New issue
Advanced search Search tips

Issue 819792 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: May 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 1
Type: Bug

Blocking:
issue 717696



Sign in to add a comment

[Incompatible Applications] Race condition in UninstallAppController::AutomationControllerDelegate::OnFocusChangedEvent

Project Member Reported by pmonette@chromium.org, Mar 7 2018

Issue description

The OnceCallback can get invoked multiple time if a focus event happens between posting the task to delete the delegate and its execution.
 
Project Member

Comment 1 by bugdroid1@chromium.org, Mar 12 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/77bf3236c295fa1c17be5cb89afca7d64ce25694

commit 77bf3236c295fa1c17be5cb89afca7d64ce25694
Author: Patrick Monette <pmonette@chromium.org>
Date: Mon Mar 12 20:14:39 2018

[3p-Conflicts] Fix a race condition in UninstallAppController.

It was possible to have repeated call to OnFocusChangedEvent() between
the time the name was written in the search box, and the actual destruction
of the automation controller, which unregisters the event handlers.

Bug:  819792 
Change-Id: Ied95051f7ebb07e954b8c5d7d3cff0d3e7574daa
Reviewed-on: https://chromium-review.googlesource.com/955744
Commit-Queue: Patrick Monette <pmonette@chromium.org>
Reviewed-by: Greg Thompson <grt@chromium.org>
Cr-Commit-Position: refs/heads/master@{#542580}
[modify] https://crrev.com/77bf3236c295fa1c17be5cb89afca7d64ce25694/chrome/browser/conflicts/uninstall_application_win.cc

Labels: Merge-Request-66
Requesting a merge for M66 for a bug fix for the 3rd party software blocking feature.
Project Member

Comment 3 by sheriffbot@chromium.org, Mar 13 2018

Labels: -Merge-Request-66 Merge-Approved-66 Hotlist-Merge-Approved
Your change meets the bar and is auto-approved for M66. Please go ahead and merge the CL to branch 3359 manually. Please contact milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), josafat@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 4 by bugdroid1@chromium.org, Mar 13 2018

Labels: -merge-approved-66 merge-merged-3359
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e2a2d304429a50b69f62bfef72ecce6a6bf70539

commit e2a2d304429a50b69f62bfef72ecce6a6bf70539
Author: Patrick Monette <pmonette@chromium.org>
Date: Tue Mar 13 20:48:28 2018

[3p-Conflicts] Fix a race condition in UninstallAppController.

It was possible to have repeated call to OnFocusChangedEvent() between
the time the name was written in the search box, and the actual destruction
of the automation controller, which unregisters the event handlers.

Bug:  819792 
Change-Id: Ied95051f7ebb07e954b8c5d7d3cff0d3e7574daa
Reviewed-on: https://chromium-review.googlesource.com/955744
Commit-Queue: Patrick Monette <pmonette@chromium.org>
Reviewed-by: Greg Thompson <grt@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#542580}(cherry picked from commit 77bf3236c295fa1c17be5cb89afca7d64ce25694)
Reviewed-on: https://chromium-review.googlesource.com/961382
Reviewed-by: Patrick Monette <pmonette@chromium.org>
Cr-Commit-Position: refs/branch-heads/3359@{#216}
Cr-Branched-From: 66afc5e5d10127546cc4b98b9117aff588b5e66b-refs/heads/master@{#540276}
[modify] https://crrev.com/e2a2d304429a50b69f62bfef72ecce6a6bf70539/chrome/browser/conflicts/uninstall_application_win.cc

Status: Fixed (was: Assigned)
Status: Assigned (was: Fixed)
Turns out this isn't completely fixed.

OnFocusChangedEvent() can be invoked concurrently on different threads which creates a race condition between checking the value of |on_automation_finished_| and using it.
Project Member

Comment 7 by bugdroid1@chromium.org, Mar 22 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2862ec0766a231717843687ae7316739d455b890

commit 2862ec0766a231717843687ae7316739d455b890
Author: Patrick Monette <pmonette@chromium.org>
Date: Thu Mar 22 19:30:27 2018

Synchronize access to the AutomationControllerDelegate

The OnFocusChangedEvent() and OnAutomationEvent() methods can be invoked
concurrently. This means that accesses to member variables must be
synchronized using a lock.

Bug:  819792 
Change-Id: I22c08d820b0cb877e52e1cb3bb6cd7c5b316dd62
Reviewed-on: https://chromium-review.googlesource.com/971863
Commit-Queue: Patrick Monette <pmonette@chromium.org>
Reviewed-by: Greg Thompson <grt@chromium.org>
Cr-Commit-Position: refs/heads/master@{#545202}
[modify] https://crrev.com/2862ec0766a231717843687ae7316739d455b890/chrome/browser/conflicts/uninstall_application_win.cc
[modify] https://crrev.com/2862ec0766a231717843687ae7316739d455b890/chrome/browser/win/settings_app_monitor.cc

Labels: -Hotlist-Merge-Approved -merge-merged-3359 Merge-Request-66
Requesting merge for a bugfix to m66. The request refers to comment #7, 

commit 2862ec0766a231717843687ae7316739d455b890
Author: Patrick Monette <pmonette@chromium.org>
Date: Thu Mar 22 19:30:27 2018

Synchronize access to the AutomationControllerDelegate
Hi owners,

This CL is needed in m66 because we're committed externally to launching the Incompatible Applications feature in m66, and this is an important bug fix for that feature.

https://blog.chromium.org/2017/11/reducing-chrome-crashes-caused-by-third.html
Project Member

Comment 10 by sheriffbot@chromium.org, Mar 23 2018

Labels: -Merge-Request-66 Merge-Review-66 Hotlist-Merge-Review
This bug requires manual review: M66 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), josafat@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: -Merge-Review-66 Merge-Approved-66
Approving merge to M66. Branch:3359
Project Member

Comment 12 by bugdroid1@chromium.org, Mar 26 2018

Labels: -merge-approved-66 merge-merged-3359
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/448b01c748f0f264e2730f103b5e4c40a7b1863a

commit 448b01c748f0f264e2730f103b5e4c40a7b1863a
Author: Patrick Monette <pmonette@chromium.org>
Date: Mon Mar 26 18:32:47 2018

Synchronize access to the AutomationControllerDelegate

The OnFocusChangedEvent() and OnAutomationEvent() methods can be invoked
concurrently. This means that accesses to member variables must be
synchronized using a lock.

Bug:  819792 
Change-Id: I22c08d820b0cb877e52e1cb3bb6cd7c5b316dd62
Reviewed-on: https://chromium-review.googlesource.com/971863
Commit-Queue: Patrick Monette <pmonette@chromium.org>
Reviewed-by: Greg Thompson <grt@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#545202}(cherry picked from commit 2862ec0766a231717843687ae7316739d455b890)
Reviewed-on: https://chromium-review.googlesource.com/980895
Reviewed-by: Patrick Monette <pmonette@chromium.org>
Cr-Commit-Position: refs/branch-heads/3359@{#443}
Cr-Branched-From: 66afc5e5d10127546cc4b98b9117aff588b5e66b-refs/heads/master@{#540276}
[modify] https://crrev.com/448b01c748f0f264e2730f103b5e4c40a7b1863a/chrome/browser/conflicts/uninstall_application_win.cc
[modify] https://crrev.com/448b01c748f0f264e2730f103b5e4c40a7b1863a/chrome/browser/win/settings_app_monitor.cc

Status: Fixed (was: Assigned)

Sign in to add a comment