崩溃信息

dump 原始堆栈

WARNING: Continuing a non-continuable exception
(2978.5e4): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00b5f130 ebx=0b746000 ecx=00000000 edx=00b5f278 esi=0b746000 edi=00b5f220
eip=116b5c90 esp=00b5f0b8 ebp=00b5f0d8 iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
libcef!ui::Compositor::SetScaleAndSize+0xe:
116b5c90 f30f1089c4000000 movss   xmm1,dword ptr [ecx+0C4h] ds:002b:000000c4=????????
0:000> k
 # ChildEBP RetAddr      
00 00b5f0d8 116b48a3     libcef!ui::Compositor::SetScaleAndSize+0xe [e:\cef\code\code_3626\chromium_git\chromium\src\ui\compositor\compositor.cc @ 360] 
01 00b5f210 1289b9c0     libcef!aura::WindowTreeHost::OnHostResizedInPixels+0xef [e:\cef\code\code_3626\chromium_git\chromium\src\ui\aura\window_tree_host.cc @ 461] 
02 00b5f25c 132e4429     libcef!views::DesktopWindowTreeHostWin::HandleClientSizeChanged+0x46 [e:\cef\code\code_3626\chromium_git\chromium\src\ui\views\widget\desktop_aura\desktop_window_tree_host_win.cc @ 874] 
03 00b5f294 132e685a     libcef!views::HWNDMessageHandler::ClientAreaSizeChanged+0x4f [e:\cef\code\code_3626\chromium_git\chromium\src\ui\views\win\hwnd_message_handler.cc @ 1364] 
04 00b5f2a4 132e2885     libcef!views::HWNDMessageHandler::OnWindowPosChanged+0x1e [e:\cef\code\code_3626\chromium_git\chromium\src\ui\views\win\hwnd_message_handler.cc @ 2753] 
05 00b5f2e0 132e1a9d     libcef!views::HWNDMessageHandler::_ProcessWindowMessage+0xcd9 [e:\cef\code\code_3626\chromium_git\chromium\src\ui\views\win\hwnd_message_handler.h @ 428] 
06 00b5f324 11a2b79f     libcef!views::HWNDMessageHandler::OnWndProc+0x79 [e:\cef\code\code_3626\chromium_git\chromium\src\ui\views\win\hwnd_message_handler.cc @ 979] 
07 00b5f344 11a2b32d     libcef!gfx::WindowImpl::WndProc+0x53 [e:\cef\code\code_3626\chromium_git\chromium\src\ui\gfx\win\window_impl.cc @ 303] 
08 00b5f384 7754eebb     libcef!base::win::WrappedWindowProc<&gfx::WindowImpl::WndProc>+0x50 [e:\cef\code\code_3626\chromium_git\chromium\src\base\win\wrapped_window_proc.h @ 79] 
09 00b5f3b0 77545e7a     USER32!_InternalCallWinProc+0x2b
0a 00b5f494 77545a7a     USER32!UserCallWinProcCheckWow+0x33a
0b 00b5f4f8 7754ce97     USER32!DispatchClientMessage+0xea
0c 00b5f538 77e84e7d     USER32!__fnINLPWINDOWPOS+0x37
0d 00b5f588 75db124c     ntdll!KiUserCallbackDispatcher+0x4d
0e 00b5f58c 132e1dcd     win32u!NtUserSetWindowPos+0xc
0f 00b5f5e0 132e1a9d     libcef!views::HWNDMessageHandler::_ProcessWindowMessage+0x221 [e:\cef\code\code_3626\chromium_git\chromium\src\ui\views\win\hwnd_message_handler.h @ 401] 
10 00b5f624 11a2b79f     libcef!views::HWNDMessageHandler::OnWndProc+0x79 [e:\cef\code\code_3626\chromium_git\chromium\src\ui\views\win\hwnd_message_handler.cc @ 979] 
11 00b5f644 11a2b32d     libcef!gfx::WindowImpl::WndProc+0x53 [e:\cef\code\code_3626\chromium_git\chromium\src\ui\gfx\win\window_impl.cc @ 303] 
12 00b5f684 7754eebb     libcef!base::win::WrappedWindowProc<&gfx::WindowImpl::WndProc>+0x50 [e:\cef\code\code_3626\chromium_git\chromium\src\base\win\wrapped_window_proc.h @ 79] 
13 00b5f6b0 77545e7a     USER32!_InternalCallWinProc+0x2b
14 00b5f794 77543bea     USER32!UserCallWinProcCheckWow+0x33a
15 00b5f808 775439b0     USER32!DispatchMessageWorker+0x22a
16 00b5f814 1133bf30     USER32!DispatchMessageW+0x10
17 00b5f880 1133b97f     libcef!base::MessagePumpForUI::ProcessMessageHelper+0x2e0 [e:\cef\code\code_3626\chromium_git\chromium\src\base\message_loop\message_pump_win.cc @ 380] 
18 00b5f8bc 1133b4c1     libcef!base::MessagePumpForUI::DoRunLoop+0x4f [e:\cef\code\code_3626\chromium_git\chromium\src\base\message_loop\message_pump_win.cc @ 176] 
19 00b5f8dc 11a0635f     libcef!base::MessagePumpWin::Run+0x41 [e:\cef\code\code_3626\chromium_git\chromium\src\base\message_loop\message_pump_win.cc @ 55] 
1a 00b5f8ec 11354e0e     libcef!base::MessageLoopImpl::Run+0x1f [e:\cef\code\code_3626\chromium_git\chromium\src\base\message_loop\message_loop_impl.cc @ 302] 
1b 00b5f8fc 112b4d36     libcef!base::RunLoop::Run+0x2e [e:\cef\code\code_3626\chromium_git\chromium\src\base\run_loop.cc @ 108] 
1c 00b5f924 00dabe95     libcef!CefRunMessageLoop+0x43 [e:\cef\code\code_3626\chromium_git\chromium\src\cef\libcef\browser\context.cc @ 308] 
WARNING: Stack unwind information not available. Following frames may be wrong.
omit......

看崩溃当前堆栈,位于 ui 合成器部分 ui::Compositor。 这是一个用于 GPU 合成绘制的类,renderer 进程在生成一帧绘制命令后,交给 browser 进程的 compositor 对象进行 GPU 渲染。 这里 ecx 寄存器为 0,应该是 compositor 对象指针被置空。

跟随堆栈,compositor 对象生命周期由 aura::WindowTreeHost 类管理,

void WindowTreeHost::OnHostResizedInPixels(
    const gfx::Size& new_size_in_pixels,
    const viz::LocalSurfaceIdAllocation& new_local_surface_id_allocation) {
  // ...
  ScopedLocalSurfaceIdValidator lsi_validator(window());
  compositor_->SetScaleAndSize(device_scale_factor_, new_size_in_pixels,
                               local_surface_id_allocation);

  //...
}

可以看到,这里 compositor_ 指针没有判空,直接导致了崩溃。但是需要排查是什么导致了 compositor 对象在销毁后, window_tree_host 仍然调用了这个 Resize 相应函数。

void DesktopWindowTreeHostWin::HandleClientSizeChanged(
    const gfx::Size& new_size) {
  CheckForMonitorChange();
  if (dispatcher())
    OnHostResizedInPixels(new_size);
}

继续跟随堆栈,aura::DesktopWindowTreeHostWinaura::WindowTreeHost 的一个子类,这里只是简单的封装调用。

void DesktopWindowTreeHostWin::HandleDestroying() {
  drag_drop_client_->OnNativeWidgetDestroying(GetHWND());
  native_widget_delegate_->OnNativeWidgetDestroying();

  // Destroy the compositor before destroying the HWND since shutdown
  // may try to swap to the window.
  DestroyCompositor();
}

另一边,销毁混合器也是简单封装,所以继续向上排查。

view::HWNDMessageHandler 类中,WindowTreeHost 作为窗口事件委托,用来处理具体事件。

在这里,compositor 销毁发生在 void HWNDMessageHandler::OnDestroy() 函数调用中,而 Resize 调用发生在 void HWNDMessageHandler::OnWindowPosChanged()

那么也就是说,这个窗口在收到 WM_DESTROY 消息后,仍然收到了 WM_WINDOWPOSCHANGED 消息。

应该是父窗口被意外关闭,没有同步销毁,导致的这次崩溃。后续转向排查外部调用代码。