New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 692860 link

Starred by 6 users

Issue metadata

Status: Fixed
Owner:
Closed: Jun 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 2
Type: Bug


Participants' hotlists:
dmurph-shortlist-bugs


Sign in to add a comment

[33528:40451:0215/170846.858886:FATAL:resource_dispatcher_host_impl.cc(289)] Check failed: handle.

Project Member Reported by erikc...@chromium.org, Feb 16 2017

Issue description

I tried navigating 10 different tabs to youtube.com
TOT: 618b40d65c8372e95c3fb7bf848560b2a9b14a34
  5 dcheck_always_on = true                                                         
  6 is_component_build = false                                                      
  7 is_debug = false                                                                
  8 symbol_level = 1                                                                
  9 use_goma = true                                                                 
 10 enable_profiling = true  


[33531:775:0215/170821.635653:ERROR:vt_video_encode_accelerator_mac.cc(519)]  VTCompressionSessionCreate failed: -12908
[33531:775:0215/170821.636384:ERROR:vt_video_encode_accelerator_mac.cc(519)]  VTCompressionSessionCreate failed: -12908
[33528:40451:0215/170846.858886:FATAL:resource_dispatcher_host_impl.cc(289)] Check failed: handle. 
0   Chromium Framework                  0x000000010e4d128c base::debug::StackTrace::StackTrace(unsigned long) + 28
1   Chromium Framework                  0x000000010e4f6923 logging::LogMessage::~LogMessage() + 67
2   Chromium Framework                  0x000000010c9b4b31 content::(anonymous namespace)::AttachRequestBodyBlobDataHandles(content::ResourceRequestBodyImpl*, storage::BlobStorageContext*) + 273
3   Chromium Framework                  0x000000010c9b3bb6 content::ResourceDispatcherHostImpl::ContinuePendingBeginRequest(scoped_refptr<content::ResourceRequesterInfo>, int, content::ResourceRequest const&, base::Callback<void (content::SyncLoadResult const*), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, int, net::HttpRequestHeaders const&, mojo::AssociatedInterfaceRequest<content::mojom::URLLoader>, mojo::AssociatedInterfacePtr<content::mojom::URLLoaderClient>, bool, int) + 1510
4   Chromium Framework                  0x000000010c9b18e3 content::ResourceDispatcherHostImpl::BeginRequest(content::ResourceRequesterInfo*, int, content::ResourceRequest const&, base::Callback<void (content::SyncLoadResult const*), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, int, mojo::AssociatedInterfaceRequest<content::mojom::URLLoader>, mojo::AssociatedInterfacePtr<content::mojom::URLLoaderClient>) + 1587
5   Chromium Framework                  0x000000010c9b10d4 content::ResourceDispatcherHostImpl::OnRequestResourceInternal(content::ResourceRequesterInfo*, int, int, content::ResourceRequest const&, mojo::AssociatedInterfaceRequest<content::mojom::URLLoader>, mojo::AssociatedInterfacePtr<content::mojom::URLLoaderClient>) + 644
6   Chromium Framework                  0x000000010c9b0317 content::ResourceDispatcherHostImpl::OnRequestResource(content::ResourceRequesterInfo*, int, int, content::ResourceRequest const&) + 87
7   Chromium Framework                  0x000000010c9b01ce bool IPC::MessageT<ResourceHostMsg_RequestResource_Meta, std::__1::tuple<int, int, content::ResourceRequest>, void>::Dispatch<content::ResourceDispatcherHostImpl, content::ResourceDispatcherHostImpl, content::ResourceRequesterInfo, void (content::ResourceDispatcherHostImpl::*)(content::ResourceRequesterInfo*, int, int, content::ResourceRequest const&)>(IPC::Message const*, content::ResourceDispatcherHostImpl*, content::ResourceDispatcherHostImpl*, content::ResourceRequesterInfo*, void (content::ResourceDispatcherHostImpl::*)(content::ResourceRequesterInfo*, int, int, content::ResourceRequest const&)) + 158
8   Chromium Framework                  0x000000010c9afc60 content::ResourceDispatcherHostImpl::OnMessageReceived(IPC::Message const&, content::ResourceRequesterInfo*) + 432
9   Chromium Framework                  0x000000010c9c1ed6 content::ResourceMessageFilter::OnMessageReceived(IPC::Message const&) + 390
10  Chromium Framework                  0x000000010c626a28 content::BrowserMessageFilter::Internal::DispatchMessage(IPC::Message const&) + 120
11  Chromium Framework                  0x000000010c626805 content::BrowserMessageFilter::Internal::OnMessageReceived(IPC::Message const&) + 613
12  Chromium Framework                  0x000000010ece365d IPC::MessageFilterRouter::TryFilters(IPC::Message const&) + 253
13  Chromium Framework                  0x000000010ecc9805 IPC::ChannelProxy::Context::TryFilters(IPC::Message const&) + 117
14  Chromium Framework                  0x000000010ecc9ab2 IPC::ChannelProxy::Context::OnMessageReceived(IPC::Message const&) + 18
15  Chromium Framework                  0x000000010ecc6686 IPC::ChannelMojo::OnMessageReceived(IPC::Message const&) + 86
16  Chromium Framework                  0x000000010eccf90e IPC::internal::MessagePipeReader::Receive(std::__1::vector<unsigned char, std::__1::allocator<unsigned char> > const&, base::Optional<std::__1::vector<mojo::StructPtr<IPC::mojom::SerializedHandle>, std::__1::allocator<mojo::StructPtr<IPC::mojom::SerializedHandle> > > >) + 638
17  Chromium Framework                  0x000000010c0010fe IPC::mojom::ChannelStubDispatch::Accept(IPC::mojom::Channel*, mojo::Message*) + 846
18  Chromium Framework                  0x000000010e5e8fb9 mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) + 665
19  Chromium Framework                  0x000000010e5e89f6 mojo::FilterChain::Accept(mojo::Message*) + 150
20  Chromium Framework                  0x000000010e5ea065 mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) + 117
21  Chromium Framework                  0x000000010ecd4bee IPC::(anonymous namespace)::ChannelAssociatedGroupController::Accept(mojo::Message*) + 606
22  Chromium Framework                  0x000000010e5e89f6 mojo::FilterChain::Accept(mojo::Message*) + 150
23  Chromium Framework                  0x000000010e5e4fca mojo::Connector::ReadSingleMessage(unsigned int*) + 170
24  Chromium Framework                  0x000000010e5e55b1 mojo::Connector::OnHandleReadyInternal(unsigned int) + 177
25  Chromium Framework                  0x000000010e5fdd16 mojo::Watcher::OnHandleReady(unsigned int) + 278
26  Chromium Framework                  0x000000010e5fde3b void base::internal::FunctorTraits<void (mojo::Watcher::*)(unsigned int), void>::Invoke<base::WeakPtr<mojo::Watcher> const&, unsigned int const&>(void (mojo::Watcher::*)(unsigned int), base::WeakPtr<mojo::Watcher> const&&&, unsigned int const&&&) + 155
27  Chromium Framework                  0x000000010e4d1c35 base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) + 309
28  Chromium Framework                  0x000000010e50f349 base::MessageLoop::RunTask(base::PendingTask*) + 441
29  Chromium Framework                  0x000000010e50f70c base::MessageLoop::DeferOrRunPendingTask(base::PendingTask) + 44
30  Chromium Framework                  0x000000010e50fc13 base::MessageLoop::DoWork() + 483
31  Chromium Framework                  0x000000010e513a95 base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) + 245
32  Chromium Framework                  0x000000010e50f072 base::MessageLoop::RunHandler() + 354
33  Chromium Framework                  0x000000010e546097 base::RunLoop::Run() + 151
34  Chromium Framework                  0x000000010e58bd1d base::Thread::Run(base::RunLoop*) + 205
35  Chromium Framework                  0x000000010c77a048 content::BrowserThreadImpl::IOThreadRun(base::RunLoop*) + 24
36  Chromium Framework                  0x000000010c77a1d6 content::BrowserThreadImpl::Run(base::RunLoop*) + 294
37  Chromium Framework                  0x000000010e58c2d2 base::Thread::ThreadMain() + 930
38  Chromium Framework                  0x000000010e581d5f base::(anonymous namespace)::ThreadFunc(void*) + 95
39  libsystem_pthread.dylib             0x00007fff88fed99d _pthread_body + 131
40  libsystem_pthread.dylib             0x00007fff88fed91a _pthread_body + 0
41  libsystem_pthread.dylib             0x00007fff88feb351 thread_start + 13


 
Can we try to find an OWNER for this? Also, this code is an antipattern:
"""
289	    DCHECK(handle);
290	    if (!handle)
291	      continue;
"""

Comment 2 by horo@chromium.org, Feb 16 2017

Components: -Content>Core Blink>Storage
Owner: michaeln@chromium.org
I moved the logic of attaching the BlobDataHandle to the ResourceRequestBody from upload_data_stream_builder.cc.
https://codereview.chromium.org/492603002
https://chromium.googlesource.com/chromium/src/+blame/82fd6e6~/content/browser/loader/upload_data_stream_builder.cc#74

The null handle means the bug of BlobData handling.

michaeln@
Do you have any idea about this?
Cc: michaeln@chromium.org
Owner: dmu...@chromium.org
Status: Assigned (was: Untriaged)

Comment 4 by dmu...@chromium.org, Feb 21 2017

Labels: dmurph-shortlist-bugs

Comment 5 by dmu...@chromium.org, Feb 23 2017

horo@ - I want to appropriately report an error when the blob does not exist. This code is called

here
https://cs.chromium.org/chromium/src/content/browser/loader/resource_dispatcher_host_impl.cc?q=AttachRequestBodyBlobDataHandles&l=1440

and here
https://cs.chromium.org/chromium/src/content/browser/loader/resource_dispatcher_host_impl.cc?q=AttachRequestBodyBlobDataHandles&l=2170

How do I appropriately abort the request and report the blob error?

Comment 6 by horo@chromium.org, Mar 22 2017

Cc: jam@chromium.org roc...@chromium.org
 Issue 703697  has been merged into this issue.

Comment 7 by horo@chromium.org, Mar 23 2017

 Issue 704437  has been merged into this issue.

Comment 8 by dmu...@chromium.org, Apr 18 2017

Cc: dmu...@chromium.org
Owner: horo@chromium.org
Assigning to horo as it's unclear how to correctly fail out of this code and report an error when the blob is broken. If you know the correct method call (I'm mostly concerned about leaving things in a broken / invalid state if I don't cancel correctly - I'm not sure what the usage contract is here / invarients) then just let me know and I can do this patch.

Comment 9 by dmu...@chromium.org, Apr 18 2017

Labels: -dmurph-shortlist-bugs
Labels: -Pri-3 Pri-2
I've had this reproduce fairly reliable when trying to restore chrome:// tabs (I've tried chrome://settings and chrome://bookmarks) after terminating chromium from the console (I also terminated it from the task manager, but restoring the tabs did not cause the crash). 

Bumping this up to P2 (wez@chromium.com recommended)
Alright - I'll take a look again today.
Finding #1: No content_unittests test the blob-attached upload path. Looking into browsertests and layout tests now.
hypothetical changes:
https://codereview.chromium.org/2829923004/
Finding #2:

These content_browsertests exercise the navigation requests or that resource handler that can possibly upload blobs:
RenderFrameHostManagerTest.SelfReferencingFramesWithPOST
CrossSiteTransferTest/CrossSiteTransferTest.PostWithFileData/0
CrossSiteTransferTest/CrossSiteTransferTest.PostWithFileData/1
SessionHistoryTest.CrossFrameFormBackForward
NavigationHandleImplBrowserTest.VerifyFormRequestContextType
AsyncResourceHandlerBrowserTest/AsyncResourceHandlerBrowserTest.UploadProgress/0
AsyncResourceHandlerBrowserTest/AsyncResourceHandlerBrowserTest.UploadProgress/1
RequestDataResourceDispatcherHostBrowserTest.BasicCrossSite
SessionHistoryTest.GoBackToCrossSitePostWithRedirect
AsyncResourceHandlerBrowserTest/AsyncResourceHandlerBrowserTest.UploadProgressRedirect/0
AsyncResourceHandlerBrowserTest/AsyncResourceHandlerBrowserTest.UploadProgressRedirect/1
NavigationControllerBrowserTest.PostInSubframe
NavigationControllerBrowserTest.PostViaOpenUrlMsg
SessionHistoryTest.FrameFormBackForward
ResourceFetcherTests.ResourceFetcherPost
RequestDataResourceDispatcherHostBrowserTest.Basic
BrowserSideNavigationBrowserTest.POSTNavigation
NavigationControllerBrowserTest.RefererAndOriginHeadersAfterRedirects

None of these tests actually upload a blob.

Looking further into any tests that upload a blob - probably browser_tests or others.
Well, this is scary. It looks like we don't ever hit the case where we're attaching blob resources to a request in tests. the asan bot is still running, but it's not looking good:
https://codereview.chromium.org/2829923004/#ps20001

Comment 16 by horo@chromium.org, Apr 21 2017

We have layouttests for attaching blob resources to a request.
ex: external/wpt/XMLHttpRequest/send-data-blob.htm
You're right! That trips it. Great, thanks.
Although that doesn't hit the blob attachment code in BeginNavigationRequest, just in ContinuePendingBeginRequest.
Cc: ananta@chromium.org scottmg@chromium.org yhirano@chromium.org tzik@chromium.org
 Issue 726600  has been merged into this issue.
Owner: dmu...@chromium.org
Status: Fixed (was: Assigned)

Sign in to add a comment