New issue
Advanced search Search tips

Issue 862597 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Jul 20
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 3
Type: Bug



Sign in to add a comment

ExtensionMessageFilter::ShutdownOnUIThread has a data race

Project Member Reported by reillyg@chromium.org, Jul 11

Issue description

The |browser_context_| member of ExtensionMessageFilter is read in OnMessageReceived() on the IO thread but reset to null during shutdown on the UI thread. This is racy and causing browser tests to fail flakily on the TSan bots.

Example: https://chromium-swarm.appspot.com/task?id=3ea27d1191c6bf10

WARNING: ThreadSanitizer: data race (pid=21144)
  Write of size 8 at 0x7b240000cb90 by main thread:
    #0 extensions::ExtensionMessageFilter::ShutdownOnUIThread() extensions/browser/extension_message_filter.cc:83:20 (extensions_browsertests+0x1a7f335)
    #1 Invoke<void (extensions::ExtensionMessageFilter::*)(), extensions::ExtensionMessageFilter *> base/bind_internal.h:507:12 (extensions_browsertests+0x1a830f8)
    #2 MakeItSo<void (extensions::ExtensionMessageFilter::*const &)(), extensions::ExtensionMessageFilter *> base/bind_internal.h:607 (extensions_browsertests+0x1a830f8)
    #3 RunImpl<void (extensions::ExtensionMessageFilter::*const &)(), const std::__1::tuple<base::internal::UnretainedWrapper<extensions::ExtensionMessageFilter> > &, 0> base/bind_internal.h:680 (extensions_browsertests+0x1a830f8)
    #4 base::internal::Invoker<base::internal::BindState<void (extensions::ExtensionMessageFilter::*)(), base::internal::UnretainedWrapper<extensions::ExtensionMessageFilter> >, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:662 (extensions_browsertests+0x1a830f8)
    #5 Run base/callback.h:129:12 (extensions_browsertests+0x66cedf6)
    #6 Notify<> base/callback_list.h:216 (extensions_browsertests+0x66cedf6)
    #7 KeyedServiceShutdownNotifier::Shutdown() components/keyed_service/core/keyed_service_shutdown_notifier.cc:19 (extensions_browsertests+0x66cedf6)
    #8 KeyedServiceFactory::ContextShutdown(base::SupportsUserData*) components/keyed_service/core/keyed_service_factory.cc:113:17 (extensions_browsertests+0x66ce474)
    #9 BrowserContextKeyedServiceFactory::BrowserContextShutdown(content::BrowserContext*) components/keyed_service/content/browser_context_keyed_service_factory.cc:84:24 (extensions_browsertests+0x66ca330)
    #10 BrowserContextKeyedServiceFactory::ContextShutdown(base::SupportsUserData*) components/keyed_service/content/browser_context_keyed_service_factory.cc:118:3 (extensions_browsertests+0x66ca4cc)
    #11 DependencyManager::DestroyContextServices(base::SupportsUserData*) components/keyed_service/core/dependency_manager.cc:91:14 (extensions_browsertests+0x66cb0de)
    #12 BrowserContextDependencyManager::DestroyBrowserContextServices(content::BrowserContext*) components/keyed_service/content/browser_context_dependency_manager.cc:52:22 (extensions_browsertests+0x66c9c40)
    #13 extensions::ShellBrowserMainParts::PostMainMessageLoopRun() extensions/shell/browser/shell_browser_main_parts.cc:287:51 (extensions_browsertests+0x44da79e)
    #14 content::BrowserMainLoop::ShutdownThreadsAndCleanUp() content/browser/browser_main_loop.cc:1056:13 (extensions_browsertests+0x2a96b7a)
    #15 content::BrowserMainRunnerImpl::Shutdown() content/browser/browser_main_runner_impl.cc:217:17 (extensions_browsertests+0x2a9a432)
    #16 content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:49:16 (extensions_browsertests+0x2a91a7d)
    #17 RunBrowserProcessMain content/app/content_main_runner_impl.cc:596:10 (extensions_browsertests+0x448e069)
    #18 content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:947 (extensions_browsertests+0x448e069)
    #19 content::ContentServiceManagerMainDelegate::RunEmbedderProcess() content/app/content_service_manager_main_delegate.cc:53:32 (extensions_browsertests+0x35960ff)
    #20 service_manager::Main(service_manager::MainParams const&) services/service_manager/embedder/main.cc:452:29 (extensions_browsertests+0x657007f)
    #21 content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:10 (extensions_browsertests+0x35973be)
    #22 content::BrowserTestBase::SetUp() content/public/test/browser_test_base.cc:330:3 (extensions_browsertests+0x6a6353a)
    #23 extensions::AppShellTest::SetUp() extensions/shell/test/shell_test.cc:47:29 (extensions_browsertests+0x1a430ec)
    #24 testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc (extensions_browsertests+0x357b6eb)
    #25 testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2667:11 (extensions_browsertests+0x357c3ac)
    #26 testing::TestCase::Run() third_party/googletest/src/googletest/src/gtest.cc:2785:28 (extensions_browsertests+0x357cc36)
    #27 testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:5047:43 (extensions_browsertests+0x358d1d6)
    #28 testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc (extensions_browsertests+0x358caba)
    #29 RUN_ALL_TESTS third_party/googletest/src/googletest/include/gtest/gtest.h:2329:46 (extensions_browsertests+0x6a76385)
    #30 base::TestSuite::Run() base/test/test_suite.cc:277 (extensions_browsertests+0x6a76385)
    #31 extensions::AppShellTestLauncherDelegate::RunTestSuite(int, char**) extensions/shell/test/shell_test_launcher_delegate.cc:15:38 (extensions_browsertests+0x1a43223)
    #32 content::LaunchTests(content::TestLauncherDelegate*, unsigned long, int, char**) content/public/test/test_launcher.cc:637:31 (extensions_browsertests+0x6a69d81)
    #33 main extensions/shell/test/shell_tests_main.cc:17:10 (extensions_browsertests+0x1a43471)

  Previous read of size 8 at 0x7b240000cb90 by thread T2:
    #0 extensions::ExtensionMessageFilter::OnMessageReceived(IPC::Message const&) extensions/browser/extension_message_filter.cc:122:8 (extensions_browsertests+0x1a7f7c4)
    #1 DispatchMessage content/public/browser/browser_message_filter.cc:93:24 (extensions_browsertests+0x28cf22d)
    #2 content::BrowserMessageFilter::Internal::OnMessageReceived(IPC::Message const&) content/public/browser/browser_message_filter.cc:73 (extensions_browsertests+0x28cf22d)
    #3 TryFiltersImpl ipc/message_filter_router.cc:22:21 (extensions_browsertests+0x4e04e00)
    #4 IPC::MessageFilterRouter::TryFilters(IPC::Message const&) ipc/message_filter_router.cc:87 (extensions_browsertests+0x4e04e00)
    #5 IPC::ChannelProxy::Context::TryFilters(IPC::Message const&) ipc/ipc_channel_proxy.cc:86:31 (extensions_browsertests+0x4df6974)
    #6 IPC::ChannelProxy::Context::OnMessageReceived(IPC::Message const&) ipc/ipc_channel_proxy.cc:121:8 (extensions_browsertests+0x4df6bc0)
    #7 IPC::ChannelMojo::OnMessageReceived(IPC::Message const&) ipc/ipc_channel_mojo.cc:263:14 (extensions_browsertests+0x4df2efc)
    #8 non-virtual thunk to IPC::ChannelMojo::OnMessageReceived(IPC::Message const&) ipc/ipc_channel_mojo.cc (extensions_browsertests+0x4df30b4)
    #9 IPC::internal::MessagePipeReader::Receive(base::span<unsigned char const, 18446744073709551615ul>, base::Optional<std::__1::vector<mojo::StructPtr<mojo::native::SerializedHandle>, std::__1::allocator<mojo::StructPtr<mojo::native::SerializedHandle> > > >) ipc/ipc_message_pipe_reader.cc:113:14 (extensions_browsertests+0x4dfb176)
    #10 IPC::mojom::ChannelStubDispatch::Accept(IPC::mojom::Channel*, mojo::Message*) gen/ipc/ipc.mojom.cc:289:13 (extensions_browsertests+0x4e05a5a)
    #11 IPC::mojom::ChannelStub<mojo::RawPtrImplRefTraits<IPC::mojom::Channel> >::Accept(mojo::Message*) gen/ipc/ipc.mojom.h:324:12 (extensions_browsertests+0x4dfb45f)
    #12 mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:419:32 (extensions_browsertests+0x45a5be1)
    #13 mojo::InterfaceEndpointClient::HandleIncomingMessageThunk::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:133:18 (extensions_browsertests+0x45a58ba)
    #14 mojo::FilterChain::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/filter_chain.cc:40:17 (extensions_browsertests+0x45a807d)
    #15 mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:306:19 (extensions_browsertests+0x45a6e94)
    #16 IPC::(anonymous namespace)::ChannelAssociatedGroupController::Accept(mojo::Message*) ipc/ipc_mojo_bootstrap.cc:821:20 (extensions_browsertests+0x4dff946)
    #17 non-virtual thunk to IPC::(anonymous namespace)::ChannelAssociatedGroupController::Accept(mojo::Message*) ipc/ipc_mojo_bootstrap.cc (extensions_browsertests+0x4e000c4)
    #18 mojo::FilterChain::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/filter_chain.cc:40:17 (extensions_browsertests+0x45a807d)
    #19 mojo::Connector::ReadSingleMessage(unsigned int*) mojo/public/cpp/bindings/lib/connector.cc:457:51 (extensions_browsertests+0x45a3c45)
    #20 mojo::Connector::ReadAllAvailableMessages() mojo/public/cpp/bindings/lib/connector.cc:486:10 (extensions_browsertests+0x45a46ea)
    #21 OnHandleReadyInternal mojo/public/cpp/bindings/lib/connector.cc:387:3 (extensions_browsertests+0x45a4575)
    #22 mojo::Connector::OnWatcherHandleReady(unsigned int) mojo/public/cpp/bindings/lib/connector.cc:364 (extensions_browsertests+0x45a4575)
    #23 Invoke<void (mojo::Connector::*)(unsigned int), mojo::Connector *, unsigned int> base/bind_internal.h:507:12 (extensions_browsertests+0x45a4c8f)
    #24 MakeItSo<void (mojo::Connector::*const &)(unsigned int), mojo::Connector *, unsigned int> base/bind_internal.h:607 (extensions_browsertests+0x45a4c8f)
    #25 RunImpl<void (mojo::Connector::*const &)(unsigned int), const std::__1::tuple<base::internal::UnretainedWrapper<mojo::Connector> > &, 0> base/bind_internal.h:680 (extensions_browsertests+0x45a4c8f)
    #26 base::internal::Invoker<base::internal::BindState<void (mojo::Connector::*)(unsigned int), base::internal::UnretainedWrapper<mojo::Connector> >, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int) base/bind_internal.h:662 (extensions_browsertests+0x45a4c8f)
    #27 Run base/callback.h:129:12 (extensions_browsertests+0x27d2022)
    #28 mojo::SimpleWatcher::DiscardReadyState(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&) mojo/public/cpp/system/simple_watcher.h:194 (extensions_browsertests+0x27d2022)
    #29 Invoke<void (*const &)(const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &), const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &> base/bind_internal.h:407:12 (extensions_browsertests+0x27d2065)
    #30 MakeItSo<void (*const &)(const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &), const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &> base/bind_internal.h:607 (extensions_browsertests+0x27d2065)
    #31 RunImpl<void (*const &)(const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &), const std::__1::tuple<base::RepeatingCallback<void (unsigned int)> > &, 0> base/bind_internal.h:680 (extensions_browsertests+0x27d2065)
    #32 base::internal::Invoker<base::internal::BindState<void (*)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> >, void (unsigned int, mojo::HandleSignalsState const&)>::Run(base::internal::BindStateBase*, unsigned int, mojo::HandleSignalsState const&) base/bind_internal.h:662 (extensions_browsertests+0x27d2065)
    #33 Run base/callback.h:129:12 (extensions_browsertests+0x46e3d86)
    #34 mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) mojo/public/cpp/system/simple_watcher.cc:274 (extensions_browsertests+0x46e3d86)
    #35 Invoke<void (mojo::SimpleWatcher::*)(int, unsigned int, const mojo::HandleSignalsState &), const base::WeakPtr<mojo::SimpleWatcher> &, const int &, const unsigned int &, const mojo::HandleSignalsState &> base/bind_internal.h:507:12 (extensions_browsertests+0x46e417c)
    #36 MakeItSo<void (mojo::SimpleWatcher::*const &)(int, unsigned int, const mojo::HandleSignalsState &), const base::WeakPtr<mojo::SimpleWatcher> &, const int &, const unsigned int &, const mojo::HandleSignalsState &> base/bind_internal.h:627 (extensions_browsertests+0x46e417c)
    #37 RunImpl<void (mojo::SimpleWatcher::*const &)(int, unsigned int, const mojo::HandleSignalsState &), const std::__1::tuple<base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState> &, 0, 1, 2, 3> base/bind_internal.h:680 (extensions_browsertests+0x46e417c)
    #38 base::internal::Invoker<base::internal::BindState<void (mojo::SimpleWatcher::*)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState>, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:662 (extensions_browsertests+0x46e417c)
    #39 Run base/callback.h:99:12 (extensions_browsertests+0x45f4ac7)
    #40 base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) base/debug/task_annotator.cc:101 (extensions_browsertests+0x45f4ac7)
    #41 base::MessageLoop::RunTask(base::PendingTask*) base/message_loop/message_loop.cc:453:46 (extensions_browsertests+0x45f2735)
    #42 DeferOrRunPendingTask base/message_loop/message_loop.cc:464:5 (extensions_browsertests+0x45f30c8)
    #43 base::MessageLoop::DoWork() base/message_loop/message_loop.cc:522 (extensions_browsertests+0x45f30c8)
    #44 base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_libevent.cc:210:31 (extensions_browsertests+0x46d4e04)
    #45 Run base/message_loop/message_loop.cc:405:12 (extensions_browsertests+0x45f2140)
    #46 non-virtual thunk to base::MessageLoop::Run(bool) base/message_loop/message_loop.cc (extensions_browsertests+0x45f2140)
    #47 base::RunLoop::Run() base/run_loop.cc:102:14 (extensions_browsertests+0x4622f1a)
    #48 base::Thread::Run(base::RunLoop*) base/threading/thread.cc:255:13 (extensions_browsertests+0x467da89)
    #49 content::BrowserProcessSubThread::IOThreadRun(base::RunLoop*) content/browser/browser_process_sub_thread.cc:178:11 (extensions_browsertests+0x2aa4176)
    #50 content::BrowserProcessSubThread::Run(base::RunLoop*) content/browser/browser_process_sub_thread.cc:128:7 (extensions_browsertests+0x2aa40d8)
    #51 base::Thread::ThreadMain() base/threading/thread.cc:337:3 (extensions_browsertests+0x467dcec)
    #52 base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:76:13 (extensions_browsertests+0x46d093d)

  Location is heap block of size 136 at 0x7b240000cb10 allocated by main thread:
    #0 operator new(unsigned long) /b/swarming/w/ir/kitchen-workdir/src/third_party/llvm/compiler-rt/lib/tsan/rtl/tsan_new_delete.cc:65:3 (extensions_browsertests+0x19c46ed)
    #1 extensions::ShellContentBrowserClient::RenderProcessWillLaunch(content::RenderProcessHost*, mojo::InterfaceRequest<service_manager::mojom::Service>*) extensions/shell/browser/shell_content_browser_client.cc:105:7 (extensions_browsertests+0x44dab64)
    #2 content::RenderProcessHostImpl::Init() content/browser/renderer_host/render_process_host_impl.cc:1587:34 (extensions_browsertests+0x2f0c100)
    #3 InitRenderView content/browser/frame_host/render_frame_host_manager.cc:1912:40 (extensions_browsertests+0x2cce51c)
    #4 content::RenderFrameHostManager::ReinitializeRenderFrame(content::RenderFrameHostImpl*) content/browser/frame_host/render_frame_host_manager.cc:2063 (extensions_browsertests+0x2cce51c)
    #5 content::RenderFrameHostManager::GetFrameHostForNavigation(content::NavigationRequest const&) content/browser/frame_host/render_frame_host_manager.cc:637:10 (extensions_browsertests+0x2ccdc26)
    #6 content::RenderFrameHostManager::DidCreateNavigationRequest(content::NavigationRequest*) content/browser/frame_host/render_frame_host_manager.cc:488:35 (extensions_browsertests+0x2ccd4b3)
    #7 content::FrameTreeNode::CreatedNavigationRequest(std::__1::unique_ptr<content::NavigationRequest, std::__1::default_delete<content::NavigationRequest> >) content/browser/frame_host/frame_tree_node.cc:451:21 (extensions_browsertests+0x2c5e949)
    #8 content::NavigatorImpl::Navigate(std::__1::unique_ptr<content::NavigationRequest, std::__1::default_delete<content::NavigationRequest> >, content::ReloadType, content::RestoreType) content/browser/frame_host/navigator_impl.cc:382:20 (extensions_browsertests+0x2c90d72)
    #9 content::NavigationControllerImpl::NavigateWithoutEntry(content::NavigationController::LoadURLParams const&) content/browser/frame_host/navigation_controller_impl.cc:2403:22 (extensions_browsertests+0x2c68a72)
    #10 content::NavigationControllerImpl::LoadURLWithParams(content::NavigationController::LoadURLParams const&) content/browser/frame_host/navigation_controller_impl.cc:772:3 (extensions_browsertests+0x2c68210)
    #11 content::NavigationControllerImpl::LoadURL(GURL const&, content::Referrer const&, ui::PageTransition, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) content/browser/frame_host/navigation_controller_impl.cc:738:3 (extensions_browsertests+0x2c680ed)
    #12 extensions::ExtensionHost::LoadInitialURL() extensions/browser/extension_host.cc:210:35 (extensions_browsertests+0x1a7c5a9)
    #13 extensions::ExtensionHost::CreateRenderViewNow() extensions/browser/extension_host.cc:153:3 (extensions_browsertests+0x1a7be5a)
    #14 extensions::SerialExtensionHostQueue::ProcessOneHost() extensions/browser/serial_extension_host_queue.cc:79:19 (extensions_browsertests+0x1adac00)
    #15 Invoke<void (extensions::SerialExtensionHostQueue::*)(), const base::WeakPtr<extensions::SerialExtensionHostQueue> &> base/bind_internal.h:507:12 (extensions_browsertests+0x1adad4a)
    #16 MakeItSo<void (extensions::SerialExtensionHostQueue::*const &)(), const base::WeakPtr<extensions::SerialExtensionHostQueue> &> base/bind_internal.h:627 (extensions_browsertests+0x1adad4a)
    #17 RunImpl<void (extensions::SerialExtensionHostQueue::*const &)(), const std::__1::tuple<base::WeakPtr<extensions::SerialExtensionHostQueue> > &, 0> base/bind_internal.h:680 (extensions_browsertests+0x1adad4a)
    #18 base::internal::Invoker<base::internal::BindState<void (extensions::SerialExtensionHostQueue::*)(), base::WeakPtr<extensions::SerialExtensionHostQueue> >, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:662 (extensions_browsertests+0x1adad4a)
    #19 Run base/callback.h:99:12 (extensions_browsertests+0x45f4ac7)
    #20 base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) base/debug/task_annotator.cc:101 (extensions_browsertests+0x45f4ac7)
    #21 base::MessageLoop::RunTask(base::PendingTask*) base/message_loop/message_loop.cc:453:46 (extensions_browsertests+0x45f2735)
    #22 DeferOrRunPendingTask base/message_loop/message_loop.cc:464:5 (extensions_browsertests+0x45f30c8)
    #23 base::MessageLoop::DoWork() base/message_loop/message_loop.cc:522 (extensions_browsertests+0x45f30c8)
    #24 HandleDispatch base/message_loop/message_pump_glib.cc:263:25 (extensions_browsertests+0x45f8a57)
    #25 base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:109 (extensions_browsertests+0x45f8a57)
    #26 g_main_context_dispatch <null> (libglib-2.0.so.0+0x48e03)
    #27 Run base/message_loop/message_loop.cc:405:12 (extensions_browsertests+0x45f2140)
    #28 non-virtual thunk to base::MessageLoop::Run(bool) base/message_loop/message_loop.cc (extensions_browsertests+0x45f2140)
    #29 base::RunLoop::Run() base/run_loop.cc:102:14 (extensions_browsertests+0x4622f1a)
    #30 ExtensionTestMessageListener::WaitUntilSatisfied() extensions/test/extension_test_message_listener.cc:48:12 (extensions_browsertests+0x968a594)
    #31 extensions::UsbApiTest_GetUserSelectedDevices_Test::RunTestOnMainThread() extensions/browser/api/usb/usb_apitest.cc:296:3 (extensions_browsertests+0x1a1794c)
    #32 content::BrowserTestBase::ProxyRunTestOnMainThreadLoop() content/public/test/browser_test_base.cc:414:5 (extensions_browsertests+0x6a63a4a)
    #33 Invoke<void (content::BrowserTestBase::*)(), content::BrowserTestBase *> base/bind_internal.h:507:12 (extensions_browsertests+0x6a644b8)
    #34 MakeItSo<void (content::BrowserTestBase::*const &)(), content::BrowserTestBase *> base/bind_internal.h:607 (extensions_browsertests+0x6a644b8)
    #35 RunImpl<void (content::BrowserTestBase::*const &)(), const std::__1::tuple<base::internal::UnretainedWrapper<content::BrowserTestBase> > &, 0> base/bind_internal.h:680 (extensions_browsertests+0x6a644b8)
    #36 base::internal::Invoker<base::internal::BindState<void (content::BrowserTestBase::*)(), base::internal::UnretainedWrapper<content::BrowserTestBase> >, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:662 (extensions_browsertests+0x6a644b8)
    #37 Run base/callback.h:129:12 (extensions_browsertests+0x44da604)
    #38 extensions::ShellBrowserMainParts::PreMainMessageLoopRun() extensions/shell/browser/shell_browser_main_parts.cc:258 (extensions_browsertests+0x44da604)
    #39 content::BrowserMainLoop::PreMainMessageLoopRun() content/browser/browser_main_loop.cc:1006:13 (extensions_browsertests+0x2a96550)
    #40 Invoke<int (content::BrowserMainLoop::*)(), content::BrowserMainLoop *> base/bind_internal.h:507:12 (extensions_browsertests+0x2a99698)
    #41 MakeItSo<int (content::BrowserMainLoop::*const &)(), content::BrowserMainLoop *> base/bind_internal.h:607 (extensions_browsertests+0x2a99698)
    #42 RunImpl<int (content::BrowserMainLoop::*const &)(), const std::__1::tuple<base::internal::UnretainedWrapper<content::BrowserMainLoop> > &, 0> base/bind_internal.h:680 (extensions_browsertests+0x2a99698)
    #43 base::internal::Invoker<base::internal::BindState<int (content::BrowserMainLoop::*)(), base::internal::UnretainedWrapper<content::BrowserMainLoop> >, int ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:662 (extensions_browsertests+0x2a99698)
    #44 Run base/callback.h:129:12 (extensions_browsertests+0x30873fe)
    #45 content::StartupTaskRunner::RunAllTasksNow() content/browser/startup_task_runner.cc:43 (extensions_browsertests+0x30873fe)
    #46 content::BrowserMainLoop::CreateStartupTasks() content/browser/browser_main_loop.cc:917:25 (extensions_browsertests+0x2a94794)
    #47 content::BrowserMainRunnerImpl::Initialize(content::MainFunctionParams const&) content/browser/browser_main_runner_impl.cc:141:15 (extensions_browsertests+0x2a99c2a)
    #48 content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:43:32 (extensions_browsertests+0x2a91a4a)
    #49 RunBrowserProcessMain content/app/content_main_runner_impl.cc:596:10 (extensions_browsertests+0x448e069)
    #50 content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:947 (extensions_browsertests+0x448e069)
    #51 content::ContentServiceManagerMainDelegate::RunEmbedderProcess() content/app/content_service_manager_main_delegate.cc:53:32 (extensions_browsertests+0x35960ff)
    #52 service_manager::Main(service_manager::MainParams const&) services/service_manager/embedder/main.cc:452:29 (extensions_browsertests+0x657007f)
    #53 content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:10 (extensions_browsertests+0x35973be)
    #54 content::BrowserTestBase::SetUp() content/public/test/browser_test_base.cc:330:3 (extensions_browsertests+0x6a6353a)
    #55 extensions::AppShellTest::SetUp() extensions/shell/test/shell_test.cc:47:29 (extensions_browsertests+0x1a430ec)
    #56 testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc (extensions_browsertests+0x357b6eb)
    #57 testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2667:11 (extensions_browsertests+0x357c3ac)
    #58 testing::TestCase::Run() third_party/googletest/src/googletest/src/gtest.cc:2785:28 (extensions_browsertests+0x357cc36)
    #59 testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:5047:43 (extensions_browsertests+0x358d1d6)
    #60 testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc (extensions_browsertests+0x358caba)
    #61 RUN_ALL_TESTS third_party/googletest/src/googletest/include/gtest/gtest.h:2329:46 (extensions_browsertests+0x6a76385)
    #62 base::TestSuite::Run() base/test/test_suite.cc:277 (extensions_browsertests+0x6a76385)
    #63 extensions::AppShellTestLauncherDelegate::RunTestSuite(int, char**) extensions/shell/test/shell_test_launcher_delegate.cc:15:38 (extensions_browsertests+0x1a43223)
    #64 content::LaunchTests(content::TestLauncherDelegate*, unsigned long, int, char**) content/public/test/test_launcher.cc:637:31 (extensions_browsertests+0x6a69d81)
    #65 main extensions/shell/test/shell_tests_main.cc:17:10 (extensions_browsertests+0x1a43471)

  Thread T2 'Chrome_IOThread' (tid=21156, running) created by main thread at:
    #0 pthread_create /b/swarming/w/ir/kitchen-workdir/src/third_party/llvm/compiler-rt/lib/tsan/rtl/tsan_interceptors.cc:965:3 (extensions_browsertests+0x195a725)
    #1 base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThread::Delegate*, base::PlatformThreadHandle*, base::ThreadPriority) base/threading/platform_thread_posix.cc:115:13 (extensions_browsertests+0x46d04c7)
    #2 base::PlatformThread::CreateWithPriority(unsigned long, base::PlatformThread::Delegate*, base::PlatformThreadHandle*, base::ThreadPriority) base/threading/platform_thread_posix.cc:200:10 (extensions_browsertests+0x46d03c5)
    #3 base::Thread::StartWithOptions(base::Thread::Options const&) base/threading/thread.cc:112:15 (extensions_browsertests+0x467d5ae)
    #4 content::BrowserProcessSubThread::CreateIOThread() content/browser/browser_process_sub_thread.cc:91:19 (extensions_browsertests+0x2aa3eee)
    #5 content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:927:29 (extensions_browsertests+0x448de85)
    #6 content::ContentServiceManagerMainDelegate::RunEmbedderProcess() content/app/content_service_manager_main_delegate.cc:53:32 (extensions_browsertests+0x35960ff)
    #7 service_manager::Main(service_manager::MainParams const&) services/service_manager/embedder/main.cc:452:29 (extensions_browsertests+0x657007f)
    #8 content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:10 (extensions_browsertests+0x35973be)
    #9 content::BrowserTestBase::SetUp() content/public/test/browser_test_base.cc:330:3 (extensions_browsertests+0x6a6353a)
    #10 extensions::AppShellTest::SetUp() extensions/shell/test/shell_test.cc:47:29 (extensions_browsertests+0x1a430ec)
    #11 testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc (extensions_browsertests+0x357b6eb)
    #12 testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2667:11 (extensions_browsertests+0x357c3ac)
    #13 testing::TestCase::Run() third_party/googletest/src/googletest/src/gtest.cc:2785:28 (extensions_browsertests+0x357cc36)
    #14 testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:5047:43 (extensions_browsertests+0x358d1d6)
    #15 testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc (extensions_browsertests+0x358caba)
    #16 RUN_ALL_TESTS third_party/googletest/src/googletest/include/gtest/gtest.h:2329:46 (extensions_browsertests+0x6a76385)
    #17 base::TestSuite::Run() base/test/test_suite.cc:277 (extensions_browsertests+0x6a76385)
    #18 extensions::AppShellTestLauncherDelegate::RunTestSuite(int, char**) extensions/shell/test/shell_test_launcher_delegate.cc:15:38 (extensions_browsertests+0x1a43223)
    #19 content::LaunchTests(content::TestLauncherDelegate*, unsigned long, int, char**) content/public/test/test_launcher.cc:637:31 (extensions_browsertests+0x6a69d81)
    #20 main extensions/shell/test/shell_tests_main.cc:17:10 (extensions_browsertests+0x1a43471)

SUMMARY: ThreadSanitizer: data race extensions/browser/extension_message_filter.cc:83:20 in extensions::ExtensionMessageFilter::ShutdownOnUIThread()
 
Owner: karandeepb@chromium.org
Status: Assigned (was: Untriaged)
Thanks for the report, Reilly.

Karan, do you think you could take a look at this?  (If you're feeling swamped, feel free to assign back to me.)
Status: Started (was: Assigned)
Project Member

Comment 3 by bugdroid1@chromium.org, Jul 20

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/00ab10ef385e107f755960f0ec9de301a8137fa9

commit 00ab10ef385e107f755960f0ec9de301a8137fa9
Author: Karan Bhatia <karandeepb@chromium.org>
Date: Fri Jul 20 19:36:40 2018

ExtensionMessageFilter: Prevent data race.

The |browser_context_| member of ExtensionMessageFilter is only supposed to be
read on the UI thread, but is also read in OnMessageReceived which might not be
invoked on the UI thread (for messages not handled by the
ExtensionMessageFilter). This is racy and can lead to accessing the variable
simultaneously on multiple threads.

Remove the check for a valid |browser_context_| in
ExtensionMessageFilter::OnMessageReceived. It's redundant anyway since all the
message handler functions do already check for a valid browser context.

BUG= 862597 

Change-Id: Ib34ac14b9a1ff609224a9fdf80202070098760e9
Reviewed-on: https://chromium-review.googlesource.com/1144606
Commit-Queue: Karan Bhatia <karandeepb@chromium.org>
Reviewed-by: Devlin <rdevlin.cronin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#576953}
[modify] https://crrev.com/00ab10ef385e107f755960f0ec9de301a8137fa9/extensions/browser/extension_message_filter.cc

Status: Fixed (was: Started)

Sign in to add a comment