New issue
Advanced search Search tips

Issue 686188 link

Starred by 2 users

Issue metadata

Status: Untriaged
Owner: ----
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 2
Type: Bug



Sign in to add a comment

Figure out what to do with FrameReplicationState races

Project Member Reported by dcheng@chromium.org, Jan 27 2017

Issue description

1. Suppose renderer 1 is hosting frame A, so it has the LocalFrame for A. Some script makes a change, and renderer 1 queues an IPC to the browser process to update the replicated state.
2. Simultaneously, a cross-process navigation commits in renderer 2, so renderer 2 swaps from a RemoteFrame for A to the LocalFrame for A.

In the browser process, the RFH for frame A in renderer 1 is put in the pending delete list on swap and deleted after a second.

If the IPC reaches the RFH before it's deleted, then we can send the replicated state. But then we need to replicate it to renderer 2 (which now has a RFH, instead of a RFPH) for frame A. Doing this also makes things more complicated, because the replication code might need to understand that it only needs to re-replicate to a RFH if the active RFH changed.

On the other hand, if it reaches the browser, and the RFH is already gone, then the IPC just gets ignored, and we have inconsistent state between renderers.

One possibility is to use Mojo as the framework for replicating state: Mojo interfaces can be rebound, so the replication interface can be passed along easily. However, this introduces other issues, since generally, only the "active" RFH should be triggering changes in FrameReplicationState...

Another possibility is to force all state updates to require a round trip to the browser, but this introduces a sync IPC in paths we probably don't want it =(
 
Project Member

Comment 1 by sheriffbot@chromium.org, Feb 12 2018

Labels: Hotlist-Recharge-Cold
Status: Untriaged (was: Available)
This issue has been Available for over a year. If it's no longer important or seems unlikely to be fixed, please consider closing it out. If it is important, please re-triage the issue.

Sorry for the inconvenience if the bug really should have been left as Available. If you change it back, also remove the "Hotlist-Recharge-Cold" label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment