DescriptionFold IPCSupportInitializer::ForceShutdown() with ShutDown().
A race is possible on browser shut down where the UI thread releases
its last |ScopedIPCSupport| which then causes ShutDown() to call
ForceShutdown() since the last reference is released. However, at the
point ForceShutdown() is called, |lock_| is not held and so a utility
process being created on the IO thead can call Init() and assume it has
a reference to the IPC support. However, |shutting_down_| hasn't been
set yet, so there's no way to cancel the shutdown process. This causes
|ChannelManager| internally to post a task to the IO thread with a
reference to itself, even though it is about to be destroyed.
BUG=542069
Committed: https://crrev.com/55eeeffd666bd30f20bf596f117ea1a101d4b202
Cr-Commit-Position: refs/heads/master@{#354924}
Patch Set 1 #Patch Set 2 : Add myself and Ken to owners. #
Messages
Total messages: 12 (4 generated)
|