New issue
Advanced search Search tips

Issue 591271 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner: ----
Closed: Sep 2016
Cc:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 3
Type: Bug



Sign in to add a comment

RendererDataMemoizingStore deadlocks when calling Store() on the UI thread for an RPH that has been destroyed

Project Member Reported by est...@chromium.org, Mar 2 2016

Issue description

RendererDataMemoizingStore::Store() takes the lock. If the process isn't already being watched, and we are on the UI thread, Store() calls StartObservingProcess(). If StartObservingProcess() does find a RenderProcessHost for the given |process_id|, then it calls RemoveRenderProcessItems(), which tries to take the lock and deadlocks.

I somehow ran into this while writing a ResourceDispatcherHost unit test. I suspect it's not really supposed to happen, because if we are on the UI thread the whole time, a RenderProcessHost that existed when Store() was called can't get destroyed before StartObservingProcess() is called (it's all synchronous).

So maybe Store() should DCHECK that |process_id| corresponds to a valid RPH at the outset.
 
Cc: a...@chromium.org
ccing avi@ to see if you have any thoughts since you reviewed some of this code approximately 3 years ago... which is about the most recently that it's been touched.

Comment 2 by jam@chromium.org, Sep 12 2016

Status: WontFix (was: Available)
This is removed in r417989.

Sign in to add a comment