New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 761420 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Sep 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 3
Type: Bug



Sign in to add a comment

DCHECK(IsAllowingChanges()) failed on browser startup in SharedModelTypeProcessor::Put

Project Member Reported by w...@chromium.org, Sep 1 2017

Issue description

Chrome Version: 62.0.3202.1 (Official Build) canary SyzyASan (32-bit) (cohort: ASAN) w/ DcheckIsFatal
OS: Windows 10

What steps will reproduce the problem?
(Sorry not sure what specifically triggers this, but here's what I did)
(1) Opt-in to the SyzyASAN canary build.
(2) Use it for a while, so you have browsing state, are signed-in and syncing, etc.
(3) In about:flags, enable DCHECKs, and restart.

What happens instead?

Browser reloaded to the point of showing my previous session tabs, all with loading spinners, and then crashed. See crash Id 06822836e2818a0c
 

Comment 1 by s...@chromium.org, Sep 1 2017

Cc: pav...@chromium.org
Owner: s...@chromium.org
Status: Assigned (was: Untriaged)

Comment 2 by s...@chromium.org, Sep 1 2017

Status: Started (was: Assigned)
The ModelType is USER_EVENTS, looks like I made a mistake in the bridge implementation, I'm sending changes to the processor before the processor is accepting changes [1][2].

Looks like similar bridge's simply check IsTrackingMetadata() [3] before calling Put() on the processor. While we're here, I guess we could audit all the bridges to make sure no one else is making "mistake".

I'm not thrilled that this issue exists, it feels like a trap. Yes, there's a subtle distinction between is the processor is waiting for metadata vs initial sync for the type is done. However, how much state tracking do we want to force onto bridges?

I think DCHECK was initially created to help bridge implementations realize when they forget to send metadata to the proc. But if everyone guards their Put()s with IsTrackingMetadata(), we're back to square one. If we wanted to force bridges to check in with the proc before they constructed EntityData, it should be more obvious than this.

To quickly mention impact of this, it doesn't look like this DCHECK really matters, we're simply returning early if the processor isn't ready to track changes [4]. This seems to be the only crash with this signature [5], probably because most people with DCHECKs enabled don't have crash reporting enabled. I'd guess we're probably crashing a handful of developers' chromium builds everyday with this issue. But for user builds w/o DCHECKs, this is harmless. Won't need to merge a fix back to any branches or turn down USER_EVENTS.

[1] https://cs.chromium.org/chromium/src/components/sync/user_events/user_event_sync_bridge.cc?l=180
[2] https://cs.chromium.org/chromium/src/components/sync/model_impl/shared_model_type_processor.cc?l=209
[3] https://cs.chromium.org/chromium/src/components/sync/device_info/device_info_sync_bridge.cc?l=447
[4] https://cs.chromium.org/chromium/src/components/sync/model_impl/shared_model_type_processor.cc?l=217
[5] https://crash.corp.google.com/browse?q=custom_data.ChromeCrashProto.magic_signature_1.name%3D%27%5BAssert%5D%20syncer%3A%3ASharedModelTypeProcessor%3A%3APut%27&ignore_case=false&enable_rewrite=true&omit_field_name=&omit_field_value=&omit_field_opt=%3D&unnest=#samplereports

Comment 4 by s...@chromium.org, Sep 1 2017

Labels: Sync-V2
Just kidding, it seems TypedUrlsSyncBridge actually does correctly check https://cs.chromium.org/chromium/src/components/history/core/browser/typed_url_sync_bridge.cc?l=346 , changing UserEventSyncBridge for now, since it seems I'm really the only one that cannot get this right :)

Pavel, let's talk about this during our USS meeting next week.

Comment 5 by s...@chromium.org, Sep 1 2017

Created  issue 761485  to track the larger issue.

Comment 6 by w...@chromium.org, Sep 2 2017

Thanks for the quick investigation & response. :)
Project Member

Comment 7 by bugdroid1@chromium.org, Sep 5 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/35bc18751ffff64a565119fe22224179ae78f721

commit 35bc18751ffff64a565119fe22224179ae78f721
Author: Sky Malice <skym@chromium.org>
Date: Tue Sep 05 23:17:58 2017

[Sync] Drop UserEvents before the proc is ready.

Processors do not want to receive changes from ModelTypeSyncBridge
implementations when they're not tracking metadata changes, so check
and don't call Put() for UserEvents if that is the case. This is more
or less a hack, because we're forced to drop the whole event on the
floor because our metadata loading process is async. Fixing this in a
more satisfactory way will be tracked in  crbug.com/761485 .

Bug:  761420 
Change-Id: Ia4209c129eeeedbc8f774ddfbe050aaaa4469fdb
Reviewed-on: https://chromium-review.googlesource.com/647350
Reviewed-by: Pavel Yatsuk <pavely@chromium.org>
Commit-Queue: Sky Malice <skym@chromium.org>
Cr-Commit-Position: refs/heads/master@{#499787}
[modify] https://crrev.com/35bc18751ffff64a565119fe22224179ae78f721/components/sync/user_events/user_event_sync_bridge.cc
[modify] https://crrev.com/35bc18751ffff64a565119fe22224179ae78f721/components/sync/user_events/user_event_sync_bridge_unittest.cc

Comment 8 by s...@chromium.org, Sep 5 2017

Status: Fixed (was: Started)

Sign in to add a comment