0> >::Notify<void (aura::WindowTreeHostObserver::*)(aura::WindowTreeHost *),aura::WindowTreeHost *>((aura::WindowTreeHost *),aura::WindowTreeHost * const &) ( observer_list.h:397 )
[ 42 ] aura::WindowTreeHost::UpdateCompositorScaleAndSize(gfx::Size const &) ( window_tree_host.cc:219 )
[ 43 ] aura::WindowTreeHost::OnHostResizedInPixels(gfx::Size const &) ( window_tree_host.cc:615 )
[ 44 ] views::HWNDMessageHandler::ClientAreaSizeChanged() ( hwnd_message_handler.cc:1571 )
[ 45 ] views::HWNDMessageHandler::OnWindowPosChanged(tagWINDOWPOS *) ( hwnd_message_handler.cc:3050 )
[ 46 ] views::HWNDMessageHandler::_ProcessWindowMessage(HWND__ *,unsigned int,unsigned __int64,__int64,__int64 &,unsigned long) ( hwnd_message_handler.h:488 )
[ 47 ] views::HWNDMessageHandler::OnWndProc(unsigned int,unsigned __int64,__int64) ( hwnd_message_handler.cc:1110 )
[ 48 ] gfx::WindowImpl::WndProc(HWND__ *,unsigned int,unsigned __int64,__int64) ( window_impl.cc:311 )
[ 49 ] base::win::WrappedWindowProc<&gfx::WindowImpl::WndProc>(HWND__ *,unsigned int,unsigned __int64,__int64) ( wrapped_window_proc.h:77 )
[ 50 ] UserCallWinProcCheckWow(struct _ACTIVATION_CONTEXT *,__int64 (*)(struct tagWND *,unsigned int,unsigned __int64,__int64),struct HWND__ *,enum _WM_VALUE,unsigned __int64,__int64,void *,int)
[ 51 ] DispatchClientMessage
[ 52 ] __fnINLPWINDOWPOS
[ 53 ] KiUserCallbackDispatch
[ 54 ] NtUserMessageCall
[ 55 ] RealDefWindowProcWorker
[ 56 ] RealDefWindowProcW(struct HWND__ *,unsigned int,unsigned __int64,__int64)
[ 57 ] DoMsgDefault(struct _THEME_MSG const *)
[ 58 ] OnDwpSysCommand(class CThemeWnd *,struct _THEME_MSG *)
[ 59 ] _ThemeDefWindowProc(struct HWND__ *,unsigned int,unsigned __int64,__int64,int)
[ 60 ] ThemeDefWindowProcW
[ 61 ] DefWindowProcW
[ 62 ] scoped_refptr<const base::internal::WeakReference::Flag>::scoped_refptr(base::internal::WeakReference::Flag const *) ( scoped_refptr.h:248 )
[ 63 ] views::HWNDMessageHandler::OnSysCommand(unsigned int,gfx::Point const &) ( hwnd_message_handler.cc:2840 )
[ 64 ] views::HWNDMessageHandler::_ProcessWindowMessage(HWND__ *,unsigned int,unsigned __int64,__int64,__int64 &,unsigned long) ( hwnd_message_handler.h:484 )
[ 65 ] views::HWNDMessageHandler::OnWndProc(unsigned int,unsigned __int64,__int64) ( hwnd_message_handler.cc:1110 )
[ 66 ] gfx::WindowImpl::WndProc(HWND__ *,unsigned int,unsigned __int64,__int64) ( window_impl.cc:311 )
[ 67 ] base::win::WrappedWindowProc<&gfx::WindowImpl::WndProc>(HWND__ *,unsigned int,unsigned __int64,__int64) ( wrapped_window_proc.h:77 )
[ 68 ] UserCallWinProcCheckWow(struct _ACTIVATION_CONTEXT *,__int64 (*)(struct tagWND *,unsigned int,unsigned __int64,__int64),struct HWND__ *,enum _WM_VALUE,unsigned __int64,__int64,void *,int)
[ 69 ] SendMessageWorker
[ 70 ] SendMessageInternal(struct HWND__ *,unsigned int,unsigned __int64,__int64,int)
[ 71 ] SendMessageW
[ 72 ] views::DesktopNativeWidgetAura::Minimize() ( desktop_native_widget_aura.cc:1035 )
[ 73 ] base::RepeatingCallback<void ()>::Run() ( callback.h:345 )
[ 74 ] views::Button::NotifyClick(ui::Event const &) ( button.cc:728 )
[ 75 ] std::__Cr::unique_ptr<views::ButtonControllerDelegate,std::__Cr::default_delete<views::ButtonControllerDelegate> >::operator->() ( unique_ptr.h:280 )
[ 76 ] views::ButtonController::OnMouseReleased(ui::MouseEvent const &) ( button_controller.cc:0 )
[ 77 ] ui::ScopedTargetHandler::OnEvent(ui::Event *) ( scoped_target_handler.cc:32 )
[ 78 ] ui::EventDispatcher::DispatchEvent(ui::EventHandler *,ui::Event *) ( event_dispatcher.cc:188 )
[ 79 ] ui::EventDispatcherDelegate::DispatchEventToTarget(ui::EventTarget *,ui::Event *) ( event_dispatcher.cc:90 )
[ 80 ] ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget *,ui::Event *) ( event_dispatcher.cc:54 )
[ 81 ] views::internal::RootView::OnMouseReleased(ui::MouseEvent const &) ( root_view.cc:630 )
[ 82 ] views::Widget::OnMouseEvent(ui::MouseEvent *) ( widget.cc:2017 )
[ 83 ] views::DesktopNativeWidgetAura::OnMouseEvent(ui::MouseEvent *) ( desktop_native_widget_aura.cc:1386 )
[ 84 ] ui::EventDispatcher::DispatchEvent(ui::EventHandler *,ui::Event *) ( event_dispatcher.cc:188 )
[ 85 ] ui::EventDispatcherDelegate::DispatchEventToTarget(ui::EventTarget *,ui::Event *) ( event_dispatcher.cc:90 )
[ 86 ] ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget *,ui::Event *) ( event_dispatcher.cc:54 )
[ 87 ] ui::EventProcessor::OnEventFromSource(ui::Event *) ( event_processor.cc:21 )
[ 88 ] ui::EventSource::DeliverEventToSink(ui::Event *) ( event_source.cc:119 )
[ 89 ] ui::EventSource::SendEventToSinkFromRewriter(ui::Event const *,ui::EventRewriter const *) ( event_source.cc:134 )
[ 90 ] ui::EventSource::SendEventToSink(ui::Event const *) ( event_source.cc:113 )
[ 91 ] views::DesktopWindowTreeHostWin::HandleMouseEvent(ui::MouseEvent *) ( desktop_window_tree_host_win.cc:1143 )
[ 92 ] views::HWNDMessageHandler::HandleMouseEventInternal(unsigned int,unsigned __int64,__int64,bool) ( hwnd_message_handler.cc:3298 )
[ 93 ] base::AtomicFlag::IsSet() ( atomic_flag.h:37 )
[ 94 ] base::internal::WeakReference::Flag::IsValid() ( weak_ptr.cc:39 )
[ 95 ] views::HWNDMessageHandler::_ProcessWindowMessage(HWND__ *,unsigned int,unsigned __int64,__int64,__int64 &,unsigned long) ( hwnd_message_handler.h:0 )
[ 96 ] views::HWNDMessageHandler::OnWndProc(unsigned int,unsigned __int64,__int64) ( hwnd_message_handler.cc:1110 )
[ 97 ] gfx::WindowImpl::WndProc(HWND__ *,unsigned int,unsigned __int64,__int64) ( window_impl.cc:311 )
[ 98 ] base::win::WrappedWindowProc<&gfx::WindowImpl::WndProc>(HWND__ *,unsigned int,unsigned __int64,__int64) ( wrapped_window_proc.h:77 )
[ 99 ] UserCallWinProcCheckWow(struct _ACTIVATION_CONTEXT *,__int64 (*)(struct tagWND *,unsigned int,unsigned __int64,__int64),struct HWND__ *,enum _WM_VALUE,unsigned __int64,__int64,void *,int)
[ 100 ] DispatchMessageWorker
[ 101 ] base::MessagePumpForUI::ProcessMessageHelper(tagMSG const &) ( message_pump_win.cc:630 )
[ 102 ] base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoIdleWork() ( thread_controller_with_message_pump_impl.cc:602 )
[ 103 ] base::MessagePumpForUI::DoRunLoop() ( message_pump_win.cc:251 )
[ 104 ] base::MessagePumpWin::Run(base::MessagePump::Delegate *) ( message_pump_win.cc:89 )
[ 105 ] base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool,base::TimeDelta) ( thread_controller_with_message_pump_impl.cc:648 )
[ 106 ] base::RunLoop::Run(base::Location const &) ( run_loop.cc:136 )
[ 107 ] content::BrowserMainLoop::RunMainMessageLoop() ( browser_main_loop.cc:1094 )
[ 108 ] content::BrowserMainRunnerImpl::Run() ( browser_main_runner_impl.cc:156 )
[ 109 ] content::BrowserMain(content::MainFunctionParams) ( browser_main.cc:34 )
[ 110 ] RunBrowserProcessMain(content::MainFunctionParams,content::ContentMainDelegate *) ( content_main_runner_impl.cc:714 )
[ 111 ] content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams,bool) ( content_main_runner_impl.cc:1292 )
[ 112 ] content::ContentMainRunnerImpl::Run() ( content_main_runner_impl.cc:1144 )
[ 113 ] RunContentProcess(content::ContentMainParams,content::ContentMainRunner *) ( content_main.cc:348 )
[ 114 ] content::ContentMain(content::ContentMainParams) ( content_main.cc:361 )
[ 115 ] ChromeMain(HINSTANCE__ *,sandbox::SandboxInterfaceInfo *,__int64,__int64,__int64) ( chrome_main.cc:224 )
[ 116 ] 0x7ff7bf38a74f
[ 117 ] 0x7ff7bf5cf320
[ 118 ] 0x7ff7bf5fcd13
[ 119 ] LoadLibraryExW

Expected result

Brave should not crash

Reproduces how often

Intermittent issue

Brave version (brave://version info)

Brave	1.76.55 Chromium: 133.0.6943.54 (Official Build) beta (64-bit)
Revision	8b59c06a32ec3a53b2caada1e6c43c3e5c35d64f
OS	Windows 11 Version 24H2 (Build 26100.2894)

Channel information

• release (stable)
• beta
• nightly

Reproducibility

• with Brave Shields disabled
• with Brave Rewards disabled
• in the latest version of Chrome

Miscellaneous information

@rebron @simonhong
cc: @brave/qa-team