Revert 224179 "Track active references in ShillClientHelper"

Revert 224179 "Track active references in ShillClientHelper"
Use after free on ASAN chromiumos.

> Track active references in ShillClientHelper
> To prevent Shill Service DBus ObjectProxy instances from accumulating,
> remove them when the service becomes inactive.
> 
> BUG=223483
> 
> Review URL: https://chromiumcodereview.appspot.com/23658053

TBR=stevenjb@chromium.org

Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=224204

[kkania, 2013-09-19 21:19:00]

Committed patchset #1 manually as r224204.

[kkania, 2013-09-19 21:19:31]

On 2013/09/19 21:19:00, kkania wrote:
> Committed patchset #1 manually as r224204.

=================================================================
==6380== ERROR: AddressSanitizer: heap-use-after-free on address 0x7fe9bcc60660
at pc 0x7fe9d4ed5b4e bp 0x7fff7ba32110 sp 0x7fff7ba32108
READ of size 8 at 0x7fe9bcc60660 thread T0 (chrome)
    #0 0x7fe9d4ed5b4d in std::_Rb_tree<std::basic_string<char,
std::char_traits<char>, std::allocator<char> >,
std::pair<std::basic_string<char, std::char_traits<char>, std::allocator<char> >
const, chromeos::ShillClientHelper*>,
std::_Select1st<std::pair<std::basic_string<char, std::char_traits<char>,
std::allocator<char> > const, chromeos::ShillClientHelper*> >,
std::less<std::basic_string<char, std::char_traits<char>, std::allocator<char> >
>, std::allocator<std::pair<std::basic_string<char, std::char_traits<char>,
std::allocator<char> > const, chromeos::ShillClientHelper*> >
>::equal_range(std::basic_string<char, std::char_traits<char>,
std::allocator<char> > const&) ??:0
    #1 0x7fe9d4ed5598 in std::_Rb_tree<std::basic_string<char,
std::char_traits<char>, std::allocator<char> >,
std::pair<std::basic_string<char, std::char_traits<char>, std::allocator<char> >
const, chromeos::ShillClientHelper*>,
std::_Select1st<std::pair<std::basic_string<char, std::char_traits<char>,
std::allocator<char> > const, chromeos::ShillClientHelper*> >,
std::less<std::basic_string<char, std::char_traits<char>, std::allocator<char> >
>, std::allocator<std::pair<std::basic_string<char, std::char_traits<char>,
std::allocator<char> > const, chromeos::ShillClientHelper*> >
>::erase(std::basic_string<char, std::char_traits<char>, std::allocator<char> >
const&) ??:0
    #2 0x7fe9d4ed52b8 in chromeos::(anonymous
namespace)::ShillServiceClientImpl::NotifyReleased(chromeos::ShillClientHelper*)
chromeos/dbus/shill_service_client.cc:0
    #3 0x7fe9d507855c in chromeos::ShillClientHelper::Release() ???:0
    #4 0x7fe9d4fd1101 in
chromeos::internal::ShillPropertyObserver::~ShillPropertyObserver() ???:0
    #5 0x7fe9d4fd0dfd in
chromeos::internal::ShillPropertyObserver::~ShillPropertyObserver() ???:0
    #6 0x7fe9d4fc0bd8 in
chromeos::internal::ShillPropertyHandler::~ShillPropertyHandler() ???:0
    #7 0x7fe9d4fc0aad in
chromeos::internal::ShillPropertyHandler::~ShillPropertyHandler() ???:0
    #8 0x7fe9d4f8079f in chromeos::NetworkStateHandler::~NetworkStateHandler()
???:0
    #9 0x7fe9d4f8031d in chromeos::NetworkStateHandler::~NetworkStateHandler()
???:0
    #10 0x7fe9d4f69a3b in chromeos::NetworkHandler::~NetworkHandler() ???:0
    #11 0x7fe9d4f695ed in chromeos::NetworkHandler::~NetworkHandler() ???:0
    #12 0x7fe9d4f6a040 in chromeos::NetworkHandler::Shutdown() ???:0
    #13 0x7fe9dc69e175 in
chromeos::ChromeBrowserMainPartsChromeos::PostDestroyThreads() ???:0
    #14 0x7fe9da91a037 in content::BrowserMainLoop::ShutdownThreadsAndCleanUp()
???:0
    #15 0x7fe9da91dc8e in content::BrowserMainRunnerImpl::Shutdown() ???:0
    #16 0x7fe9da909d66 in content::BrowserMain(content::MainFunctionParams
const&) ???:0
    #17 0x7fe9d3b084c1 in
content::RunNamedProcessTypeMain(std::basic_string<char, std::char_traits<char>,
std::allocator<char> > const&, content::MainFunctionParams const&,
content::ContentMainDelegate*) ???:0
    #18 0x7fe9d3b0a2db in content::ContentMainRunnerImpl::Run() ???:0
    #19 0x7fe9d3b06387 in content::ContentMain(int, char const**,
content::ContentMainDelegate*) ???:0
    #20 0x7fe9d2615fcf in ChromeMain ??:0
    #21 0x7fe9cf6df464 in ?? ??:0
0x7fe9bcc60660 is located 32 bytes inside of 176-byte region
[0x7fe9bcc60640,0x7fe9bcc606f0)
freed by thread T0 (chrome) here:
    #0 0x7fe9d260d352 in operator delete(void*) ??:0
    #1 0x7fe9d511e846 in std::_Rb_tree<std::pair<std::basic_string<char,
std::char_traits<char>, std::allocator<char> >, int>,
std::pair<std::pair<std::basic_string<char, std::char_traits<char>,
std::allocator<char> >, int> const, scoped_refptr<dbus::ObjectProxy> >,
std::_Select1st<std::pair<std::pair<std::basic_string<char,
std::char_traits<char>, std::allocator<char> >, int> const,
scoped_refptr<dbus::ObjectProxy> > >,
std::less<std::pair<std::basic_string<char, std::char_traits<char>,
std::allocator<char> >, int> >,
std::allocator<std::pair<std::pair<std::basic_string<char,
std::char_traits<char>, std::allocator<char> >, int> const,
scoped_refptr<dbus::ObjectProxy> > >
>::_M_destroy_node(std::_Rb_tree_node<std::pair<std::pair<std::basic_string<char,
std::char_traits<char>, std::allocator<char> >, int> const,
scoped_refptr<dbus::ObjectProxy> > >*) ???:0
    #2 0x7fe9d510cbee in
dbus::Bus::RemoveObjectProxyWithOptions(std::basic_string<char,
std::char_traits<char>, std::allocator<char> > const&, dbus::ObjectPath const&,
int, base::Callback<void ()> const&) ???:0
    #3 0x7fe9d510c84a in dbus::Bus::RemoveObjectProxy(std::basic_string<char,
std::char_traits<char>, std::allocator<char> > const&, dbus::ObjectPath const&,
base::Callback<void ()> const&) ???:0
    #4 0x7fe9d4ed5269 in chromeos::(anonymous
namespace)::ShillServiceClientImpl::NotifyReleased(chromeos::ShillClientHelper*)
chromeos/dbus/shill_service_client.cc:0
    #5 0x7fe9d507855c in chromeos::ShillClientHelper::Release() ???:0
    #6 0x7fe9d4fd1101 in
chromeos::internal::ShillPropertyObserver::~ShillPropertyObserver() ???:0
    #7 0x7fe9d4fd0dfd in
chromeos::internal::ShillPropertyObserver::~ShillPropertyObserver() ???:0
    #8 0x7fe9d4fc0bd8 in
chromeos::internal::ShillPropertyHandler::~ShillPropertyHandler() ???:0
    #9 0x7fe9d4fc0aad in
chromeos::internal::ShillPropertyHandler::~ShillPropertyHandler() ???:0
    #10 0x7fe9d4f8079f in chromeos::NetworkStateHandler::~NetworkStateHandler()
???:0
    #11 0x7fe9d4f8031d in chromeos::NetworkStateHandler::~NetworkStateHandler()
???:0
    #12 0x7fe9d4f69a3b in chromeos::NetworkHandler::~NetworkHandler() ???:0
    #13 0x7fe9d4f695ed in chromeos::NetworkHandler::~NetworkHandler() ???:0
    #14 0x7fe9d4f6a040 in chromeos::NetworkHandler::Shutdown() ???:0
previously allocated by thread T0 (chrome) here:
    #0 0x7fe9d260d192 in operator new(unsigned long) ??:0
    #1 0x7fe9d510c10c in
dbus::Bus::GetObjectProxyWithOptions(std::basic_string<char,
std::char_traits<char>, std::allocator<char> > const&, dbus::ObjectPath const&,
int) ???:0
    #2 0x7fe9d4ed2d8f in chromeos::(anonymous
namespace)::ShillServiceClientImpl::GetHelper(dbus::ObjectPath const&)
chromeos/dbus/shill_service_client.cc:0
    #3 0x7fe9d4ecf72c in chromeos::(anonymous
namespace)::ShillServiceClientImpl::GetProperties(dbus::ObjectPath const&,
base::Callback<void (chromeos::DBusMethodCallStatus, base::DictionaryValue
const&)> const&) chromeos/dbus/shill_service_client.cc:0
    #4 0x7fe9d4fc45e0 in
chromeos::internal::ShillPropertyHandler::RequestProperties(chromeos::ManagedState::ManagedType,
std::basic_string<char, std::char_traits<char>, std::allocator<char> > const&)
???:0
    #5 0x7fe9d4fc817b in
chromeos::internal::ShillPropertyHandler::UpdateProperties(chromeos::ManagedState::ManagedType,
base::ListValue const&) ???:0
    #6 0x7fe9d4fc6b66 in
chromeos::internal::ShillPropertyHandler::ManagerPropertyChanged(std::basic_string<char,
std::char_traits<char>, std::allocator<char> > const&, base::Value const&) ???:0
    #7 0x7fe9d4fc1a64 in
chromeos::internal::ShillPropertyHandler::ManagerPropertiesCallback(chromeos::DBusMethodCallStatus,
base::DictionaryValue const&) ???:0
    #8 0x7fe9d507be73 in chromeos::(anonymous
namespace)::OnDictionaryValueMethod(chromeos::ShillClientHelper::RefHolder*,
base::Callback<void (chromeos::DBusMethodCallStatus, base::DictionaryValue
const&)> const&, dbus::Response*) chromeos/dbus/shill_client_helper.cc:0
Shadow byte and word:
  0x1ffd3798c0cc: fd
  0x1ffd3798c0c8: fd fd fd fd fd fd fd fd
More shadow bytes:
  0x1ffd3798c0a8: fd fd fd fd fd fd fd fd
  0x1ffd3798c0b0: fd fd fd fd fd fd fd fd
  0x1ffd3798c0b8: fa fa fa fa fa fa fa fa
  0x1ffd3798c0c0: fa fa fa fa fa fa fa fa
=>0x1ffd3798c0c8: fd fd fd fd fd fd fd fd
  0x1ffd3798c0d0: fd fd fd fd fd fd fd fd
  0x1ffd3798c0d8: fd fd fd fd fd fd fd fd
  0x1ffd3798c0e0: fa fa fa fa fa fa fa fa
  0x1ffd3798c0e8: 00 00 00 00 00 00 00 00
Stats: 95M malloced (97M for red zones) by 335366 calls
Stats: 1M realloced by 1138 calls
Stats: 89M freed by 311355 calls
Stats: 56M really freed by 204464 calls
Stats: 153M (39422 full pages) mmaped in 300 calls
  mmaps   by size class: 7:147420; 8:32752; 9:7161; 10:54677; 11:2040; 12:1920;
13:384; 14:288; 15:80; 16:184; 17:4; 18:2; 19:61; 20:4; 21:1;
  mallocs by size class: 7:203359; 8:43449; 9:7290; 10:75076; 11:2211; 12:2701;
13:516; 14:345; 15:107; 16:239; 17:4; 18:2; 19:62; 20:4; 21:1;
  frees   by size class: 7:185428; 8:39063; 9:6214; 10:74881; 11:2070; 12:2526;
13:488; 14:291; 15:97; 16:231; 17:2; 18:1; 19:61; 20:2;
  rfrees  by size class: 7:118432; 8:24731; 9:4230; 10:53806; 11:1144; 12:1297;
13:345; 14:219; 15:45; 16:193; 19:20; 20:2;
Stats: malloc large: 419 small slow: 4478

[kkania, 2013-09-19 21:19:49]

http://build.chromium.org/p/chromium.memory/buildstatus?builder=Chromium%20OS...