ActivityLogAPI can DoS browser process |
|||
Issue descriptionSomeone sent me a report of Chrome needing 200% CPU. I asked them to report a sample, here it is. The interesting part of it is: 2094 base::MessagePumpCFRunLoopBase::RunWork() (in Google Chrome Framework) load address 0x1078c1000 + 0x5841bd [message_pump_mac.mm:330] 2091 base::MessageLoop::DoWork() (in Google Chrome Framework) load address 0x1078c1000 + 0x5b1cbb [message_loop.cc:624] ! 2091 base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) (in Google Chrome Framework) load address 0x1078c1000 + 0x5b195c [message_loop.cc:502] ! 2091 base::MessageLoop::RunTask(base::PendingTask const&) (in Google Chrome Framework) load address 0x1078c1000 + 0x5b164c [vector:640] ! 2091 base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) (in Google Chrome Framework) load address 0x1078c1000 + 0x58eebb [callback.h:389] ! 2089 void base::ObserverListThreadSafe<extensions::ActivityLog::Observer>::NotifyWrapper<void (extensions::ActivityLog::Observer::*)(...) ! : 1986 extensions::ActivityLogAPI::OnExtensionActivity(scoped_refptr<extensions::Action>) [activity_log_private_api.cc:91] ! : | 1986 extensions::Action::ConvertToExtensionActivity() (in Google Chrome Framework) [activity_actions.cc:36] I'm guessing they have some bad extension installed (any idea which one?) but an extension shouldn't be able to bring down the browser process.
,
Sep 14 2016
- Yes, googler (will email you their ldap) - Chrome 53 (chrome version, os version etc are listed at the top of the attached txt file too) - I asked them for it, will forward once I know.
,
Sep 19 2016
+felt as FYI. So, I followed up with the Googler, and apparently the pref we use to keep track of the number of extensions listening to the activity log is quite borked. It should only be around one, instead it was 75. My guess is that we somehow got out of sync in listening to whitelisted additions/removals of extensions, in which case we can add code to verify whether or not the number makes sense. The other possibility is pref corruption, which would be unfortunate.
,
Sep 29 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/100d164a4403d22bfa238607ebad71331e5032ad commit 100d164a4403d22bfa238607ebad71331e5032ad Author: rdevlin.cronin <rdevlin.cronin@chromium.org> Date: Thu Sep 29 18:06:40 2016 [Extensions] Fix incorrect counting prefs in activity log The ActivityLog maintains a count of active apps/extensions that are listening to the API. This is necessary so that events that happen on startup (potentially before the extension is loaded) are properly recorded. Unfortunately, there was a bug where this counter was never properly decremented. Because of this, there are cases where we are recording activity, but there are no active consumers. Fix this by separating the concept of cached consumers and seen active consumers. During startup, we can rely on the cached consumer count, but once startup is complete, we check whether or not there is actually a consumer and update the cached count appropriately. BUG= 646853 Review-Url: https://codereview.chromium.org/2372223003 Cr-Commit-Position: refs/heads/master@{#421870} [modify] https://crrev.com/100d164a4403d22bfa238607ebad71331e5032ad/chrome/browser/extensions/activity_log/activity_log.cc [modify] https://crrev.com/100d164a4403d22bfa238607ebad71331e5032ad/chrome/browser/extensions/activity_log/activity_log.h [modify] https://crrev.com/100d164a4403d22bfa238607ebad71331e5032ad/chrome/browser/extensions/activity_log/activity_log_enabled_unittest.cc [modify] https://crrev.com/100d164a4403d22bfa238607ebad71331e5032ad/chrome/browser/extensions/activity_log/activity_log_unittest.cc
,
Oct 14 2016
I think this should be fixed, at least so that logging doesn't happen if the listening app (Chrome Apps and Extensions Developer Tool) is not installed and enabled. Please let me know if you see this again.
,
Oct 14 2016
|
|||
►
Sign in to add a comment |
|||
Comment 1 by rdevlin....@chromium.org
, Sep 14 2016Owner: rdevlin....@chromium.org
Status: Assigned (was: Untriaged)