New issue
Advanced search Search tips

Issue 592753 link

Starred by 1 user

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug



Sign in to add a comment

`anonymous namespace'::ActiveVerifier::OnHandleBeingClosed sometimes in chrome.exe or chrome_child.dll

Project Member Reported by wfh@chromium.org, Mar 7 2016

Issue description

e.g. crash/637f4f9800000000 version 51.0.2667.1

06 0063f98c 00390091 chrome!logging::LogMessage::LogMessage+0x19 [c:\b\build\slave\win-asan\build\src\base\logging.cc @ 492]
07 0063fb78 0f9d3111 chrome!`anonymous namespace'::ActiveVerifier::OnHandleBeingClosed+0x91 [c:\b\build\slave\win-asan\build\src\base\win\scoped_handle.cc @ 212]
08 (Inline) -------- chrome_child!base::win::OnHandleBeingClosed+0x1d [c:\b\build\slave\win-asan\build\src\base\win\scoped_handle.cc @ 246]
09 0063fb88 75a54b8f chrome_child!`anonymous namespace'::CloseHandleHook+0x21 [c:\b\build\slave\win-asan\build\src\base\debug\close_handle_hook_win.cc @ 42]
0a 0063fb9c 75a54b50 SHLWAPI!_ProcessDetach+0x35
0b 0063fba8 75a59c34 SHLWAPI!DllMain+0x28
0c 0063fc08 772a8d04 SHLWAPI!_CRT_INIT+0x26d
0d 0063fc28 772c9dce ntdll!LdrpCallInitRoutine+0x14
0e 0063fccc 772c9c70 ntdll!LdrShutdownProcess+0x1aa
0f 0063fce0 752779c4 ntdll!RtlExitUserProcess+0x74
10 0063fcf4 003dd9bb KERNEL32!ExitProcessStub+0x12
11 0063fd00 003ddc49 chrome!__crtExitProcess+0x15 [f:\dd\vctools\crt\crtw32\startup\crt0dat.c @ 774]
12 0063fd48 003ddc6e chrome!doexit+0x119 [f:\dd\vctools\crt\crtw32\startup\crt0dat.c @ 678]
13 0063fd5c 003dc259 chrome!exit+0xf [f:\dd\vctools\crt\crtw32\startup\crt0dat.c @ 417]
14 0063fd9c 7527336a chrome!__tmainCRTStartup+0x10c [f:\dd\vctools\crt\crtw32\startup\crt0.c @ 264]
15 0063fda8 772a92b2 KERNEL32!BaseThreadInitThunk+0xe
16 0063fde8 772a9285 ntdll!__RtlUserThreadStart+0x70
17 0063fe00 00000000 ntdll!_RtlUserThreadStart+0x1b

e.g. crash/001df60800000000 version 51.0.2667.1

06 003bf87c 0f463151 chrome_child!logging::LogMessage::LogMessage+0x19 [c:\b\build\slave\win-asan\build\src\base\logging.cc @ 492]
07 003bfa6c 0f473111 chrome_child!`anonymous namespace'::ActiveVerifier::OnHandleBeingClosed+0x91 [c:\b\build\slave\win-asan\build\src\base\win\scoped_handle.cc @ 212]
08 (Inline) -------- chrome_child!base::win::OnHandleBeingClosed+0x1d [c:\b\build\slave\win-asan\build\src\base\win\scoped_handle.cc @ 246]
09 003bfa7c 75684b8f chrome_child!`anonymous namespace'::CloseHandleHook+0x21 [c:\b\build\slave\win-asan\build\src\base\debug\close_handle_hook_win.cc @ 42]
0a 003bfa90 75684b50 SHLWAPI!_ProcessDetach+0x35
0b 003bfa9c 75689c34 SHLWAPI!DllMain+0x28
0c 003bfafc 77ca92e0 SHLWAPI!_CRT_INIT+0x26d
0d 003bfb1c 77cc9da4 ntdll!LdrpCallInitRoutine+0x14
0e 003bfbc0 77cc9c46 ntdll!LdrShutdownProcess+0x1aa
0f 003bfbd4 76c579dc ntdll!RtlExitUserProcess+0x74
10 003bfbe8 012cd9bb KERNEL32!ExitProcessStub+0x12
11 003bfbf4 012cdc49 chrome!__crtExitProcess+0x15 [f:\dd\vctools\crt\crtw32\startup\crt0dat.c @ 774]
12 003bfc3c 012cdc6e chrome!doexit+0x119 [f:\dd\vctools\crt\crtw32\startup\crt0dat.c @ 678]
13 003bfc50 012cc259 chrome!exit+0xf [f:\dd\vctools\crt\crtw32\startup\crt0dat.c @ 417]
14 003bfc90 76c5337a chrome!__tmainCRTStartup+0x10c [f:\dd\vctools\crt\crtw32\startup\crt0.c @ 264]
15 003bfc9c 77ca9882 KERNEL32!BaseThreadInitThunk+0xe
16 003bfcdc 77ca9855 ntdll!__RtlUserThreadStart+0x70
17 003bfcf4 00000000 ntdll!_RtlUserThreadStart+0x1b

this could be related to change https://codereview.chromium.org/1549633005 maybe. This could also be WAI.
 

Comment 1 by wfh@chromium.org, Mar 7 2016

Activeverifier has always been this way. Looking back in time there's always a fraction of ActiveVerifier::OnHandleBeingClosed living in the DLL and a fraction living in EXE.
Project Member

Comment 3 by bugdroid1@chromium.org, Mar 9 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1f9673dbd1b71cfa5a0dc5ab06509368153bcb20

commit 1f9673dbd1b71cfa5a0dc5ab06509368153bcb20
Author: wfh <wfh@chromium.org>
Date: Wed Mar 09 00:33:02 2016

Add creation tracking for ActiveVerifier.

Sometimes the ActiveVerifier gets instantiated inside chrome_child's
copy of base and sometimes inside chrome.exe's copy of base.

The ActiveVerifier should only be running from chrome.exe's copy of base,
but before enforcing this, am adding a check to determine what is causing
this unpredictability.

See bug for the gory details.

BUG=592753

Review URL: https://codereview.chromium.org/1767293005

Cr-Commit-Position: refs/heads/master@{#379996}

[modify] https://crrev.com/1f9673dbd1b71cfa5a0dc5ab06509368153bcb20/base/win/scoped_handle.cc

Comment 4 by wfh@chromium.org, Mar 10 2016

Cc: -rvargas@chromium.org fdoray@chromium.org scottmg@chromium.org
The reason for this is that currently handle verifier is instantiated in the module that first uses the code i.e. first creates a scoped handle.

The reason for the variation is because there is currently a fieldtrial to sometimes do preread of the chrome.dll.

This code means that where the first scoped handle is created varies.

Sometimes it's in 

chrome!`anonymous namespace'::PreReadFileUsingReadFile
https://code.google.com/p/chromium/codesearch#chromium/src/chrome/app/file_pre_reader_win.cc&sq=package:chromium&l=20

otherwise it's in

chrome_child!base::i18n::`anonymous namespace'::LazyInitIcuDataFile
https://code.google.com/p/chromium/codesearch#chromium/src/base/i18n/icu_util.cc&sq=package:chromium&l=142

this is fine so this is mostly FYI... but what I'll probably do is change this to be more deterministic by instantiating the handle verifier earlier in startup, always in chrome.exe
Project Member

Comment 5 by bugdroid1@chromium.org, Mar 11 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/678736a103c3e64acdce5e76910ff077b17cc6c3

commit 678736a103c3e64acdce5e76910ff077b17cc6c3
Author: wfh <wfh@chromium.org>
Date: Fri Mar 11 08:41:04 2016

Two HandleVerifier thread safety fixes.

Two changes in this CL:

1. Before setting the g_active_verifier, check that another thread hasn't
already set this. This is to cater for the situation where multiple
threads attempt to create the handle verifier in the same module at the
same time. The g_lock was not protecting the check to see if the handle
verifier had already been instantiated by another thread before setting
it. This could result in a handle verifier leaking and some handles
being tracked in the leaked verifier.

2. Always instantiate the handle verifier inside the main module, unless
the main module does not link with base. This means that there should be
always one instance that lives in the main module.

BUG=592753
TEST=base_unittests

Review URL: https://codereview.chromium.org/1772343007

Cr-Commit-Position: refs/heads/master@{#380581}

[modify] https://crrev.com/678736a103c3e64acdce5e76910ff077b17cc6c3/base/win/scoped_handle.cc

Project Member

Comment 6 by bugdroid1@chromium.org, Mar 12 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/8f20e83de53c12033403e198b903f81112625d0b

commit 8f20e83de53c12033403e198b903f81112625d0b
Author: wfh <wfh@chromium.org>
Date: Sat Mar 12 02:09:59 2016

Add test for multithreaded ActiveVerifier behavior.

Previous to crrev.com/678736a there was a race in the setting of the
g_active_verifier global that could have caused multiple instantiations.

This adds a test to verify the new behavior and detect any future
regressions. The test failing with the old code can be seen here:

http://pastebin.com/raw/iXz8j21C

BUG=592753
TEST=base_unittests --gtest_filter=ScopedHandleTest.MultiProcess

Review URL: https://codereview.chromium.org/1779333003

Cr-Commit-Position: refs/heads/master@{#380835}

[modify] https://crrev.com/8f20e83de53c12033403e198b903f81112625d0b/base/BUILD.gn
[modify] https://crrev.com/8f20e83de53c12033403e198b903f81112625d0b/base/base.gyp
[modify] https://crrev.com/8f20e83de53c12033403e198b903f81112625d0b/base/base_switches.cc
[modify] https://crrev.com/8f20e83de53c12033403e198b903f81112625d0b/base/base_switches.h
[modify] https://crrev.com/8f20e83de53c12033403e198b903f81112625d0b/base/test/test_suite.cc
[modify] https://crrev.com/8f20e83de53c12033403e198b903f81112625d0b/base/win/scoped_handle.cc
[modify] https://crrev.com/8f20e83de53c12033403e198b903f81112625d0b/base/win/scoped_handle.h
[add] https://crrev.com/8f20e83de53c12033403e198b903f81112625d0b/base/win/scoped_handle_test_dll.cc
[modify] https://crrev.com/8f20e83de53c12033403e198b903f81112625d0b/base/win/scoped_handle_unittest.cc

Comment 7 by osh...@chromium.org, Mar 18 2016

ScopedHandleTest.MultiProcess is flaky on DrMemory bot. wfh@ can you take a look?

[ RUN      ] ScopedHandleTest.MultiProcess
~~Dr.M~~ SYMCACHE ERROR: api-ms-win-crt-heap-l1-1-0.dll file has too-large entry 0xfa8b5ec0 for _msize
c:\b\build\slave\drm-cr\build\src\base\win\scoped_handle_unittest.cc(114): error: Value of: test_child_process.WaitForExitWithTimeout( TestTimeouts::action_timeout(), &rv)
  Actual: false
Expected: true

https://build.chromium.org/p/chromium.memory.fyi/builders/Windows%20Unit%20%28DrMemory%20full%29%20%282%29/builds/10275
https://build.chromium.org/p/chromium.memory.fyi/builders/Windows%20Unit%20%28DrMemory%20full%29%20%282%29/builds/10273
https://build.chromium.org/p/chromium.memory.fyi/builders/Windows%20Unit%20%28DrMemory%20full%29%20%282%29/builds/10263

Comment 8 by wfh@chromium.org, Mar 18 2016

This test starts a new process then starts 200 threads inside this child process. would there be an issue with drmemory keeping track of this?

I can try and repro when I get back into the office next week.
Project Member

Comment 9 by bugdroid1@chromium.org, Mar 21 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/730968b08daed211500b2e0828af15302125d9f7

commit 730968b08daed211500b2e0828af15302125d9f7
Author: tommycli <tommycli@chromium.org>
Date: Mon Mar 21 22:35:21 2016

Memory Sheriff: Exclude ScopedHandleTest.MultiProcess from Dr. Memory

Test times out.

wfh@ to investigate either fixing test or making exclusion permanent.

BUG=592753
TBR=wfh@chromium.org

Review URL: https://codereview.chromium.org/1820083002

Cr-Commit-Position: refs/heads/master@{#382420}

[modify] https://crrev.com/730968b08daed211500b2e0828af15302125d9f7/tools/valgrind/gtest_exclude/base_unittests.gtest-drmemory_win32.txt

Sign in to add a comment