New issue
Advanced search Search tips

Issue 701380 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Mar 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Bug



Sign in to add a comment

ui::mojom::Gpu_EstablishGpuChannel Serialization Failure

Project Member Reported by jonr...@chromium.org, Mar 14 2017

Issue description

Failure seen on: linux_chromium_chromeos_ozone_rel_ng
While running: mash_browser_tests
Suspected test: BrowserTest.CommandCreateAppShortcutHttps

Haven't reproed locally yet

Seen on a WIP change: https://codereview.chromium.org/2741343003/
Log containing the failure: https://luci-logdog.appspot.com/v/?s=chromium%2Fbb%2Ftryserver.chromium.linux%2Flinux_chromium_chromeos_ozone_rel_ng%2F339123%2F%2B%2Frecipes%2Fsteps%2Fmash_browser_tests__with_patch_%2F0%2Fstdout

Stack trace:

base::debug::StackTrace::StackTrace()
#1 0x0000035264cf base::debug::(anonymous namespace)::StackDumpSignalHandler()
#2 0x7efd8e67b330 <unknown>
#3 0x000001e8a9c6 mojo::internal::Serializer<>::PrepareToSerialize()
#4 0x000001e89355 ui::mojom::Gpu_EstablishGpuChannel_ProxyToResponder::Run()
#5 0x000001e8a800 _ZN4base8internal7InvokerINS0_9BindStateIMN2ui5mojom40Gpu_EstablishGpuChannel_ProxyToResponderEFviN4mojo16ScopedHandleBaseINS6_17MessagePipeHandleEEERKN3gpu7GPUInfoEEJNS0_13PassedWrapperISt10unique_ptrIS5_St14default_deleteIS5_EEEEEEEFviS9_SD_EE3RunEPNS0_13BindStateBaseEOiOS9_SD_
#6 0x000007c8cef8 ui::ws::(anonymous namespace)::GpuClient::OnGpuChannelEstablished()
#7 0x000007c8cf54 _ZN4base8internal7InvokerINS0_9BindStateIMN2ui2ws12_GLOBAL__N_19GpuClientEFvRKNS_8CallbackIFviN4mojo16ScopedHandleBaseINS8_17MessagePipeHandleEEERKN3gpu7GPUInfoEELNS0_8CopyModeE1ELNS0_10RepeatModeE1EEESB_EJNS0_17UnretainedWrapperIS6_EESJ_EEEFvSB_EE3RunEPNS0_13BindStateBaseEOSB_
#8 0x000001e9eb58 ui::mojom::WindowTree_GetCursorLocationMemory_ForwardToCallback::Accept()
#9 0x0000046df6f0 mojo::InterfaceEndpointClient::HandleValidatedMessage()
#10 0x0000046f0c66 mojo::FilterChain::Accept()
#11 0x0000046e079b mojo::InterfaceEndpointClient::HandleIncomingMessage()
#12 0x0000046e6a79 mojo::internal::MultiplexRouter::ProcessIncomingMessage()
#13 0x0000046e6374 mojo::internal::MultiplexRouter::Accept()
#14 0x0000046f0c66 mojo::FilterChain::Accept()
#15 0x0000046de00e mojo::Connector::ReadSingleMessage()
#16 0x0000046de4c1 mojo::Connector::OnHandleReadyInternal()
#17 0x0000046f2856 mojo::Watcher::OnHandleReady()
#18 0x00000183a7d1 _ZN4base8internal13FunctorTraitsIMN3arc17ArcSessionManagerEFvN6policy23AndroidManagementClient6ResultEEvE6InvokeIRKNS_7WeakPtrIS3_EEJS6_EEEvS8_OT_DpOT0_
#19 0x0000035d01b9 base::debug::TaskAnnotator::RunTask()
#20 0x000003545b6d base::MessageLoop::RunTask()
#21 0x0000035461f5 base::MessageLoop::DoWork()
#22 0x0000035488c9 base::MessagePumpLibevent::Run()
#23 0x0000035458ea base::MessageLoop::RunHandler()
#24 0x00000356c5af base::RunLoop::Run()
#25 0x000003518a8a (anonymous namespace)::StartChildApp()
#26 0x00000220c9f4 _ZN4base8internal7InvokerINS0_9BindStateIPFvN4mojo16InterfaceRequestIN6device5mojom16VibrationManagerEEEEJEEES9_E3RunEPNS0_13BindStateBaseEOS8_
#27 0x000001f467d0 service_manager::RunStandaloneService()
#28 0x000003518786 RunMashBrowserTests()
#29 0x000003518613 main
#30 0x7efd8acf4f45 __libc_start_main
#31 0x000000614df1 <unknown>
  r8: 0000000000000000  r9: 00007ffc3b022f08 r10: 00000aae03187b70 r11: 0000000000000246
 r12: 0000000000000004 r13: 00007ffc3b021eb8 r14: 00000000f3085fe0 r15: 00000aae09903020
  di: 0000000000000004  si: 00007ffc3b021cb8  bp: 00007ffc3b021cb8  bx: 00000aae0cfacb80
  dx: 00007ffc3b021eb8  ax: 0000000001e89320  cx: 0000000000000004  sp: 00007ffc3b0219f0
  ip: 0000000001e8a9c6 efl: 0000000000010206 cgf: 0000000000000033 erf: 0000000000000004
 trp: 000000000000000e msk: 0000000000000000 cr2: 0000000000000024
[end of stack trace]

There are subsequent stacks, which are noting a teardown error. But those are expected if something crashed and never tears down correctly:

[0313/142124.477150:FATAL:window_tree_client.cc(212)] Check failed: windows_.empty(). 
#0 0x000003526957 base::debug::StackTrace::StackTrace()
#1 0x00000353e48a logging::LogMessage::~LogMessage()
#2 0x000005041409 aura::WindowTreeClient::~WindowTreeClient()
#3 0x000005041759 aura::WindowTreeClient::~WindowTreeClient()
#4 0x0000034f9992 ash::mus::WindowManager::OnLostConnection()
#5 0x000000750e8b _ZN4base8internal13FunctorTraitsIMNS_18CancelableCallbackIFvvEEEKFvvEvE6InvokeIRKNS_7WeakPtrIS4_EEJEEEvS6_OT_DpOT0_
#6 0x0000046e091a mojo::InterfaceEndpointClient::NotifyError()
#7 0x0000046e731e mojo::internal::MultiplexRouter::ProcessNotifyErrorTask()
#8 0x0000046e5020 mojo::internal::MultiplexRouter::ProcessTasks()
#9 0x0000046e3c4d mojo::internal::MultiplexRouter::OnPipeConnectionError()
#10 0x0000046ddd85 mojo::Connector::HandleError()
#11 0x0000046de4a1 mojo::Connector::OnHandleReadyInternal()
#12 0x0000046f2856 mojo::Watcher::OnHandleReady()
#13 0x00000183a7d1 _ZN4base8internal13FunctorTraitsIMN3arc17ArcSessionManagerEFvN6policy23AndroidManagementClient6ResultEEvE6InvokeIRKNS_7WeakPtrIS3_EEJS6_EEEvS8_OT_DpOT0_
#14 0x0000035d01b9 base::debug::TaskAnnotator::RunTask()
#15 0x000003545b6d base::MessageLoop::RunTask()
#16 0x0000035461f5 base::MessageLoop::DoWork()
#17 0x0000035488c9 base::MessagePumpLibevent::Run()
#18 0x0000035458ea base::MessageLoop::RunHandler()
#19 0x00000356c5af base::RunLoop::Run()
#20 0x000003518a8a (anonymous namespace)::StartChildApp()
#21 0x00000220c9f4 _ZN4base8internal7InvokerINS0_9BindStateIPFvN4mojo16InterfaceRequestIN6device5mojom16VibrationManagerEEEEJEEES9_E3RunEPNS0_13BindStateBaseEOS8_
#22 0x000001f467d0 service_manager::RunStandaloneService()
#23 0x000003518786 RunMashBrowserTests()
#24 0x000003518613 main
#25 0x7f0152437f45 __libc_start_main
#26 0x000000614df1 <unknown>

Received signal 6
#0 0x000003526957 base::debug::StackTrace::StackTrace()
#1 0x0000035264cf base::debug::(anonymous namespace)::StackDumpSignalHandler()
#2 0x7f0155dbe330 <unknown>
#3 0x7f015244cc37 gsignal
#4 0x7f0152450028 abort
#5 0x0000035251f2 base::debug::BreakDebugger()
#6 0x00000353e791 logging::LogMessage::~LogMessage()
#7 0x000005041409 aura::WindowTreeClient::~WindowTreeClient()
#8 0x000005041759 aura::WindowTreeClient::~WindowTreeClient()
#9 0x0000034f9992 ash::mus::WindowManager::OnLostConnection()
#10 0x000000750e8b _ZN4base8internal13FunctorTraitsIMNS_18CancelableCallbackIFvvEEEKFvvEvE6InvokeIRKNS_7WeakPtrIS4_EEJEEEvS6_OT_DpOT0_
#11 0x0000046e091a mojo::InterfaceEndpointClient::NotifyError()
#12 0x0000046e731e mojo::internal::MultiplexRouter::ProcessNotifyErrorTask()
#13 0x0000046e5020 mojo::internal::MultiplexRouter::ProcessTasks()
#14 0x0000046e3c4d mojo::internal::MultiplexRouter::OnPipeConnectionError()
#15 0x0000046ddd85 mojo::Connector::HandleError()
#16 0x0000046de4a1 mojo::Connector::OnHandleReadyInternal()
#17 0x0000046f2856 mojo::Watcher::OnHandleReady()
#18 0x00000183a7d1 _ZN4base8internal13FunctorTraitsIMN3arc17ArcSessionManagerEFvN6policy23AndroidManagementClient6ResultEEvE6InvokeIRKNS_7WeakPtrIS3_EEJS6_EEEvS8_OT_DpOT0_
#19 0x0000035d01b9 base::debug::TaskAnnotator::RunTask()
#20 0x000003545b6d base::MessageLoop::RunTask()
#21 0x0000035461f5 base::MessageLoop::DoWork()
#22 0x0000035488c9 base::MessagePumpLibevent::Run()
#23 0x0000035458ea base::MessageLoop::RunHandler()
#24 0x00000356c5af base::RunLoop::Run()
#25 0x000003518a8a (anonymous namespace)::StartChildApp()
#26 0x00000220c9f4 _ZN4base8internal7InvokerINS0_9BindStateIPFvN4mojo16InterfaceRequestIN6device5mojom16VibrationManagerEEEEJEEES9_E3RunEPNS0_13BindStateBaseEOS8_
#27 0x000001f467d0 service_manager::RunStandaloneService()
#28 0x000003518786 RunMashBrowserTests()
#29 0x000003518613 main
#30 0x7f0152437f45 __libc_start_main
#31 0x000000614df1 [0313/142124.722519:ERROR:screen_manager_ozone_internal.cc(356)] Not implemented reached in virtual void display::ScreenManagerOzoneInternal::CloseMirroringDisplayIfNotNecessary()
<unknown>
  r8: ffffb02a6b6d4d48  r9: ffffb02a6b6d4d38 r10: 0000000000000008 r11: 0000000000000202
 r12: 0000302940c444d0 r13: 0000302940c444e0 r14: 00007ffed524a758 r15: 00007ffed524a748
  di: 0000000000004040  si: 0000000000004040  bp: 0000302940c62000  bx: 0000000000000000
  dx: 0000000000000006  ax: 0000000000000000  cx: ffffffffffffffff  sp: 00007ffed524a188
  ip: 00007f015244cc37 efl: 0000000000000202 cgf: 0000000000000033 erf: 0000000000000000
 trp: 0000000000000000 msk: 0000000000000000 cr2: 0000000000000000
[end of stack trace]


 

Comment 1 by sadrul@chromium.org, Mar 14 2017

The stacktrace doesn't make a lot of sense. I don't see a path from ArcSessionManager to WindowTree_GetCursorLocationMemory to GpuClient::OnGpuChannelEstablished(). The log shows some timeouts before this crash. Maybe the timeout is causing the test to abort, and it's dumping a weird stacktrace in the process?
Maybe there is a weird shutdown ordering happening on a timeout.

I've seen lots of timeouts on previous runs, as I haven't upped the limit. However I've not seen that lead to crashes.

I'll keep an eye on it to see if I can narrow down the case.
I can now reproduce a similar stack trace locally. However only when running the full bot config, and not 100% repro.

I wouldn't be surprised if timeouts are leading us into a potentially bad state. But I just confirmed ability to repro locally. So I haven't debugged further the timeouts.

Stack trace:
Received signal 11 <unknown> 000000000000
#0 0x7f7f37e6ec5b base::debug::StackTrace::StackTrace()
#1 0x7f7f37e6d32c base::debug::StackTrace::StackTrace()
#2 0x7f7f37e6e76f base::debug::(anonymous namespace)::StackDumpSignalHandler()
#3 0x7f7f382be330 <unknown>
#4 0x000001dda36c std::reverse_iterator<>::base()
#5 0x00000309c0be mojo::internal::CallWithContext<>()
#6 0x0000032a5153 mojo::internal::Serializer<>::PrepareToSerialize()
#7 0x0000032a0d32 _ZN4mojo8internal18PrepareToSerializeIN3gpu5mojom15GpuInfoDataViewERKNS2_7GPUInfoEJPNS0_20SerializationContextEELPv0EEEmOT0_DpOT1_
#8 0x00000329e9a0 ui::mojom::Gpu_EstablishGpuChannel_ProxyToResponder::Run()
#9 0x0000032a36f4 _ZN4base8internal13FunctorTraitsIMN2ui5mojom40Gpu_EstablishGpuChannel_ProxyToResponderEFviN4mojo16ScopedHandleBaseINS5_17MessagePipeHandleEEERKN3gpu7GPUInfoEEvE6InvokeISt10unique_ptrIS4_St14default_deleteIS4_EEJiS8_SC_EEEvSE_OT_DpOT0_
#10 0x0000032a35b0 _ZN4base8internal12InvokeHelperILb0EvE8MakeItSoIRKMN2ui5mojom40Gpu_EstablishGpuChannel_ProxyToResponderEFviN4mojo16ScopedHandleBaseINS7_17MessagePipeHandleEEERKN3gpu7GPUInfoEEJSt10unique_ptrIS6_St14default_deleteIS6_EEiSA_SE_EEEvOT_DpOT0_
#11 0x0000032a3511 _ZN4base8internal7InvokerINS0_9BindStateIMN2ui5mojom40Gpu_EstablishGpuChannel_ProxyToResponderEFviN4mojo16ScopedHandleBaseINS6_17MessagePipeHandleEEERKN3gpu7GPUInfoEEJNS0_13PassedWrapperISt10unique_ptrIS5_St14default_deleteIS5_EEEEEEEFviS9_SD_EE7RunImplIRKSF_RKSt5tupleIJSL_EEJLm0EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEEOiOS9_SD_
#12 0x0000032a3423 _ZN4base8internal7InvokerINS0_9BindStateIMN2ui5mojom40Gpu_EstablishGpuChannel_ProxyToResponderEFviN4mojo16ScopedHandleBaseINS6_17MessagePipeHandleEEERKN3gpu7GPUInfoEEJNS0_13PassedWrapperISt10unique_ptrIS5_St14default_deleteIS5_EEEEEEEFviS9_SD_EE3RunEPNS0_13BindStateBaseEOiOS9_SD_
#13 0x0000032a098f base::internal::RunMixin<>::Run()
#14 0x0000087a05f2 ui::ws::(anonymous namespace)::GpuClient::OnGpuChannelEstablished()
#15 0x0000087a0a2f _ZN4base8internal13FunctorTraitsIMN2ui2ws12_GLOBAL__N_19GpuClientEFvRKNS_8CallbackIFviN4mojo16ScopedHandleBaseINS7_17MessagePipeHandleEEERKN3gpu7GPUInfoEELNS0_8CopyModeE1ELNS0_10RepeatModeE1EEESA_EvE6InvokeIPS5_JSK_SA_EEEvSM_OT_DpOT0_
#16 0x0000087a08cb _ZN4base8internal12InvokeHelperILb0EvE8MakeItSoIRKMN2ui2ws12_GLOBAL__N_19GpuClientEFvRKNS_8CallbackIFviN4mojo16ScopedHandleBaseINS9_17MessagePipeHandleEEERKN3gpu7GPUInfoEELNS0_8CopyModeE1ELNS0_10RepeatModeE1EEESC_EJPS7_SM_SC_EEEvOT_DpOT0_
#17 0x0000087a0848 _ZN4base8internal7InvokerINS0_9BindStateIMN2ui2ws12_GLOBAL__N_19GpuClientEFvRKNS_8CallbackIFviN4mojo16ScopedHandleBaseINS8_17MessagePipeHandleEEERKN3gpu7GPUInfoEELNS0_8CopyModeE1ELNS0_10RepeatModeE1EEESB_EJNS0_17UnretainedWrapperIS6_EESJ_EEEFvSB_EE7RunImplIRKSN_RKSt5tupleIJSP_SJ_EEJLm0ELm1EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEEOSB_
#18 0x0000087a074c _ZN4base8internal7InvokerINS0_9BindStateIMN2ui2ws12_GLOBAL__N_19GpuClientEFvRKNS_8CallbackIFviN4mojo16ScopedHandleBaseINS8_17MessagePipeHandleEEERKN3gpu7GPUInfoEELNS0_8CopyModeE1ELNS0_10RepeatModeE1EEESB_EJNS0_17UnretainedWrapperIS6_EESJ_EEEFvSB_EE3RunEPNS0_13BindStateBaseEOSB_
#19 0x0000009e46e3 base::internal::RunMixin<>::Run()
#20 0x00000395b536 ui::mojom::GpuService_EstablishGpuChannel_ForwardToCallback::Accept()
#21 0x7f7f38551d93 mojo::InterfaceEndpointClient::HandleValidatedMessage()
#22 0x7f7f385517e1 mojo::InterfaceEndpointClient::HandleIncomingMessageThunk::Accept()
#23 0x7f7f3854f630 mojo::FilterChain::Accept()
#24 0x7f7f3855364f mojo::InterfaceEndpointClient::HandleIncomingMessage()
#25 0x7f7f38567dbc mojo::internal::MultiplexRouter::ProcessIncomingMessage()
#26 0x7f7f38567644 mojo::internal::MultiplexRouter::Accept()
#27 0x7f7f3854f630 mojo::FilterChain::Accept()
#28 0x7f7f38545795 mojo::Connector::ReadSingleMessage()
#29 0x7f7f38546269 mojo::Connector::ReadAllAvailableMessages()
#30 0x7f7f385460de mojo::Connector::OnHandleReadyInternal()
#31 0x7f7f38545fdb mojo::Connector::OnWatcherHandleReady()
#32 0x7f7f3854809c _ZN4base8internal13FunctorTraitsIMN4mojo9ConnectorEFvjEvE6InvokeIPS3_JjEEEvS5_OT_DpOT0_
#33 0x7f7f38547fa6 _ZN4base8internal12InvokeHelperILb0EvE8MakeItSoIRKMN4mojo9ConnectorEFvjEJPS5_jEEEvOT_DpOT0_
#34 0x7f7f38547f37 _ZN4base8internal7InvokerINS0_9BindStateIMN4mojo9ConnectorEFvjEJNS0_17UnretainedWrapperIS4_EEEEEFvjEE7RunImplIRKS6_RKSt5tupleIJS8_EEJLm0EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEEOj
#35 0x7f7f38547e3c _ZN4base8internal7InvokerINS0_9BindStateIMN4mojo9ConnectorEFvjEJNS0_17UnretainedWrapperIS4_EEEEEFvjEE3RunEPNS0_13BindStateBaseEOj
#36 0x7f7f385010ef base::internal::RunMixin<>::Run()
#37 0x7f7f38500b0f mojo::Watcher::OnHandleReady()
#38 0x7f7f38501a2e _ZN4base8internal13FunctorTraitsIMN4mojo7WatcherEFvjEvE6InvokeIRKNS_7WeakPtrIS3_EEJRKjEEEvS5_OT_DpOT0_
#39 0x7f7f385018af _ZN4base8internal12InvokeHelperILb1EvE8MakeItSoIRKMN4mojo7WatcherEFvjERKNS_7WeakPtrIS5_EEJRKjEEEvOT_OT0_DpOT1_
#40 0x7f7f38501823 _ZN4base8internal7InvokerINS0_9BindStateIMN4mojo7WatcherEFvjEJNS_7WeakPtrIS4_EEjEEEFvvEE7RunImplIRKS6_RKSt5tupleIJS8_jEEJLm0ELm1EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEE
#41 0x7f7f3850170c _ZN4base8internal7InvokerINS0_9BindStateIMN4mojo7WatcherEFvjEJNS_7WeakPtrIS4_EEjEEEFvvEE3RunEPNS0_13BindStateBaseE
#42 0x7f7f37e74331 _ZNO4base8internal8RunMixinINS_8CallbackIFvvELNS0_8CopyModeE0ELNS0_10RepeatModeE0EEEE3RunEv
#43 0x7f7f37e73c21 base::debug::TaskAnnotator::RunTask()
#44 0x7f7f37efab9e base::MessageLoop::RunTask()
#45 0x7f7f37efae14 base::MessageLoop::DeferOrRunPendingTask()
#46 0x7f7f37efb104 base::MessageLoop::DoWork()
#47 0x7f7f37f1117c base::MessagePumpLibevent::Run()
#48 0x7f7f37efa782 base::MessageLoop::RunHandler()
#49 0x7f7f37f9d194 base::RunLoop::Run()
#50 0x000003a2fabe (anonymous namespace)::StartChildApp()
#51 0x000002804df7 _ZN4base8internal13FunctorTraitsIPFvN4mojo16InterfaceRequestIN3arc5mojom23VideoAcceleratorServiceEEEEvE6InvokeIJS7_EEEvS9_DpOT_
#52 0x000003a31f48 _ZN4base8internal12InvokeHelperILb0EvE8MakeItSoIRKPFvN4mojo16InterfaceRequestIN15service_manager5mojom7ServiceEEEEJS9_EEEvOT_DpOT0_
#53 0x000003a31f06 _ZN4base8internal7InvokerINS0_9BindStateIPFvN4mojo16InterfaceRequestIN15service_manager5mojom7ServiceEEEEJEEES9_E7RunImplIRKSA_RKSt5tupleIJEEJEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEEOS8_
#54 0x000003a31e6c _ZN4base8internal7InvokerINS0_9BindStateIPFvN4mojo16InterfaceRequestIN15service_manager5mojom7ServiceEEEEJEEES9_E3RunEPNS0_13BindStateBaseEOS8_
#55 0x0000009e46e3 base::internal::RunMixin<>::Run()
#56 0x000003a23618 service_manager::RunStandaloneService()
#57 0x000003a2f81a RunMashBrowserTests()
#58 0x000003a2f64d main
#59 0x7f7f1e2b0f45 __libc_start_main
#60 0x0000008102e5 <unknown>
  r8: 00007ffc57827698  r9: cdcdcdcdcdcdcdcd r10: fffffffffffffeb8 r11: 00007f7f1e415390
 r12: 00000000008102bc r13: 00007ffc5782b4f0 r14: 0000000000000000 r15: 0000000000000000
  di: cdcdcdcdcdcdcdcd  si: cdcdcdcdcdcdcdcd  bp: 00007ffc57826f80  bx: 0000000000000000
  dx: 0000000001dda360  ax: 0000000001dda360  cx: 000030f1fba6c000  sp: 00007ffc57826f80
  ip: 0000000001dda36c efl: 0000000000010206 cgf: 0000000000000033 erf: 0000000000000000
 trp: 000000000000000d msk: 0000000000000000 cr2: 0000000000000000
[end of stack trace]

Cc: sadrul@chromium.org
Owner: jonr...@chromium.org
Status: Assigned (was: Available)
It is suspected that ui::ws::{anonymoose}::GpuClient is accessing gpu::GPUInfo after destruction.

As this GpuClient is held in a StrongBindingPtr. While the owner of the GPUInfo, GPUHost, might be destructed earlier.

Would explain the flakiness. I'm going to investigate further locally.
Status: Started (was: Assigned)
Cc: kylec...@chromium.org
Project Member

Comment 7 by bugdroid1@chromium.org, Mar 23 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/cead65052697a1c3ec0d2fbfb7ee0ee9a9e52963

commit cead65052697a1c3ec0d2fbfb7ee0ee9a9e52963
Author: jonross <jonross@chromium.org>
Date: Thu Mar 23 22:12:36 2017

While testing expanded mash_browser_tests a flaky shutdown crash was found in GpuClient.

GpuClient::EstablishGpuChannel could be called after GpuHost or GpuClient had been deleted.

GpuClient was holding a raw pointer back to GpuHost. It's lifetime can exceed GpuHost as it exists in a StrongBindingPtr. It also was registering a callback with and Unretained pointer to itself. So it could be called post delete.

This change updates GpuHost to hold all GpuClients in a StrongBindingSet which deletes them upon shutdown.

This also updates GpuClient to register the callback with a WeakPtr to itself, so that the callback can be invalidated upon deletion.

TEST=GpuHostTest.GpuClientDestructionOrder,
GpuHostTest.HostDeletionInvalidatesGpuClientCallback
TEST=BrowserTests
BUG= 701380 
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.android:android_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel

Review-Url: https://codereview.chromium.org/2741343003
Cr-Commit-Position: refs/heads/master@{#459248}

[modify] https://crrev.com/cead65052697a1c3ec0d2fbfb7ee0ee9a9e52963/services/ui/ws/BUILD.gn
[modify] https://crrev.com/cead65052697a1c3ec0d2fbfb7ee0ee9a9e52963/services/ui/ws/DEPS
[add] https://crrev.com/cead65052697a1c3ec0d2fbfb7ee0ee9a9e52963/services/ui/ws/gpu_client.cc
[add] https://crrev.com/cead65052697a1c3ec0d2fbfb7ee0ee9a9e52963/services/ui/ws/gpu_client.h
[modify] https://crrev.com/cead65052697a1c3ec0d2fbfb7ee0ee9a9e52963/services/ui/ws/gpu_host.cc
[modify] https://crrev.com/cead65052697a1c3ec0d2fbfb7ee0ee9a9e52963/services/ui/ws/gpu_host.h
[add] https://crrev.com/cead65052697a1c3ec0d2fbfb7ee0ee9a9e52963/services/ui/ws/gpu_host_unittest.cc

Status: Fixed (was: Started)
Components: -Internals>MUS Internals>Services>WindowService

Sign in to add a comment