New issue
Advanced search Search tips

Issue 692439 link

Starred by 2 users
Status: Fixed
Owner:
shimazu@chromium.org
Closed: Feb 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 1
Type: Bug



Sign in to add a comment

Check failed: wrapper_ in EmbeddedWorkerInstanceClientImpl::AddMessageToConsole

Project Member Reported by shimazu@chromium.org, Feb 15 2017 
I've found that fetch-event-after-navigation-within-page.https.html seems likely to fail when '-f' option is used on running the layout tests.

$ ./third_party/WebKit/Tools/Scripts/run-webkit-tests  -f -t Debug 'external/wpt/service-workers/service-worker/' --no-retry-failures  --iterations=1 --exit-after-n-crashes-or-timeouts=1

--STDERR--

[1:1:0215/182040.565599:462848431523:FATAL:embedded_worker_instance_client_impl.cc(91)] Check failed: wrapper_. 
#0 0x7fd89067fb9b base::debug::StackTrace::StackTrace()
#1 0x7fd89067e1dc base::debug::StackTrace::StackTrace()
#2 0x7fd8906e94af logging::LogMessage::~LogMessage()
#3 0x7fd893603d7c content::EmbeddedWorkerInstanceClientImpl::AddMessageToConsole()
#4 0x7fd891aba03d content::mojom::EmbeddedWorkerInstanceClientStubDispatch::Accept()
#5 0x7fd893604d93 content::mojom::EmbeddedWorkerInstanceClientStub<>::Accept()
#6 0x7fd88e8c9b25 mojo::InterfaceEndpointClient::HandleValidatedMessage()
#7 0x7fd88e8c94d1 mojo::InterfaceEndpointClient::HandleIncomingMessageThunk::Accept()
#8 0x7fd88e8c7155 mojo::FilterChain::Accept()
#9 0x7fd88e8cb5c1 mojo::InterfaceEndpointClient::HandleIncomingMessage()
#10 0x7fd88e8e1721 mojo::internal::MultiplexRouter::ProcessIncomingMessage()
#11 0x7fd88e8e0f18 mojo::internal::MultiplexRouter::Accept()
#12 0x7fd88e8c7155 mojo::FilterChain::Accept()
#13 0x7fd88e8bce25 mojo::Connector::ReadSingleMessage()
#14 0x7fd88e8bdab9 mojo::Connector::ReadAllAvailableMessages()
#15 0x7fd88e8bd8db mojo::Connector::OnHandleReadyInternal()
#16 0x7fd88e8bd7bb mojo::Connector::OnWatcherHandleReady()
#17 0x7fd88e8bfa7c _ZN4base8internal13FunctorTraitsIMN4mojo9ConnectorEFvjEvE6InvokeIPS3_JjEEEvS5_OT_DpOT0_
#18 0x7fd88e8bf986 _ZN4base8internal12InvokeHelperILb0EvE8MakeItSoIRKMN4mojo9ConnectorEFvjEJPS5_jEEEvOT_DpOT0_
#19 0x7fd88e8bf917 _ZN4base8internal7InvokerINS0_9BindStateIMN4mojo9ConnectorEFvjEJNS0_17UnretainedWrapperIS4_EEEEEFvjEE7RunImplIRKS6_RKSt5tupleIJS8_EEJLm0EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEEOj
#20 0x7fd88e8bf81c _ZN4base8internal7InvokerINS0_9BindStateIMN4mojo9ConnectorEFvjEJNS0_17UnretainedWrapperIS4_EEEEEFvjEE3RunEPNS0_13BindStateBaseEOj
#21 0x7fd895ff255f base::internal::RunMixin<>::Run()
#22 0x7fd895ff1ede mojo::Watcher::OnHandleReady()
#23 0x7fd895ff2ece _ZN4base8internal13FunctorTraitsIMN4mojo7WatcherEFvjEvE6InvokeIRKNS_7WeakPtrIS3_EEJRKjEEEvS5_OT_DpOT0_
#24 0x7fd895ff2d4f _ZN4base8internal12InvokeHelperILb1EvE8MakeItSoIRKMN4mojo7WatcherEFvjERKNS_7WeakPtrIS5_EEJRKjEEEvOT_OT0_DpOT1_
#25 0x7fd895ff2cc3 _ZN4base8internal7InvokerINS0_9BindStateIMN4mojo7WatcherEFvjEJNS_7WeakPtrIS4_EEjEEEFvvEE7RunImplIRKS6_RKSt5tupleIJS8_jEEJLm0ELm1EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEE
#26 0x7fd895ff2bac _ZN4base8internal7InvokerINS0_9BindStateIMN4mojo7WatcherEFvjEJNS_7WeakPtrIS4_EEjEEEFvvEE3RunEPNS0_13BindStateBaseE
#27 0x7fd890685b61 _ZNO4base8internal8RunMixinINS_8CallbackIFvvELNS0_8CopyModeE0ELNS0_10RepeatModeE0EEEE3RunEv
#28 0x7fd8906853de base::debug::TaskAnnotator::RunTask()
#29 0x7fd88a2aae96 blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue()
#30 0x7fd88a2a8289 blink::scheduler::TaskQueueManager::DoWork()
#31 0x7fd88a2b2b64 _ZN4base8internal13FunctorTraitsIMN5blink9scheduler16TaskQueueManagerEFvbEvE6InvokeIRKNS_7WeakPtrIS4_EEJRKbEEEvS6_OT_DpOT0_
#32 0x7fd88a2b2a6f _ZN4base8internal12InvokeHelperILb1EvE8MakeItSoIRKMN5blink9scheduler16TaskQueueManagerEFvbERKNS_7WeakPtrIS6_EEJRKbEEEvOT_OT0_DpOT1_
#33 0x7fd88a2b29e3 _ZN4base8internal7InvokerINS0_9BindStateIMN5blink9scheduler16TaskQueueManagerEFvbEJNS_7WeakPtrIS5_EEbEEEFvvEE7RunImplIRKS7_RKSt5tupleIJS9_bEEJLm0ELm1EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEE
#34 0x7fd88a2b28fc _ZN4base8internal7InvokerINS0_9BindStateIMN5blink9scheduler16TaskQueueManagerEFvbEJNS_7WeakPtrIS5_EEbEEEFvvEE3RunEPNS0_13BindStateBaseE
#35 0x7fd890685b61 _ZNO4base8internal8RunMixinINS_8CallbackIFvvELNS0_8CopyModeE0ELNS0_10RepeatModeE0EEEE3RunEv
#36 0x7fd8906853de base::debug::TaskAnnotator::RunTask()
#37 0x7fd89071261d base::MessageLoop::RunTask()
#38 0x7fd8907128b4 base::MessageLoop::DeferOrRunPendingTask()
#39 0x7fd890712ba4 base::MessageLoop::DoWork()
#40 0x7fd89072a288 base::MessagePumpDefault::Run()
#41 0x7fd8907121b7 base::MessageLoop::RunHandler()
#42 0x7fd8907c149a base::RunLoop::Run()
#43 0x7fd8935ef87d content::RendererMain()
#44 0x7fd893a00f4b content::RunZygote()
#45 0x7fd893a01300 content::RunNamedProcessTypeMain()
#46 0x7fd893a0371c content::ContentMainRunnerImpl::Run()
#47 0x7fd893a00432 content::ContentMain()
#48 0x000000496e01 main
#49 0x7fd8824ebf45 __libc_start_main
#50 0x000000496cd5 <unknown>

Comment 1 by shimazu@chromium.org, Feb 16 2017 

This happened when EmbeddedWorkerInstance::AddMessageToConsole is called before dispatching StartWorker message.

== stack trace on the browser side ==

#0 0x7fa7b219629b base::debug::StackTrace::StackTrace()
#1 0x7fa7b21948dc base::debug::StackTrace::StackTrace()
#2 0x7fa7b46ad187 content::EmbeddedWorkerInstance::AddMessageToConsole()
#3 0x7fa7b488004c content::ServiceWorkerWriteToCacheJob::NotifyFinishedCaching()
#4 0x7fa7b487fd56 content::ServiceWorkerWriteToCacheJob::Kill()
#5 0x7fa7afd1077f net::URLRequest::DoCancel()
#6 0x7fa7afd0b49e net::URLRequest::CancelWithError()
#7 0x7fa7b4314236 content::ResourceLoader::CancelRequestInternal()
#8 0x7fa7b4313f45 content::ResourceLoader::CancelRequest()
#9 0x7fa7b42e2938 content::ResourceDispatcherHostImpl::CancelRequestFromRenderer()
#10 0x7fa7b42dc1d2 content::ResourceDispatcherHostImpl::OnCancelRequest()
#11 0x7fa7b3eb3e91 _ZN3IPC20DispatchToMethodImplIN7content28RenderFrameDevToolsAgentHostEMS2_FvPNS1_15RenderFrameHostEiES3_St5tupleIJiEEJLm0EEEEvPT_T0_PT1_RKT2_N4base13IndexSequenceIJXspT3_EEEE
#12 0x7fa7b3eb3de0 _ZN3IPC16DispatchToMethodIN7content28RenderFrameDevToolsAgentHostENS1_15RenderFrameHostEJiEJiEEENSt9enable_ifIXeqsZT1_sZT2_EvE4typeEPT_MS7_FvPT0_DpT1_ESA_RKSt5tupleIJDpT2_EE
#13 0x7fa7b42ea4af _ZN3IPC8MessageTI34ResourceHostMsg_CancelRequest_MetaSt5tupleIJiEEvE8DispatchIN7content26ResourceDispatcherHostImplES7_NS6_21ResourceRequesterInfoEMS7_FvPS8_iEEEbPKNS_7MessageEPT_PT0_PT1_T2_
#14 0x7fa7b42dbabe content::ResourceDispatcherHostImpl::OnMessageReceived()
#15 0x7fa7b431d05b content::ResourceMessageFilter::OnMessageReceived()
#16 0x7fa7b30d8ffb content::BrowserMessageFilter::Internal::DispatchMessage()
#17 0x7fa7b30d8d00 content::BrowserMessageFilter::Internal::OnMessageReceived()
#18 0x7fa7b7b9918c IPC::(anonymous namespace)::TryFiltersImpl()
#19 0x7fa7b7b9910c IPC::MessageFilterRouter::TryFilters()
#20 0x7fa7b7b440b3 IPC::ChannelProxy::Context::TryFilters()
#21 0x7fa7b7b4463f IPC::ChannelProxy::Context::OnMessageReceived()
#22 0x7fa7b7b35c5b IPC::ChannelMojo::OnMessageReceived()
#23 0x7fa7b7b5c94e IPC::internal::MessagePipeReader::Receive()
#24 0x7fa7b7ba4286 IPC::mojom::ChannelStubDispatch::Accept()
#25 0x7fa7b7b5d553 IPC::mojom::ChannelStub<>::Accept()
#26 0x7fa7b03dab25 mojo::InterfaceEndpointClient::HandleValidatedMessage()
#27 0x7fa7b03da4d1 mojo::InterfaceEndpointClient::HandleIncomingMessageThunk::Accept()
#28 0x7fa7b03d8155 mojo::FilterChain::Accept()
#29 0x7fa7b03dc5c1 mojo::InterfaceEndpointClient::HandleIncomingMessage()
#30 0x7fa7b7b6be7b IPC::(anonymous namespace)::ChannelAssociatedGroupController::Accept()
#31 0x7fa7b03d8155 mojo::FilterChain::Accept()
#32 0x7fa7b03cde25 mojo::Connector::ReadSingleMessage()
#33 0x7fa7b03ceab9 mojo::Connector::ReadAllAvailableMessages()
#34 0x7fa7b03ce8db mojo::Connector::OnHandleReadyInternal()
#35 0x7fa7b03ce7bb mojo::Connector::OnWatcherHandleReady()
#36 0x7fa7b03d0a7c _ZN4base8internal13FunctorTraitsIMN4mojo9ConnectorEFvjEvE6InvokeIPS3_JjEEEvS5_OT_DpOT0_
#37 0x7fa7b03d0986 _ZN4base8internal12InvokeHelperILb0EvE8MakeItSoIRKMN4mojo9ConnectorEFvjEJPS5_jEEEvOT_DpOT0_
#38 0x7fa7b03d0917 _ZN4base8internal7InvokerINS0_9BindStateIMN4mojo9ConnectorEFvjEJNS0_17UnretainedWrapperIS4_EEEEEFvjEE7RunImplIRKS6_RKSt5tupleIJS8_EEJLm0EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEEOj
#39 0x7fa7b03d081c _ZN4base8internal7InvokerINS0_9BindStateIMN4mojo9ConnectorEFvjEJNS0_17UnretainedWrapperIS4_EEEEEFvjEE3RunEPNS0_13BindStateBaseEOj
#40 0x7fa7b7af955f base::internal::RunMixin<>::Run()
#41 0x7fa7b7af8ede mojo::Watcher::OnHandleReady()
#42 0x7fa7b7af9ece _ZN4base8internal13FunctorTraitsIMN4mojo7WatcherEFvjEvE6InvokeIRKNS_7WeakPtrIS3_EEJRKjEEEvS5_OT_DpOT0_
#43 0x7fa7b7af9d4f _ZN4base8internal12InvokeHelperILb1EvE8MakeItSoIRKMN4mojo7WatcherEFvjERKNS_7WeakPtrIS5_EEJRKjEEEvOT_OT0_DpOT1_
#44 0x7fa7b7af9cc3 _ZN4base8internal7InvokerINS0_9BindStateIMN4mojo7WatcherEFvjEJNS_7WeakPtrIS4_EEjEEEFvvEE7RunImplIRKS6_RKSt5tupleIJS8_jEEJLm0ELm1EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEE
#45 0x7fa7b7af9bac _ZN4base8internal7InvokerINS0_9BindStateIMN4mojo7WatcherEFvjEJNS_7WeakPtrIS4_EEjEEEFvvEE3RunEPNS0_13BindStateBaseE
#46 0x7fa7b219c261 _ZNO4base8internal8RunMixinINS_8CallbackIFvvELNS0_8CopyModeE0ELNS0_10RepeatModeE0EEEE3RunEv
#47 0x7fa7b219bade base::debug::TaskAnnotator::RunTask()
#48 0x7fa7b2228d1d base::MessageLoop::RunTask()
#49 0x7fa7b2228fb4 base::MessageLoop::DeferOrRunPendingTask()
#50 0x7fa7b22292a4 base::MessageLoop::DoWork()
#51 0x7fa7b22436ee base::MessagePumpLibevent::Run()
#52 0x7fa7b22288b7 base::MessageLoop::RunHandler()
#53 0x7fa7b22d7b9a base::RunLoop::Run()
#54 0x7fa7b237f664 base::Thread::Run()
#55 0x7fa7b3d3d156 content::BrowserThreadImpl::IOThreadRun()
#56 0x7fa7b3d3d45b content::BrowserThreadImpl::Run()
#57 0x7fa7b237feca base::Thread::ThreadMain()
#58 0x7fa7b236679a base::(anonymous namespace)::ThreadFunc()
#59 0x7fa7b783b184 start_thread
#60 0x7fa7a40a637d clone

Comment 2 by shimazu@chromium.org, Feb 20 2017

Status: Started (was: Available)
Project Member

Comment 3 by bugdroid1@chromium.org, Feb 21 2017 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/acc713786ac1643648471dd35083ce760dcdfd30

commit acc713786ac1643648471dd35083ce760dcdfd30
Author: shimazu <shimazu@chromium.org>
Date: Tue Feb 21 11:30:54 2017

ServiceWorker: ignore AddMessageToConsole before process allocation

This patch is to skip EmbeddedWorkerInstance::AddMessageToConsole before process
is allocated.

When test is finishing, a renderer process on which the worker's script loading
is running is killed. This cancels the ServiceWorkerWriteToCacheJob
URLRequestJob. So ServiceWorkerWriteToCacheJob::NotifyFinishedCaching() calls
EmbeddedWorkerInstance::AddMessageToConsole.  At the same time with finishing,
ClearAllServiceWorkersForTest calls SWVersion::StopWorker. This causes a
situation that EmbeddedWorkerInstance is in the STARTING state, due to the
restart behavior of Stop, but not yet have a process when AddMessageToConsole is
called. So AddMessageToConsole would crash.

BUG= 692439 

Review-Url: https://codereview.chromium.org/2703153002
Cr-Commit-Position: refs/heads/master@{#451733}

[modify] https://crrev.com/acc713786ac1643648471dd35083ce760dcdfd30/content/browser/service_worker/embedded_worker_instance.cc
[modify] https://crrev.com/acc713786ac1643648471dd35083ce760dcdfd30/content/browser/service_worker/embedded_worker_instance_unittest.cc

Comment 4 by shimazu@chromium.org, Feb 24 2017

Status: Fixed (was: Started)
►

Sign in to add a comment