Closed Bug 545757 Opened 11 years ago Closed 11 years ago
Sync/RPC replies are posted to the IO thread after hangs
This can cause messages delivered to the IO thread to race with the incoming notification of the closed channel.
(In reply to comment #0) > This can cause messages delivered to the IO thread to race with the incoming > notification of the closed channel. Also with the destruction of the channel, which can lead to use-after-free. This is the problem I'm seeing locally on TestHangs.
After looking more, what was actually happening is that after a hang timeout, the RPCChannel was still posting replies to rpc in-calls to the RPCChannel. This was causing out-events to remain in the IO thread's queue, and breaking an assumption made about Close() --- after Close(), there's no more pending work for the IO thread. This led to a use-after-Clear() error when the IO thread dequeued the rpc reply posted from a dead channel; AssertIOThread() failed because mIOLoop was 0. This bug might have been possible with regular channel errors too, but I never saw it after a *lot* of test runs. Might have been luck.
Summary: Close()ing a channel after a hang-kill but before error notification leaves the transport open → Sync/RPC replies are posted to the IO thread after hangs
Assignee: nobody → jones.chris.g
Attachment #426592 - Flags: review?(bent.mozilla)
11 years ago
Attachment #426592 - Flags: review?(bent.mozilla) → review+
Whiteboard: [land m-c]
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.