Closed
Bug 545757
Opened 14 years ago
Closed 14 years ago
Sync/RPC replies are posted to the IO thread after hangs
Categories
(Core :: IPC, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: cjones, Assigned: cjones)
References
Details
(Whiteboard: [land m-c])
Attachments
(1 file)
1.57 KB,
patch
|
bent.mozilla
:
review+
|
Details | Diff | Splinter Review |
This can cause messages delivered to the IO thread to race with the incoming notification of the closed channel.
Assignee | ||
Comment 1•14 years ago
|
||
(In reply to comment #0) > This can cause messages delivered to the IO thread to race with the incoming > notification of the closed channel. Also with the destruction of the channel, which can lead to use-after-free. This is the problem I'm seeing locally on TestHangs.
Assignee | ||
Comment 2•14 years ago
|
||
After looking more, what was actually happening is that after a hang timeout, the RPCChannel was still posting replies to rpc in-calls to the RPCChannel. This was causing out-events to remain in the IO thread's queue, and breaking an assumption made about Close() --- after Close(), there's no more pending work for the IO thread. This led to a use-after-Clear() error when the IO thread dequeued the rpc reply posted from a dead channel; AssertIOThread() failed because mIOLoop was 0. This bug might have been possible with regular channel errors too, but I never saw it after a *lot* of test runs. Might have been luck.
Summary: Close()ing a channel after a hang-kill but before error notification leaves the transport open → Sync/RPC replies are posted to the IO thread after hangs
Assignee | ||
Comment 3•14 years ago
|
||
Assignee: nobody → jones.chris.g
Attachment #426592 -
Flags: review?(bent.mozilla)
Updated•14 years ago
|
Attachment #426592 -
Flags: review?(bent.mozilla) → review+
Assignee | ||
Comment 4•14 years ago
|
||
Pushed http://hg.mozilla.org/projects/electrolysis/rev/ab07afb8c04c
Whiteboard: [land m-c]
Assignee | ||
Comment 5•14 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/c5ca3076da1b
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•