New issue
Advanced search Search tips

Issue 796951 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Jan 2018
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 1
Type: Bug



Sign in to add a comment

[Windows] Host crashes in IqRequest::SetTimeout while sending heartbeats

Project Member Reported by joedow@chromium.org, Dec 21 2017

Issue description

Per crash reports we have seen in the M61 and M63 host:

 # ChildEBP RetAddr  Args to Child              
00 0516ec20 770505da 745cb143 00000002 0516edf0 ntdll!KiFastSystemCallRet
01 0516ec24 745cb143 00000002 0516edf0 00000001 ntdll!NtWaitForMultipleObjects+0xa
02 0516edb8 745cb028 00000002 0516edf0 00000000 KERNELBASE!WaitForMultipleObjectsEx+0x103
*** WARNING: Unable to verify checksum for remoting_core.dll
03 0516edd4 674e92e0 00000002 0516edf0 00000000 KERNELBASE!WaitForMultipleObjects+0x18
04 0516edf8 674e9295 039e33d8 00000001 0516ee1c remoting_core!google_breakpad::CrashGenerationClient::SignalCrashEventAndWait+0x45 [c:\b\c\b\win_pgo\src\third_party\breakpad\breakpad\src\client\windows\crash_generation\crash_generation_client.cc @ 373]
05 0516ee08 674e8c22 0516ef00 00000000 039e33d8 remoting_core!google_breakpad::CrashGenerationClient::RequestDump+0x4f [c:\b\c\b\win_pgo\src\third_party\breakpad\breakpad\src\client\windows\crash_generation\crash_generation_client.cc @ 337]
06 0516ee1c 674e887c 00001bb0 0516ef00 00000000 remoting_core!google_breakpad::ExceptionHandler::WriteMinidumpWithException+0x30 [c:\b\c\b\win_pgo\src\third_party\breakpad\breakpad\src\client\windows\handler\exception_handler.cc @ 853]
07 0516ee40 7463df04 0516ef00 03c4969c 00000000 remoting_core!google_breakpad::ExceptionHandler::HandleException+0x7f [c:\b\c\b\win_pgo\src\third_party\breakpad\breakpad\src\client\windows\handler\exception_handler.cc @ 508]
08 0516eed0 7702ace5 0516ef00 770563e2 0516f864 KERNELBASE!UnhandledExceptionFilter+0x184
09 0516eed8 770563e2 0516f864 00000000 fffffffe ntdll!__RtlUserThreadStart+0x75
0a 0516eeec 77055cef 00000000 00000000 00000000 ntdll!_EH4_CallFilterFunc+0x12
0b 0516ef1c 7705a0e0 770dc244 77053f50 0516f048 ntdll!_except_handler4_common+0x7f
0c 0516ef3c 77066162 0516f048 0516f864 0516f064 ntdll!_except_handler4+0x20
0d 0516ef60 77066134 0516f048 0516f864 0516f064 ntdll!ExecuteHandler2+0x26
0e 0516f030 77054266 0516f048 0516f064 0516f048 ntdll!ExecuteHandler+0x24
0f 0516f030 671ecbce 0516f048 0516f064 0516f048 ntdll!KiUserExceptionDispatcher+0x26
10 (Inline) -------- -------- -------- -------- remoting_core!base::WeakPtrFactory<remoting::IqRequest>::GetWeakPtr+0x3 [c:\b\c\b\win_pgo\src\base\memory\weak_ptr.h @ 312]
11 0516f380 674edeb8 01c9c380 00000000 04ed4db0 remoting_core!remoting::IqRequest::SetTimeout+0x29 [c:\b\c\b\win_pgo\src\remoting\signaling\iq_sender.cc @ 146]
12 0516f47c 66d9137b 04ed4db0 0516f5f0 04ed4c70 remoting_core!remoting::HeartbeatSender::SendHeartbeat+0x152 [c:\b\c\b\win_pgo\src\remoting\host\heartbeat_sender.cc @ 158]
13 (Inline) -------- -------- -------- -------- remoting_core!base::RepeatingCallback<void __cdecl(void)>::Run+0x6 [c:\b\c\b\win_pgo\src\base\callback.h @ 92]
14 (Inline) -------- -------- -------- -------- remoting_core!base::Timer::RunScheduledTask+0x97 [c:\b\c\b\win_pgo\src\base\timer\timer.cc @ 261]
15 0516f49c 66dde708 04ed4c70 ffffffff 00000000 remoting_core!base::BaseTimerTaskInternal::Run+0xbb [c:\b\c\b\win_pgo\src\base\timer\timer.cc @ 50]
16 (Inline) -------- -------- -------- -------- remoting_core!base::OnceCallback<void __cdecl(void)>::Run+0x11 [c:\b\c\b\win_pgo\src\base\callback.h @ 64]
17 0516f510 66d7afdc 6766ea18 0516f5f0 2974c645 remoting_core!base::debug::TaskAnnotator::RunTask+0xd8 [c:\b\c\b\win_pgo\src\base\debug\task_annotator.cc @ 57]
18 (Inline) -------- -------- -------- -------- remoting_core!base::internal::IncomingTaskQueue::RunTask+0x18 [c:\b\c\b\win_pgo\src\base\message_loop\incoming_task_queue.cc @ 130]
19 0516f5d4 66d7b19b 0516f5f0 0516f720 00000005 remoting_core!base::MessageLoop::RunTask+0x2cc [c:\b\c\b\win_pgo\src\base\message_loop\message_loop.cc @ 393]
1a 0516f5e8 66d7b500 00000000 677ee370 6785cca4 remoting_core!base::MessageLoop::DeferOrRunPendingTask+0x4b [c:\b\c\b\win_pgo\src\base\message_loop\message_loop.cc @ 404]
1b 0516f68c 66dbdd69 039ee928 00000000 039ee920 remoting_core!base::MessageLoop::DoDelayedWork+0x100 [c:\b\c\b\win_pgo\src\base\message_loop\message_loop.cc @ 490]
1c 0516f6a8 66dbd555 00000000 6766eac8 0516f720 remoting_core!base::MessagePumpForIO::DoRunLoop+0x49 [c:\b\c\b\win_pgo\src\base\message_loop\message_pump_win.cc @ 485]
1d 0516f6d4 66d7ac4f 0516f720 0516f708 66d78f12 remoting_core!base::MessagePumpWin::Run+0x55 [c:\b\c\b\win_pgo\src\base\message_loop\message_pump_win.cc @ 58]
1e 0516f6e0 66d78f12 039eee88 66c6df90 039e7910 remoting_core!base::MessageLoop::Run+0xf [c:\b\c\b\win_pgo\src\base\message_loop\message_loop.cc @ 344]
1f 0516f6e8 66c6df90 039e7910 00000001 039eee88 remoting_core!base::RunLoop::Run+0x12 [c:\b\c\b\win_pgo\src\base\run_loop.cc @ 124]
20 0516f7d8 66d8cfc3 66d8cf40 66d8cf40 039e7910 remoting_core!remoting::AutoThread::ThreadMain+0x124 [c:\b\c\b\win_pgo\src\remoting\base\auto_thread.cc @ 231]
21 0516f818 76d79ba4 039e7910 76d79b80 bdcc2c6b remoting_core!base::`anonymous namespace'::ThreadFunc+0x83 [c:\b\c\b\win_pgo\src\base\threading\platform_thread_win.cc @ 91]
22 0516f82c 7702ac9b 039e7910 0747da28 00000000 kernel32!BaseThreadInitThunk+0x24
23 0516f874 7702ac6f ffffffff 770662de 00000000 ntdll!__RtlUserThreadStart+0x2b
24 0516f884 00000000 66d8cf40 039e7910 00000000 ntdll!_RtlUserThreadStart+0x1b

 
Project Member

Comment 1 by bugdroid1@chromium.org, Dec 21 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1a9f3f4ef41237aa16ff10ace1dbcb8abc3c06af

commit 1a9f3f4ef41237aa16ff10ace1dbcb8abc3c06af
Author: Joe Downing <joedow@chromium.org>
Date: Thu Dec 21 22:38:29 2017

Fixing a crash in the Heartbeat sender

This change is based on crashes we have seen in the field.  The problem appears
to occur when the HeartbeatSender creates a new Iq for a heartbeat but that Iq
fails to be sent.  The HeartbeatSender does not check for validity of the
object returned (which is nullptr if the stanza fails to send).

I think the correct action to take in this case is to call into the response
handler to indicate the failure and allow it to either disconnect or try again
later.

BUG= 796951 

Change-Id: I4ce0979d43c64d3a624f0286e22068d3ec13a3dc
Reviewed-on: https://chromium-review.googlesource.com/840268
Commit-Queue: Jamie Walch <jamiewalch@chromium.org>
Reviewed-by: Jamie Walch <jamiewalch@chromium.org>
Cr-Commit-Position: refs/heads/master@{#525832}
[modify] https://crrev.com/1a9f3f4ef41237aa16ff10ace1dbcb8abc3c06af/remoting/host/heartbeat_sender.cc

Labels: -M-64 M-65
Status: Fixed (was: Assigned)

Sign in to add a comment