New issue
Advanced search Search tips

Issue 641463 link

Starred by 1 user

Issue metadata

Status: Archived
Owner: ----
Closed: Sep 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 2
Type: Bug



Sign in to add a comment

Mash crashes when ShelfWidget is being destroyed

Project Member Reported by kylec...@chromium.org, Aug 26 2016

Issue description

The ShelfWidget crashes when it gets destroyed. This can be reproduced by running "out_oxygen/chrome --mash --multi-display" and closing the second window.

There appears to be a number of problems with the order in which parts of mash are shutdown / destroyed in the window that is closing. In general ash::mus::RootWindowController is missing all of the logic that ash::RootWindowController::Shutdown() contains.
 

Comment 1 by msw@chromium.org, Aug 29 2016

Here's the callstack I get; I might take a look this week:
[1201:1201:0829/112126:412269852895:FATAL:shelf_widget.cc(341)] Check failed: !status_area_widget_. 
#0 0x7f5ddbc86dde base::debug::StackTrace::StackTrace()
#1 0x7f5ddbce65fc logging::LogMessage::~LogMessage()
#2 0x7f5dcea40d7e ash::ShelfWidget::~ShelfWidget()
#3 0x7f5dcea40ff9 ash::ShelfWidget::~ShelfWidget()
#4 0x7f5ddc9d2daf std::default_delete<>::operator()()
#5 0x7f5dde73b43c std::unique_ptr<>::reset()
#6 0x7f5dde73b2f8 ash::mus::WmShelfMus::~WmShelfMus()
#7 0x7f5dde73b359 ash::mus::WmShelfMus::~WmShelfMus()
#8 0x7f5ddc9d2daf std::default_delete<>::operator()()
#9 0x7f5dde75f90c std::unique_ptr<>::reset()
#10 0x7f5dde75f6f9 std::unique_ptr<>::~unique_ptr()
#11 0x7f5dde75e9c7 ash::mus::RootWindowController::~RootWindowController()
#12 0x7f5dde75ea29 ash::mus::RootWindowController::~RootWindowController()
#13 0x7f5ddcab684f std::default_delete<>::operator()()
#14 0x7f5dde76fb3c std::unique_ptr<>::reset()
#15 0x7f5dde768f19 std::unique_ptr<>::~unique_ptr()
#16 0x7f5dde769bf9 std::_Rb_tree_node<>::~_Rb_tree_node()
#17 0x7f5dde769bd9 __gnu_cxx::new_allocator<>::destroy()
#18 0x7f5dde769bac std::_Rb_tree<>::_M_destroy_node()
#19 0x7f5dde7710dc std::_Rb_tree<>::_M_erase_aux()
#20 0x7f5dde771085 std::_Rb_tree<>::erase()
#21 0x7f5dde771025 std::__cxx1998::set<>::erase()
#22 0x7f5dde7690d7 std::__debug::set<>::erase()
#23 0x7f5dde766f04 ash::mus::WindowManager::OnWindowDestroyed()
#24 0x7f5dde31ac28 ui::Window::~Window()
#25 0x7f5dde318117 ui::Window::LocalDestroy()
#26 0x7f5dde33c5b8 ui::WindowPrivate::LocalDestroy()
#27 0x7f5dde336710 ui::WindowTreeClient::OnWindowDeleted()
#28 0x7f5dde2b5f32 ui::mojom::WindowTreeClientStub::Accept()
#29 0x7f5de01185a8 mojo::InterfaceEndpointClient::HandleValidatedMessage()
So that is caused by ShelfWidget::Shutdown() not getting called before ShelfWidget::~ShelfWidget(). If ShelfWidget::Shutdown() is called in ~WmShelfMus() then a different crash happens a bit later on with the following stack trace:

Received signal 11 SEGV_MAPERR ffffee6691406edd
#0 0x7f7372314317 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#1 0x7f7372458330 <unknown>
#2 0x7f736dbe9a21 views::Widget::OnNativeWidgetDestroying()
#3 0x7f736ccc3b21 views::NativeWidgetMus::OnPlatformWindowClosed()
#4 0x7f736ccc6d67 views::NativeWidgetMus::MusWindowObserver::OnWindowDestroyed()
#5 0x7f736cd04e94 ui::Window::~Window()
#6 0x7f736cd025dd ui::Window::Destroy()
#7 0x7f736ccc366b views::NativeWidgetMus::~NativeWidgetMus()
#8 0x7f736ccc3819 views::NativeWidgetMus::~NativeWidgetMus()
#9 0x7f736dbe669f views::Widget::~Widget()
#10 0x7f736d4dcf18 ash::ShelfWidget::~ShelfWidget()
#11 0x7f736d4dcfc9 ash::ShelfWidget::~ShelfWidget()
#12 0x7f7373797cc1 ash::mus::WmShelfMus::~WmShelfMus()
#13 0x7f7373797d19 ash::mus::WmShelfMus::~WmShelfMus()
#14 0x7f73737a2ec0 ash::mus::RootWindowController::~RootWindowController()
#15 0x7f73737a2f29 ash::mus::RootWindowController::~RootWindowController()
#16 0x7f73737a6294 ash::mus::WindowManager::OnWindowDestroyed()
#17 0x7f73736997e4 ui::Window::~Window()
#18 0x7f7373697701 ui::Window::LocalDestroy()
#19 0x7f73736a16a7 ui::WindowTreeClient::OnWindowDeleted()
#20 0x7f737367e972 ui::mojom::WindowTreeClientStub::Accept()
#21 0x7f7373fe361e mojo::InterfaceEndpointClient::HandleValidatedMessage()
#22 0x7f7373fe34d6 mojo::FilterChain::Accept()
#23 0x7f7373fe436c mojo::InterfaceEndpointClient::HandleIncomingMessage()
#24 0x7f7373fe91b4 mojo::internal::MultiplexRouter::ProcessIncomingMessage()
#25 0x7f7373fe8b8e mojo::internal::MultiplexRouter::Accept()
#26 0x7f7373fe34d6 mojo::FilterChain::Accept()
#27 0x7f7373fe1a22 mojo::Connector::ReadSingleMessage()
#28 0x7f7373fe1f74 mojo::Connector::OnHandleReadyInternal()
#29 0x7f7372ef157b mojo::Watcher::OnHandleReady()
#30 0x7f7372315180 base::debug::TaskAnnotator::RunTask()
#31 0x7f737233c4e5 base::MessageLoop::RunTask()
#32 0x7f737233c818 base::MessageLoop::DeferOrRunPendingTask()
#33 0x7f737233cc6b base::MessageLoop::DoWork()
#34 0x7f737233ef99 base::MessagePumpLibevent::Run()
#35 0x7f737233c041 base::MessageLoop::RunHandler()
#36 0x7f73723651e0 base::RunLoop::Run()
#37 0x7f737233b270 base::MessageLoop::Run()
#38 0x7f7372eaccd6 MashRunner::StartChildApp()
#39 0x7f7372eae81e _ZN4base8internal7InvokerINS0_9BindStateIM10MashRunnerFvN4mojo16InterfaceRequestIN5shell5mojom7ServiceEEEEJNS0_17UnretainedWrapperIS3_EEEEEFvS9_EE3RunEPNS0_13BindStateBaseEOS9_
#40 0x7f73737e8c9a shell::ChildProcessMainWithCallback()
#41 0x7f7372eac7e8 MashRunner::Run()
#42 0x7f7372eacdb7 MashMain()
#43 0x7f7372eaada8 ChromeMain
#44 0x7f736a149f45 __libc_start_main
#45 0x7f7372eaac40 <unknown>
I suspect the problem is that the ash window containers are not being shut down early enough, so the shelf container isn't shut down, so the ShelfLayoutManager isn't destroyed, so WmShelfMus::WillDeleteShelfLayoutManager isn't called, so shelf_widget_->Shutdown() doesn't run.

Components: MUS
Project Member

Comment 5 by bugdroid1@chromium.org, Sep 6 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/709f84d2f2bac43662b31b9393812c8a711f6da0

commit 709f84d2f2bac43662b31b9393812c8a711f6da0
Author: msw <msw@chromium.org>
Date: Tue Sep 06 22:59:45 2016

mash: Avoid shelf crashes on display removal.

Make ShelfWidget CloseNow in Shutdown.
Call ShutdownShelfWidget() in the WmShelfMus dtor.
Check for a valid shelf window in UpdateVisibilityState.

BUG= 641463 
TEST='chrome --mash --multi-display' doesn't crash when closing the second display.
R=sky@chromium.org

Review-Url: https://codereview.chromium.org/2302673002
Cr-Commit-Position: refs/heads/master@{#416747}

[modify] https://crrev.com/709f84d2f2bac43662b31b9393812c8a711f6da0/ash/common/shelf/shelf_layout_manager.cc
[modify] https://crrev.com/709f84d2f2bac43662b31b9393812c8a711f6da0/ash/common/shelf/shelf_widget.cc
[modify] https://crrev.com/709f84d2f2bac43662b31b9393812c8a711f6da0/ash/mus/bridge/wm_shelf_mus.cc

Comment 6 by msw@chromium.org, Sep 6 2016

Status: Fixed (was: Untriaged)

Comment 7 by dchan@chromium.org, Oct 7 2016

Labels: VerifyIn-55

Comment 8 by dchan@google.com, Nov 19 2016

Labels: VerifyIn-56

Comment 9 by dchan@google.com, Jan 21 2017

Labels: VerifyIn-57

Comment 10 by dchan@google.com, Mar 4 2017

Labels: VerifyIn-58

Comment 11 by dchan@google.com, Apr 17 2017

Labels: VerifyIn-59

Comment 12 by dchan@google.com, May 30 2017

Labels: VerifyIn-60
Labels: VerifyIn-61

Comment 14 by dchan@chromium.org, Oct 14 2017

Status: Archived (was: Fixed)
Components: -MUS Internals>Services>WindowService

Sign in to add a comment