New issue
Advanced search Search tips

Issue 716348 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Jan 15
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug



Sign in to add a comment

ProcessManagerFactory is missing dependency on LazyBackgroundTaskQueueFactory

Project Member Reported by grt@chromium.org, Apr 28 2017

Issue description

ProcessManager::WakeEventPage calls LazyBackgroundTaskQueue::Get as of r327412, yet ProcessManagerFactory doesn't add a dependency to LazyBackgroundTaskQueue's factory. Hence, shutdown order badness (crash/a398553480000000):

00 000000b5`d42fe5b0 00007ffd`107cd4c2 chrome_elf!DumpProcessWithoutCrash+0x23 [c:\b\build\slave\win64-pgo\build\src\components\crash\content\app\crashpad_win.cc @ 138]
01 (Inline Function) --------`-------- chrome_7ffd0f390000!base::debug::DumpWithoutCrashing+0xe [c:\b\build\slave\win64-pgo\build\src\base\debug\dump_without_crashing.cc @ 23]
02 000000b5`d42feac0 00007ffd`10bc4b69 chrome_7ffd0f390000!DependencyManager::AssertContextWasntDestroyed+0x4a [c:\b\build\slave\win64-pgo\build\src\components\keyed_service\core\dependency_manager.cc @ 117]
03 (Inline Function) --------`-------- chrome_7ffd0f390000!KeyedServiceBaseFactory::AssertContextWasntDestroyed+0x9 [c:\b\build\slave\win64-pgo\build\src\components\keyed_service\core\keyed_service_base_factory.cc @ 87]
04 000000b5`d42feaf0 00007ffd`107cbc05 chrome_7ffd0f390000!BrowserContextKeyedServiceFactory::GetContextToUse+0x19 [c:\b\build\slave\win64-pgo\build\src\components\keyed_service\content\browser_context_keyed_service_factory.cc @ 103]
05 000000b5`d42feb20 00007ffd`0faeebe9 chrome_7ffd0f390000!KeyedServiceFactory::GetServiceForContext+0xe5 [c:\b\build\slave\win64-pgo\build\src\components\keyed_service\core\keyed_service_factory.cc @ 63]
06 000000b5`d42fec30 00007ffd`10c8f213 chrome_7ffd0f390000!extensions::ProcessManager::WakeEventPage+0x39 [c:\b\build\slave\win64-pgo\build\src\extensions\browser\process_manager.cc @ 454]
07 000000b5`d42fec70 00007ffd`10c8f0d0 chrome_7ffd0f390000!media_router::MediaRouterMojoImpl::AttemptWakeEventPage+0xff [c:\b\build\slave\win64-pgo\build\src\chrome\browser\media\router\mojo\media_router_mojo_impl.cc @ 887]
08 000000b5`d42fecc0 00007ffd`10c8d920 chrome_7ffd0f390000!media_router::MediaRouterMojoImpl::RunOrDefer+0x44 [c:\b\build\slave\win64-pgo\build\src\chrome\browser\media\router\mojo\media_router_mojo_impl.cc @ 859]
09 000000b5`d42fecf0 00007ffd`10c96413 chrome_7ffd0f390000!media_router::MediaRouterMojoImpl::UnregisterMediaRoutesObserver+0x130 [c:\b\build\slave\win64-pgo\build\src\chrome\browser\media\router\mojo\media_router_mojo_impl.cc @ 536]
0a 000000b5`d42feda0 00007ffd`10e80f5c chrome_7ffd0f390000!media_router::MediaRoutesObserver::~MediaRoutesObserver+0x23 [c:\b\build\slave\win64-pgo\build\src\chrome\browser\media\router\media_routes_observer.cc @ 22]
0b 000000b5`d42fedd0 00007ffd`11602abc chrome_7ffd0f390000!MediaRouterActionController::~MediaRouterActionController+0x34 [c:\b\build\slave\win64-pgo\build\src\chrome\browser\ui\toolbar\media_router_action_controller.cc @ 24]
0c 000000b5`d42fee00 00007ffd`11602a84 chrome_7ffd0f390000!media_router::MediaRouterUIService::~MediaRouterUIService+0x1c [c:\b\build\slave\win64-pgo\build\src\chrome\browser\media\router\media_router_ui_service.cc @ 16]
0d 000000b5`d42fee30 00007ffd`107cbec8 chrome_7ffd0f390000!media_router::MediaRouterUIService::`scalar deleting destructor'+0x14
0e 000000b5`d42fee60 00007ffd`107cbf55 chrome_7ffd0f390000!KeyedServiceFactory::Disassociate+0x58 [c:\b\build\slave\win64-pgo\build\src\components\keyed_service\core\keyed_service_factory.cc @ 106]
0f 000000b5`d42fee90 00007ffd`10bc5005 chrome_7ffd0f390000!KeyedServiceFactory::ContextDestroyed+0x15 [c:\b\build\slave\win64-pgo\build\src\components\keyed_service\core\keyed_service_factory.cc @ 123]
10 (Inline Function) --------`-------- chrome_7ffd0f390000!DependencyManager::DestroyContextServices+0xfe [c:\b\build\slave\win64-pgo\build\src\components\keyed_service\core\dependency_manager.cc @ 100]
11 000000b5`d42feec0 00007ffd`10f111c2 chrome_7ffd0f390000!BrowserContextDependencyManager::DestroyBrowserContextServices+0x115 [c:\b\build\slave\win64-pgo\build\src\components\keyed_service\content\browser_context_dependency_manager.cc @ 52]
12 000000b5`d42fef40 00007ffd`10f100f4 chrome_7ffd0f390000!ProfileImpl::~ProfileImpl+0x136 [c:\b\build\slave\win64-pgo\build\src\chrome\browser\profiles\profile_impl.cc @ 743]

 
Project Member

Comment 1 by bugdroid1@chromium.org, May 17 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/994885e87e81f4d513a81ff2730cb5a2a240793b

commit 994885e87e81f4d513a81ff2730cb5a2a240793b
Author: kmarshall <kmarshall@chromium.org>
Date: Wed May 17 18:10:10 2017

ProcessManagerFactory: fix dependencies in ApiResourceManager, LazyBgndTaskFactory

ProcessManagerFactory: add dependency on LazyBgndTaskFactory.
The absence of a factory is causing some crashes on shutdown
(see bug).

Add service dependencies from ApiResourceManager to
ExtensionRegistryFactory and ProcessManagerFactory.
ApiResourceManager is holding scoped observer objects on
those services. The observed objects must be alive when
the observers are unregistered, otherwise a use after free
condition may occur.

Add template struct-based dependency registration system,
necessary for supporting type inference using partial
specialization.

R=benwells@chromium.org
BUG= 716348 

Review-Url: https://codereview.chromium.org/2863213004
Cr-Commit-Position: refs/heads/master@{#472495}

[modify] https://crrev.com/994885e87e81f4d513a81ff2730cb5a2a240793b/extensions/browser/api/api_resource_manager.h
[modify] https://crrev.com/994885e87e81f4d513a81ff2730cb5a2a240793b/extensions/browser/browser_context_keyed_api_factory.h
[modify] https://crrev.com/994885e87e81f4d513a81ff2730cb5a2a240793b/extensions/browser/process_manager_factory.cc

Status: Fixed (was: Assigned)

Sign in to add a comment