crashes when sending tabs from mobile to desktop

[simonhong]

Description

[ 00 ] ImmediateCrash() ( immediate_crash.h:186 )
[ 01 ] CheckFailure() ( check.h:256 )
[ 02 ] send_tab_to_self::SendTabToSelfToolbarIconController::ShowToolbarButton(send_tab_to_self::SendTabToSelfEntry const &,Browser *) ( send_tab_to_self_toolbar_icon_controller.cc:127 )
[ 03 ] send_tab_to_self::SendTabToSelfClientService::EntriesAddedRemotely(std::__Cr::vector<const send_tab_to_self::SendTabToSelfEntry *,std::__Cr::allocator<const send_tab_to_self::SendTabToSelfEntry *> > const &) ( send_tab_to_self_client_service.cc:51 )
[ 04 ] send_tab_to_self::SendTabToSelfBridge::NotifyRemoteSendTabToSelfEntryAdded(std::__Cr::vector<const send_tab_to_self::SendTabToSelfEntry *,std::__Cr::allocator<const send_tab_to_self::SendTabToSelfEntry *> > const &) ( send_tab_to_self_bridge.cc:494 )
[ 05 ] send_tab_to_self::SendTabToSelfBridge::ApplyIncrementalSyncChanges(std::__Cr::unique_ptr<syncer::MetadataChangeList,std::__Cr::default_delete<syncer::MetadataChangeList> >,std::__Cr::vector<std::__Cr::unique_ptr<syncer::EntityChange,std::__Cr::default_delete<syncer::EntityChange> >,std::__Cr::allocator<std::__Cr::unique_ptr<syncer::EntityChange,std::__Cr::default_delete<syncer::EntityChange> > > >) ( send_tab_to_self_bridge.cc:210 )
[ 06 ] syncer::ClientTagBasedRemoteUpdateHandler::ProcessIncrementalUpdate(sync_pb::DataTypeState const &,std::__Cr::vector<syncer::UpdateResponseData,std::__Cr::allocator<syncer::UpdateResponseData> >,std::__Cr::optional<sync_pb::GarbageCollectionDirective>) ( client_tag_based_remote_update_handler.cc:156 )
[ 07 ] syncer::ClientTagBasedDataTypeProcessor::OnIncrementalUpdateReceived(sync_pb::DataTypeState const &,std::__Cr::vector<syncer::UpdateResponseData,std::__Cr::allocator<syncer::UpdateResponseData> >,std::__Cr::optional<sync_pb::GarbageCollectionDirective>) ( client_tag_based_data_type_processor.cc:1188 )
[ 08 ] syncer::ClientTagBasedDataTypeProcessor::OnUpdateReceived(sync_pb::DataTypeState const &,std::__Cr::vector<syncer::UpdateResponseData,std::__Cr::allocator<syncer::UpdateResponseData> >,std::__Cr::optional<sync_pb::GarbageCollectionDirective>) ( client_tag_based_data_type_processor.cc:951 )
[ 09 ] base::internal::DecayedFunctorTraits<void (syncer::DataTypeProcessor::*)(const sync_pb::DataTypeState &, std::__Cr::vector<syncer::UpdateResponseData,std::__Cr::allocator<syncer::UpdateResponseData> >, std::__Cr::optional<sync_pb::GarbageCollectionDirective>),base::WeakPtr<syncer::DataTypeProcessor> &&,sync_pb::DataTypeState &&,std::__Cr::vector<syncer::UpdateResponseData,std::__Cr::allocator<syncer::UpdateResponseData> > &&,std::__Cr::optional<sync_pb::GarbageCollectionDirective> &&>::Invoke<void (syncer::DataTypeProcessor::*)(const sync_pb::DataTypeState &, std::__Cr::vector<syncer::UpdateResponseData,std::__Cr::allocator<syncer::UpdateResponseData> >, std::__Cr::optional<sync_pb::GarbageCollectionDirective>),const base::WeakPtr<syncer::DataTypeProcessor> &,sync_pb::DataTypeState,std::__Cr::vector<syncer::UpdateResponseData,std::__Cr::allocator<syncer::UpdateResponseData> >,std::__Cr::optional<sync_pb::GarbageCollectionDirective> >((sync_pb::DataTypeState const &,std::__Cr::vector<syncer::UpdateResponseData,std::__Cr::allocator<syncer::UpdateResponseData> >,std::__Cr::optional<sync_pb::GarbageCollectionDirective>),base::WeakPtr<syncer::DataTypeProcessor> const &,sync_pb::DataTypeState &&,std::__Cr::vector<syncer::UpdateResponseData,std::__Cr::allocator<syncer::UpdateResponseData> > &&,std::__Cr::optional<sync_pb::GarbageCollectionDirective> &&) ( bind_internal.h:728 )
[ 10 ] base::internal::Invoker<base::internal::FunctorTraits<void (syncer::DataTypeProcessor::*&&)(const sync_pb::DataTypeState &, std::__Cr::vector<syncer::UpdateResponseData,std::__Cr::allocator<syncer::UpdateResponseData> >, std::__Cr::optional<sync_pb::GarbageCollectionDirective>),base::WeakPtr<syncer::DataTypeProcessor> &&,sync_pb::DataTypeState &&,std::__Cr::vector<syncer::UpdateResponseData,std::__Cr::allocator<syncer::UpdateResponseData> > &&,std::__Cr::optional<sync_pb::GarbageCollectionDirective> &&>,base::internal::BindState<1,1,0,void (syncer::DataTypeProcessor::*)(const sync_pb::DataTypeState &, std::__Cr::vector<syncer::UpdateResponseData,std::__Cr::allocator<syncer::UpdateResponseData> >, std::__Cr::optional<sync_pb::GarbageCollectionDirective>),base::WeakPtr<syncer::DataTypeProcessor>,sync_pb::DataTypeState,std::__Cr::vector<syncer::UpdateResponseData,std::__Cr::allocator<syncer::UpdateResponseData> >,std::__Cr::optional<sync_pb::GarbageCollectionDirective> >,void ()>::RunOnce(base::internal::BindStateBase *) ( bind_internal.h:970 )
[ 11 ] base::TaskAnnotator::RunTaskImpl(base::PendingTask &) ( task_annotator.cc:217 )
[ 12 ] base::TaskAnnotator::RunTask(perfetto::StaticString,base::PendingTask &,base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl::<lambda_4> &&) ( task_annotator.h:106 )

Reported by users - https://bravesoftware.slack.com/archives/C01826CM3J9/p1743697085773229

Steps to reproduce

1. sending tabs from mobile to desktop

Actual result

No crash

Expected result

crash

Reproduces how often

Easily reproduced

Brave version (brave://version info)

1.77.95 stable on desktop

Channel information

• release (stable)
• beta
• nightly

Reproducibility

• with Brave Shields disabled
• with Brave Rewards disabled
• in the latest version of Chrome

Miscellaneous information

cc @rebron @brave/qa-team