New issue
Advanced search Search tips

Issue 868906 link

Starred by 2 users

Issue metadata

Status: WontFix
Owner:
Closed: Dec 31
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 1
Type: Bug-Regression



Sign in to add a comment

NOTREACHED() in extensions::UpdateService::OnEvent(), attempting to update a removed extension

Project Member Reported by w...@chromium.org, Jul 30

Issue description

Chrome Version: 70.0.3507.1
OS: Windows 10

What steps will reproduce the problem?
I had just re-enable sync in a Chrome profile that had been unused for ~4 weeks.  I'm not sure whether any extensions were added/removed over that period.
Crash occurred shortly after re-enabling profile sign-in.

See crash report 563e38e7f0b3a3ba - browser crashed with:
0x551c7e28	(chrome.dll -logging.cc:856 )	logging::LogMessage::~LogMessage()
0x5623de16	(chrome.dll -update_service.cc:141 )	extensions::UpdateService::OnEvent(update_client::UpdateClient::Observer::Events,std::basic_string<char,std::char_traits<char>,std::allocator<char> > const &)
0x566ab7bc	(chrome.dll -update_client.cc:174 )	update_client::UpdateClientImpl::NotifyObservers(update_client::UpdateClient::Observer::Events,std::basic_string<char,std::char_traits<char>,std::allocator<char> > const &)
0x55e25426	(chrome.dll -bind_internal.h:671 )	base::internal::Invoker<base::internal::BindState<void (DevToolsUIBindings::*)(const std::basic_string<char,std::char_traits<char>,std::allocator<char> > &, const base::ListValue &) __attribute__((thiscall)),base::internal::UnretainedWrapper<DevToolsUIBindings> >,void (const std::basic_string<char,std::char_traits<char>,std::allocator<char> > &, const base::ListValue &)>::Run
0x570361b1	(chrome.dll -component.cc:298 )	update_client::Component::NotifyObservers(update_client::UpdateClient::Observer::Events)
0x57036c61	(chrome.dll -component.cc:430 )	update_client::Component::StateUpdateError::DoHandle()
0x570358ed	(chrome.dll -component.cc:324 )	update_client::Component::State::Handle(base::OnceCallback<void >)
0x5703585a	(chrome.dll -component.cc:188 )	update_client::Component::Handle(base::OnceCallback<void >)
0x56b8a0a1	(chrome.dll -update_engine.cc:331 )	update_client::UpdateEngine::HandleComponent(scoped_refptr<update_client::UpdateContext>)
0x557e0900	(chrome.dll -bind_internal.h:516 )	base::internal::FunctorTraits<void (ChromeProcessSingleton::*)(base::RepeatingCallback<void ()>) __attribute__((thiscall)),void>::Invoke<void (ChromeProcessSingleton::*)(base::RepeatingCallback<void ()>) __attribute__((thiscall)),ChromeProcessSingleton *,base::RepeatingCallback<void ()> >
0x55e6f1d9	(chrome.dll -bind_internal.h:658 )	base::internal::Invoker<base::internal::BindState<void (content::IndexedDBDatabaseCallbacks::IOThreadHelper::*)(mojo::StructPtr<indexed_db::mojom::ObserverChanges>) __attribute__((thiscall)),base::internal::UnretainedWrapper<content::IndexedDBDatabaseCallbacks::IOThreadHelper>,mojo::StructPtr<indexed_db::mojom::ObserverChanges> >,void ()>::RunOnce
0x550cce65	(chrome.dll -task_annotator.cc:101 )	base::debug::TaskAnnotator::RunTask(char const *,base::PendingTask *)
0x550cf856	(chrome.dll -message_loop.cc:427 )	base::MessageLoop::RunTask(base::PendingTask *)
0x550cf652	(chrome.dll -message_loop.cc:438 )	base::MessageLoop::DeferOrRunPendingTask(base::PendingTask)
0x5504d83e	(chrome.dll -message_loop.cc:510 )	base::MessageLoop::DoWork()
0x551482a7	(chrome.dll -message_pump_win.cc:171 )	base::MessagePumpForUI::DoRunLoop()
0x5504d6b0	(chrome.dll -message_pump_win.cc:52 )	base::MessagePumpWin::Run(base::MessagePump::Delegate *)
0x5504d607	(chrome.dll -message_loop.cc:379 )	base::MessageLoop::Run(bool)
0x5504d2c3	(chrome.dll -run_loop.cc:102 )	base::RunLoop::Run()
0x553f7e67	(chrome.dll -chrome_browser_main.cc:2092 )	ChromeBrowserMainParts::MainMessageLoopRun(int *)
0x553f7cbc	(chrome.dll -browser_main_loop.cc:1034 )	content::BrowserMainLoop::RunMainMessageLoopParts()
0x553f7c63	(chrome.dll -browser_main_runner_impl.cc:162 )	content::BrowserMainRunnerImpl::Run()
0x55dd974c	(chrome.dll -browser_main.cc:47 )	content::BrowserMain(content::MainFunctionParams const &)
0x563b424f	(chrome.dll -content_main_runner_impl.cc:596 )	content::RunBrowserProcessMain(content::MainFunctionParams const &,content::ContentMainDelegate *)
0x563b4585	(chrome.dll -content_main_runner_impl.cc:947 )	content::ContentMainRunnerImpl::Run(bool)
0x5504967c	(chrome.dll -content_service_manager_main_delegate.cc:53 )	content::ContentServiceManagerMainDelegate::RunEmbedderProcess()
0x55035f91	(chrome.dll -main.cc:472 )	service_manager::Main(service_manager::MainParams const &)
0x55035953	(chrome.dll -content_main.cc:19 )	content::ContentMain(content::ContentMainParams const &)
0x55031ee9	(chrome.dll -chrome_main.cc:101 )	ChromeMain
0x00a25e3f	(chrome.exe -main_dll_loader_win.cc:201 )	MainDllLoader::Launch(HINSTANCE__ *,base::TimeTicks)
0x00a2154a	(chrome.exe -chrome_exe_main_win.cc:230 )	wWinMain
0x00aebe09	(chrome.exe -exe_common.inl:283 )	__scrt_common_main_seh
0x768d8673	(KERNEL32.DLL + 0x00018673 )	BaseThreadInitThunk
0x77075d86	(ntdll.dll + 0x00065d86 )	__RtlUserThreadStart
0x77075d56	(ntdll.dll + 0x00065d56 )	_RtlUserThreadStart

This was the NOTREACHED() at https://cs.chromium.org/chromium/src/extensions/browser/updater/update_service.cc?l=141
 
Note that this class of failures will be treated as ErrorCategory::kNone in the subsequent switch, causing an UPDATE_SERVICE_ERROR update-check-result to be reported, which is presumably incorrect.
Cc: -rdevlin....@chromium.org mxnguyen@chromium.org
Owner: rdevlin....@chromium.org
Summary: NOTREACHED() in extensions::UpdateService::OnEvent(), attempting to update a removed extension (was: NOTREACHED() in extensions::UpdateService::OnEvent())
OK, I've confirmed that the |extension_id| is for an extension that I had removed while this profile was un-synced.
Cc: sorin@chromium.org
Cc: waff...@chromium.org
Cc: -mxnguyen@chromium.org rdevlin....@chromium.org
Owner: mxnguyen@chromium.org
I think mxnguyen@ is a better owner for this.
We have a fix for this crash. Thank you wez@ for reporting it.
Project Member

Comment 8 by bugdroid1@chromium.org, Aug 8

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2e8384697adee0656a913038d97400acf2f2ddfb

commit 2e8384697adee0656a913038d97400acf2f2ddfb
Author: Minh X. Nguyen <mxnguyen@chromium.org>
Date: Wed Aug 08 22:14:42 2018

[Extensions] Fix a crash due to race condition in the update service.

Because of a change in the way update client handles extensions that
were remove during the update process UpdateService can crash when
handling update events emitted from UpdateClient.

Bug:  868906 ,  869663 
Change-Id: I78cf5075fab84075f8472edcb2428348794307fe
Reviewed-on: https://chromium-review.googlesource.com/1155749
Commit-Queue: Minh Nguyen <mxnguyen@chromium.org>
Reviewed-by: Devlin <rdevlin.cronin@chromium.org>
Reviewed-by: Sorin Jianu <sorin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#581706}
[modify] https://crrev.com/2e8384697adee0656a913038d97400acf2f2ddfb/extensions/browser/updater/update_service.cc

Project Member

Comment 9 by cr...@system.gserviceaccount.com, Dec 23

Labels: crash-BugNoRepro
Crash analysis has not encountered any reports for this bug for the past 90 days. We have added the label 'crash-BugNoRepro'

Crash analysis will be automatically closing the bug in 6 days. If you do not want Crash analysis to automatically close the bug, please remove the label 'crash-BugNoRepro'. If you have any feedback on this feature, please contact pranavk@
Project Member

Comment 10 by cr...@system.gserviceaccount.com, Dec 31

Labels: crash-BugNoRepro-Closed
Status: WontFix (was: Assigned)
Crash analysis has not encountered any reports for this bug for the past 90 days. Hence as per the comment 7 days ago, we are closing the bug and setting the status to WontFix. If you have any feedback on this feature, please contact pranavk@

Sign in to add a comment