The network service FYI perf bot is constantly failing recently. For example:
https://ci.chromium.org/buildbot/chromium.perf.fyi/Mojo%20Linux%20Perf/4087
(At least some) crashes have the following stack [1].
It seems the URLLoaderFactory raw pointer is invalid when it is used. This pointer is held by a WebURLLoaderImpl instance, whose loading is scheduled by ResourceLoadScheduler.
IIUC, the URLLoaderFactory pointer comes from URLLoaderFactoryBundle owned by RenderFrameImpl. This crash could happen if we schedule a WebURLLoaderImpl to run after the render frame is gone (or navigate away).
+CC some loading experts.
=================================================
[1]
Thread 0 (crashed)
0 chrome!content::ThrottlingURLLoader::StartNow(content::mojom::URLLoaderFactory*, int, int, unsigned int, base::OnceCallback<void (mojo::InterfaceRequest<content::mojom::URLLoader>, mojo::InterfacePtr<content::mojom::URLLoaderClient>)>, content::ResourceRequest const&, scoped_refptr<base::SingleThreadTaskRunner>) [throttling_url_loader.cc : 278 + 0x0]
1 chrome!content::ThrottlingURLLoader::Start(content::mojom::URLLoaderFactory*, int, int, unsigned int, base::OnceCallback<void (mojo::InterfaceRequest<content::mojom::URLLoader>, mojo::InterfacePtr<content::mojom::URLLoaderClient>)>, content::ResourceRequest const&, scoped_refptr<base::SingleThreadTaskRunner>) [throttling_url_loader.cc : 257 + 0x1c]
2 chrome!content::ThrottlingURLLoader::CreateLoaderAndStart(content::mojom::URLLoaderFactory*, std::__1::vector<std::__1::unique_ptr<content::URLLoaderThrottle, std::__1::default_delete<content::URLLoaderThrottle> >, std::__1::allocator<std::__1::unique_ptr<content::URLLoaderThrottle, std::__1::default_delete<content::URLLoaderThrottle> > > >, int, int, unsigned int, content::ResourceRequest const&, content::mojom::URLLoaderClient*, net::NetworkTrafficAnnotationTag const&, scoped_refptr<base::SingleThreadTaskRunner>) [throttling_url_loader.cc : 143 + 0x1c]
3 chrome!content::ResourceDispatcher::StartAsync(std::__1::unique_ptr<content::ResourceRequest, std::__1::default_delete<content::ResourceRequest> >, int, scoped_refptr<base::SingleThreadTaskRunner>, url::Origin const&, net::NetworkTrafficAnnotationTag const&, bool, std::__1::unique_ptr<content::RequestPeer, std::__1::default_delete<content::RequestPeer> >, blink::WebURLRequest::LoadingIPCType, content::mojom::URLLoaderFactory*, std::__1::vector<std::__1::unique_ptr<content::URLLoaderThrottle, std::__1::default_delete<content::URLLoaderThrottle> >, std::__1::allocator<std::__1::unique_ptr<content::URLLoaderThrottle, std::__1::default_delete<content::URLLoaderThrottle> > > >, mojo::StructPtr<content::mojom::URLLoaderClientEndpoints>) [resource_dispatcher.cc : 710 + 0x10]
4 chrome!content::WebURLLoaderImpl::Context::Start(blink::WebURLRequest const&, content::SyncLoadResponse*) [web_url_loader_impl.cc : 702 + 0x20]
5 chrome!content::WebURLLoaderImpl::LoadAsynchronously(blink::WebURLRequest const&, blink::WebURLLoaderClient*) [web_url_loader_impl.cc : 1294 + 0xa]
6 chrome!blink::ResourceLoader::StartWith(blink::ResourceRequest const&) [ResourceLoader.cpp : 150 + 0xe]
7 chrome!blink::ResourceLoadScheduler::MaybeRun() [ResourceLoadScheduler.cpp : 655 + 0x8]
8 chrome!blink::ResourceLoadScheduler::Release(unsigned long, blink::ResourceLoadScheduler::ReleaseOption, blink::ResourceLoadScheduler::TrafficReportHints const&) [ResourceLoadScheduler.h : 0 + 0x10]
9 chrome!blink::ResourceLoader::HandleError(blink::ResourceError const&) [ResourceLoader.cpp : 157 + 0xa]
10 chrome!blink::ResourceLoader::DidReceiveResponse(blink::WebURLResponse const&, std::__1::unique_ptr<blink::WebDataConsumerHandle, std::__1::default_delete<blink::WebDataConsumerHandle> >) [ResourceLoader.cpp : 0 + 0x5]
11 chrome!non-virtual thunk to blink::ResourceLoader::DidReceiveResponse(blink::WebURLResponse const&) [ResourceLoader.cpp : 601 + 0x5]
12 chrome!content::WebURLLoaderImpl::Context::OnReceivedResponse(content::ResourceResponseInfo const&) [web_url_loader_impl.cc : 822 + 0x5]
13 chrome!content::ResourceDispatcher::OnReceivedResponse(int, content::ResourceResponseHead const&) [resource_dispatcher.cc : 228 + 0x6]
14 chrome!content::URLLoaderClientImpl::OnReceiveResponse(content::ResourceResponseHead const&, base::Optional<net::SSLInfo> const&, mojo::InterfacePtr<content::mojom::DownloadedTempFile>) [url_loader_client_impl.cc : 232 + 0x8]
15 chrome!content::ThrottlingURLLoader::OnReceiveResponse(content::ResourceResponseHead const&, base::Optional<net::SSLInfo> const&, mojo::InterfacePtr<content::mojom::DownloadedTempFile>) [throttling_url_loader.cc : 350 + 0x17]
16 chrome!content::mojom::URLLoaderClientStubDispatch::Accept(content::mojom::URLLoaderClient*, mojo::Message*) [url_loader.mojom.cc : 917 + 0x9]
17 chrome!mojo::InterfaceEndpointClient::HandleIncomingMessageThunk::Accept(mojo::Message*) [interface_endpoint_client.cc : 418 + 0x38]
18 chrome!mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) [multiplex_router.cc : 880 + 0x8]
19 chrome!mojo::internal::MultiplexRouter::Accept(mojo::Message*) [multiplex_router.cc : 604 + 0xb]
20 chrome!mojo::Connector::ReadSingleMessage(unsigned int*) [connector.cc : 445 + 0x3]
21 chrome!mojo::Connector::ReadAllAvailableMessages() [connector.cc : 474 + 0xb]
22 chrome!mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) [callback.h : 94 + 0x9]
23 chrome!base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) [callback.h : 65 + 0x3]
24 chrome!blink::scheduler::TaskQueueManager::DoWork(blink::scheduler::internal::Sequence::WorkType) [task_queue_manager.cc : 516 + 0xf]
25 chrome!base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) [callback.h : 65 + 0x3]
26 chrome!blink::scheduler::internal::ThreadControllerImpl::DoWork(blink::scheduler::internal::Sequence::WorkType) [thread_controller_impl.cc : 109 + 0xf]
27 chrome!base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) [callback.h : 65 + 0x3]
28 chrome!base::MessageLoop::RunTask(base::PendingTask*) [message_loop.cc : 391 + 0x8]
29 chrome!base::MessageLoop::DoWork() [message_loop.cc : 403 + 0xb]
30 chrome!base::MessagePumpDefault::Run(base::MessagePump::Delegate*) [message_pump_default.cc : 37 + 0x17]
31 chrome!<name omitted> [run_loop.cc : 130 + 0x8]
32 chrome!content::RendererMain(content::MainFunctionParams const&) [renderer_main.cc : 222 + 0x8]
33 chrome!content::ContentMainRunnerImpl::Run() [content_main_runner.cc : 356 + 0x4]
34 chrome!service_manager::Main(service_manager::MainParams const&) [main.cc : 456 + 0x1e]
35 chrome!content::ContentMain(content::ContentMainParams const&) [content_main.cc : 19 + 0x8]
36 chrome!ChromeMain [chrome_main.cc : 128 + 0x5]
37 libc-2.19.so + 0x21f45
38 chrome + 0x18157c0
39 chrome + 0x1701000
40 ld-2.19.so + 0x103c3
41 chrome + 0x1701000
42 chrome!_start + 0x2a
Comment 1 by yhirano@chromium.org
, Dec 21 2017