New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 808071 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: Feb 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , Chrome , Mac , Fuchsia
Pri: 2
Type: Bug



Sign in to add a comment

S13nServiceWorker Flaky. controller_service_worker_connector.cc Check failed: State::kNoContainerHost != state_

Project Member Reported by arthurso...@chromium.org, Feb 1 2018

Issue description

Repro steps:
(1) Add a delay in SendSetControllerServiceWorker().
    example: https://chromium-review.googlesource.com/897629

Then several tests will crash with the network service enabled.
For instance: external/wpt/service-workers/service-worker/controller-on-disconnect.https.html 

Stack trace:
```
[1:1:0201/175238.742269:FATAL:controller_service_worker_connector.cc(77)] Check failed: State::kNoContainerHost != state_ (3 vs. 3)
#0 0x7fc2cf9cfc2d base::debug::StackTrace::StackTrace()
#1 0x7fc2cf9ce11c base::debug::StackTrace::StackTrace()
#2 0x7fc2cfa5682a logging::LogMessage::~LogMessage()
#3 0x7fc2d38a0174 content::ControllerServiceWorkerConnector::ResetControllerConnection()
#4 0x7fc2d38e982e content::ServiceWorkerProviderContext::SetController()
#5 0x7fc2d13cd811 content::mojom::ServiceWorkerContainerStubDispatch::Accept()
```

I found it will trying to apply https://docs.google.com/document/d/1dvvksKQYWEnUdOcjkyreaTOxJD9L4Gybszb5mxrSzHk/
with NavigationMojoResponse. I have the same DCHECK triggered and that's the last thing I need to fix before publishing my CL.

I will work on it tomorrow, but if you already understand the issue today, let me know ;-)
 
Project Member

Comment 1 by bugdroid1@chromium.org, Feb 6 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/4b597a8953893e33a4c76b987093655a71c87a2a

commit 4b597a8953893e33a4c76b987093655a71c87a2a
Author: arthursonzogni <arthursonzogni@chromium.org>
Date: Tue Feb 06 17:41:04 2018

ControllerServiceWorkerConnector: Remove DCHECK.

All of this happens when S13nServiceWorker is enabled.

The removed DCHECK was here to enforce that the ControllerServiceWorker
is not updated after container host connection has been closed.

A race condition can happen and triggers this DCHECK. After
CommitNavigation(), if the browser process is slow enough, a javascript
call can delete the iframe before the OnProviderCreated/SetController
round trip between the browser and the renderer has been made.

Deleting the iframe cause OnContainerHostConnectionClose() to be called. It
happens before receiving the SetController call.

┌───────┐           ┌────────┐
│Browser│           │Renderer│
└───┬───┘           └───┬────┘
    │CommitNavigation() │
    │──────────────────>│ (ResetController())
    │                   │
    │OnProviderCreated()│
    │<──────────────────│
    │─┐                 │─┐
    │ │                 │ │ Remove the iframe.
    │ │                 │ │ (OnContainerHostConnectionClose())
    │ │ Sleep...        │<┘
    │ │                 │
    │<┘                 │
    │                   │
    │  SetController()  │
    │──────────────────>│ (ResetController())
┌───┴───┐           ┌───┴────┐
│Browser│           │Renderer│
└───────┘           └────────┘

Note: The CL...
https://chromium-review.googlesource.com/897629
...shows adding a delay in the browser process causes several service
worker tests to fail.

Note: Doing SetController() on response to OnProviderCreated() is no really
necessary since thttps://goo.gl/UztxVi was implemented by
https://chromium-review.googlesource.com/742961.
This was kept to update UseCounter.

Bug:  808071 
Change-Id: I46c4fd8e4db7eb4ed5e304bb1989d36d552567ad
Reviewed-on: https://chromium-review.googlesource.com/899143
Commit-Queue: Arthur Sonzogni <arthursonzogni@chromium.org>
Reviewed-by: Matt Falkenhagen <falken@chromium.org>
Reviewed-by: Kinuko Yasuda <kinuko@chromium.org>
Cr-Commit-Position: refs/heads/master@{#534706}
[modify] https://crrev.com/4b597a8953893e33a4c76b987093655a71c87a2a/content/renderer/service_worker/controller_service_worker_connector.cc

Owner: arthurso...@chromium.org
Status: Fixed (was: Available)
Cc: jam@chromium.org nasko@chromium.org
Labels: -Pri-3 Merge-Request-65 OS-Android OS-Chrome OS-Fuchsia OS-Linux OS-Mac OS-Windows Pri-2
I would like to merge in M65 two patches together:
*  https://crbug.com/705744  (https://crrev.com/535339) 
*  https://crbug.com/808071  (https://crrev.com/534706) <- Here in comment 1.

They have been on M66 canary for a few days in 66.0.3344.0 (Feb 8) and 66.0.3342.0 (Feb 6).

They are fixing a potential race condition issue between Service workers and NavigationMojoResponse.
NavigationMojoResponse is disabled by default and finch is used. There is a 50%/50% experiment on M65 Canary. I would like to merge these two patches in order to move the experiment from Canary to Dev and get some performance statistics. I do not plan to continue the experiment further than beta in M65.

Risk is low because these two patches are modifying a code path that is not used by default (NavigationMojoResponse and/or S13nServiceWorker). Finch can be used to disable the experiment on Canary/Dev if needed.

FYI: NavigationMojoResponse launch bug: https://crbug.com/805851.
Project Member

Comment 4 by sheriffbot@chromium.org, Feb 12 2018

Labels: -Merge-Request-65 Merge-Review-65 Hotlist-Merge-Review
This bug requires manual review: M65 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), bhthompson@(ChromeOS), govind@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 5 by bugdroid1@chromium.org, Feb 12 2018

Labels: merge-merged-3325
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e65a98e0c0fd06e32226c03a4057d6dc8c3c2cd4

commit e65a98e0c0fd06e32226c03a4057d6dc8c3c2cd4
Author: arthursonzogni <arthursonzogni@chromium.org>
Date: Mon Feb 12 18:41:48 2018

ControllerServiceWorkerConnector: Remove DCHECK.

All of this happens when S13nServiceWorker is enabled.

The removed DCHECK was here to enforce that the ControllerServiceWorker
is not updated after container host connection has been closed.

A race condition can happen and triggers this DCHECK. After
CommitNavigation(), if the browser process is slow enough, a javascript
call can delete the iframe before the OnProviderCreated/SetController
round trip between the browser and the renderer has been made.

Deleting the iframe cause OnContainerHostConnectionClose() to be called. It
happens before receiving the SetController call.

┌───────┐           ┌────────┐
│Browser│           │Renderer│
└───┬───┘           └───┬────┘
    │CommitNavigation() │
    │──────────────────>│ (ResetController())
    │                   │
    │OnProviderCreated()│
    │<──────────────────│
    │─┐                 │─┐
    │ │                 │ │ Remove the iframe.
    │ │                 │ │ (OnContainerHostConnectionClose())
    │ │ Sleep...        │<┘
    │ │                 │
    │<┘                 │
    │                   │
    │  SetController()  │
    │──────────────────>│ (ResetController())
┌───┴───┐           ┌───┴────┐
│Browser│           │Renderer│
└───────┘           └────────┘

Note: The CL...
https://chromium-review.googlesource.com/897629
...shows adding a delay in the browser process causes several service
worker tests to fail.

Note: Doing SetController() on response to OnProviderCreated() is no really
necessary since thttps://goo.gl/UztxVi was implemented by
https://chromium-review.googlesource.com/742961.
This was kept to update UseCounter.

Bug:  808071 
Change-Id: I46c4fd8e4db7eb4ed5e304bb1989d36d552567ad
Reviewed-on: https://chromium-review.googlesource.com/899143
Commit-Queue: Arthur Sonzogni <arthursonzogni@chromium.org>
Reviewed-by: Matt Falkenhagen <falken@chromium.org>
Reviewed-by: Kinuko Yasuda <kinuko@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#534706}(cherry picked from commit 4b597a8953893e33a4c76b987093655a71c87a2a)
Reviewed-on: https://chromium-review.googlesource.com/913953
Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org>
Cr-Commit-Position: refs/branch-heads/3325@{#427}
Cr-Branched-From: bc084a8b5afa3744a74927344e304c02ae54189f-refs/heads/master@{#530369}
[modify] https://crrev.com/e65a98e0c0fd06e32226c03a4057d6dc8c3c2cd4/content/renderer/service_worker/controller_service_worker_connector.cc

Comment 6 by cmasso@google.com, Feb 12 2018

Was this cl merged without merge approval?

Comment 7 by gov...@chromium.org, Feb 12 2018

cmasso@, CL listed at #5 was approved for merge at - https://bugs.chromium.org/p/chromium/issues/detail?id=705744#c59.

Comment 8 by gov...@chromium.org, Feb 13 2018

This is already merged to M65 at comment #5. If nothing is pending for M65, pls remove "Merge-Review-65" label. Thank you.
Labels: -Merge-Review-65
Everything has been merged.

Sign in to add a comment