New issue
Advanced search Search tips

Issue 712391 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Apr 2017
Cc:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Bug



Sign in to add a comment

Incorrect memory management for TabModel's WebStateListFastEnumerationHelper

Project Member Reported by kkhorimoto@chromium.org, Apr 17 2017

Issue description

There have been several crashes that are occurring due to a DCHECK in the WebStateList observer list |-dealloc|, where the observer list expects to be emptied before deallocation.  These failures haven't been tree closers because the issues are fixed when the tests are run individually.  Here's a sample failure: https://uberchromegw.corp.google.com/i/internal.bling.main/builders/iphone10-simulator/builds/5042/steps/ios_chrome_integration_egtests%20%28iPhone%205%20iOS%2010.0%29%20on%20Mac

I spent some time today digging into this and discovered that the WebStateListFastEnumerationHelper's WebStateListObserverBridge is being added as an observer from TabModel's initializer, and this is sometimes not removed.  It is likely that the enumeration helper is being autoreleased, so we may be able to resolve this by wrapping some portion of the test in an autorelease pool.
 
Status: Started (was: Assigned)
This is caused by https://codereview.chromium.org/2809543003/. I guess the proper fix is to expose a method -shutdown that unregister WebStateListFastEnumerationHelper from WebStateList as we cannot control the order of the -dealloc (the @autoreleasepool that was added with the CL is apparently not enough).

Or maybe better, convert WebStateListFastEnumerationHelper to a C++ class to have proper control on destruction order.
Status: Fixed (was: Started)

Sign in to add a comment