Fix Windows logoff race.

chrome/browser/browser_process_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/browser_process_impl.h"
 
 #include <algorithm>
 #include <map>
 #include <vector>
 
+#include "base/atomic_ref_count.h"
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/command_line.h"
 #include "base/debug/alias.h"
 #include "base/debug/leak_annotations.h"
 #include "base/files/file_path.h"
 #include "base/path_service.h"
 #include "base/prefs/json_pref_store.h"
 #include "base/prefs/pref_registry_simple.h"
 #include "base/prefs/pref_service.h"
@@ skipping 282 matching lines @@
   // Reset associated state right after actual thread is stopped,
   // as io_thread_.global_ cleanup happens in CleanUp on the IO
   // thread, i.e. as the thread exits its message loop.
   //
   // This is important also because in various places, the
   // IOThread object being NULL is considered synonymous with the
   // IO thread having stopped.
   io_thread_.reset();
 }
 
-#if defined(USE_X11) || defined(OS_WIN)
-static void Signal(base::WaitableEvent* event) {
-  event->Signal();
-}
-#endif
-
 unsigned int BrowserProcessImpl::AddRefModule() {
   DCHECK(CalledOnValidThread());
 
   // CHECK(!IsShuttingDown());
   if (IsShuttingDown()) {
     // Copy the stacktrace which released the final reference onto our stack so
     // it will be available in the crash report for inspection.
     base::debug::StackTrace callstack = release_last_reference_callstack_;
     base::debug::Alias(&callstack);
     CHECK(false);
@@ skipping 43 matching lines @@
 #if defined(OS_MACOSX)
     base::MessageLoop::current()->PostTask(
         FROM_HERE,
         base::Bind(ChromeBrowserMainPartsMac::DidEndMainMessageLoop));
 #endif
     base::MessageLoop::current()->Quit();
   }
   return module_ref_count_;
 }
 
+namespace {
+
+class RundownTaskCounter :

[gab, 2014/06/25 14:21:50]

Add a meta-comment explaining the general purpose of this class.

[Sigurður Ásgeirsson, 2014/06/25 15:05:02]

Done.

+    public base::RefCountedThreadSafe<RundownTaskCounter> {
+ public:
+  RundownTaskCounter();
+
+  // Posts a rundown task to |task_runner|, can be invoked an arbitrary number
+  // of times before calling TimedWait.
+  void Post(base::SequencedTaskRunner* task_runner);
+
+  // Waits until the count is zero or |max_time| has passed.
+  // This can only be called once per instance.
+  bool TimedWait(const base::TimeDelta& max_time);
+
+ private:
+  friend class base::RefCountedThreadSafe<RundownTaskCounter>;
+  ~RundownTaskCounter() {}
+
+  // Decrements the counter and releases the waitable
+  // event on transition to zero.

[gab, 2014/06/25 14:21:50]

Some of this second line fits on the previous line.

[Sigurður Ásgeirsson, 2014/06/25 15:05:02]

Done.

+  void Decrement();
+
+  // The count starts at one to defer the possibility of one->zero transitions
+  // until TimedWait is called.
+  base::AtomicRefCount count_;
+  base::WaitableEvent waitable_event_;
+
+  DISALLOW_COPY_AND_ASSIGN(RundownTaskCounter);
+};
+
+RundownTaskCounter::RundownTaskCounter()
+    : count_(1), waitable_event_(true, false) {
+}
+
+void RundownTaskCounter::Post(base::SequencedTaskRunner* task_runner) {
+  // As the count starts off at one, it should never get to zero unless
+  // TimedWait has been called.
+  DCHECK(!base::AtomicRefCountIsZero(&count_));
+
+  base::AtomicRefCountInc(&count_);
+
+  task_runner->PostTask(FROM_HERE,
+      base::Bind(&RundownTaskCounter::Decrement, this));
+}
+
+void RundownTaskCounter::Decrement() {
+  if (!base::AtomicRefCountDec(&count_))
+    waitable_event_.Signal();
+}
+
+bool RundownTaskCounter::TimedWait(const base::TimeDelta& max_time) {
+  // Decrement the excess count from the constructor.
+  Decrement();
+
+  return waitable_event_.TimedWait(max_time);
+}
+
+}  // namespace
+
 void BrowserProcessImpl::EndSession() {
   // Mark all the profiles as clean.
   ProfileManager* pm = profile_manager();
   std::vector<Profile*> profiles(pm->GetLoadedProfiles());
-  for (size_t i = 0; i < profiles.size(); ++i)
-    profiles[i]->SetExitType(Profile::EXIT_SESSION_ENDED);
+  scoped_refptr<RundownTaskCounter> rundown_counter(new RundownTaskCounter());
+  for (size_t i = 0; i < profiles.size(); ++i) {
+    Profile* profile = profiles[i];
+    profile->SetExitType(Profile::EXIT_SESSION_ENDED);
+
+    rundown_counter->Post(profile->GetIOTaskRunner());
+  }
 
   // Tell the metrics service it was cleanly shutdown.
   MetricsService* metrics = g_browser_process->metrics_service();
   if (metrics && local_state()) {
     metrics->RecordStartOfSessionEnd();
 #if !defined(OS_CHROMEOS)
     // MetricsService lazily writes to prefs, force it to write now.
     // On ChromeOS, chrome gets killed when hangs, so no need to
     // commit metrics::prefs::kStabilitySessionEndCompleted change immediately.
     local_state()->CommitPendingWrite();
+
+    rundown_counter->Post(local_state_task_runner_);

[gab, 2014/06/25 14:21:50]

This only happens inside the "if (metrics && local_state())" check; is the
assumption that local_state has already been flushed otherwise?

[Sigurður Ásgeirsson, 2014/06/25 15:05:02]

Apparently things work differently for local state on ChromeOS.

 #endif
   }
 
   // http://crbug.com/125207
   base::ThreadRestrictions::ScopedAllowWait allow_wait;
 
   // We must write that the profile and metrics service shutdown cleanly,
   // otherwise on startup we'll think we crashed. So we block until done and
   // then proceed with normal shutdown.
 #if defined(USE_X11) || defined(OS_WIN)
-  // Create a waitable event to block on file writing being complete.
+  // Do a best-effort wait on the successful countdown of rundown tasks. Note
+  // that if we don't complete "quickly enough", Windows will terminate our

[gab, 2014/06/25 14:21:50]

Can you quantify "quickly enough" based on documentation/experimentation?

kEndSessionTimeoutSeconds is 10 seconds at the moment, is that "quickly enough"?

[Sigurður Ásgeirsson, 2014/06/25 15:05:02]

The timeout is documented something like 5 seconds, but it's not deterministic.
What happens when you overrun is that Windows (as of Vista or Win7) flings up a
dialog complaining that Chrome's tardy, and gives the user the option of blowing
it out of the sky manually. Normally this should complete much faster than 10
seconds, but I don't think the amount of delay is very important - it's only a
safeguard against deadlocking.

+  // process.
   //
   // On Windows, we previously posted a message to FILE and then ran a nested
   // message loop, waiting for that message to be processed until quitting.
   // However, doing so means that other messages will also be processed. In
   // particular, if the GPU process host notices that the GPU has been killed
   // during shutdown, it races exiting the nested loop with the process host
   // blocking the message loop attempting to re-establish a connection to the
   // GPU process synchronously. Because the system may not be allowing
   // processes to launch, this can result in a hang. See
   // http://crbug.com/318527.
-  scoped_ptr<base::WaitableEvent> done_writing(
-      new base::WaitableEvent(false, false));
-  BrowserThread::PostTask(BrowserThread::FILE, FROM_HERE,
-      base::Bind(Signal, done_writing.get()));
-  // If all file writes haven't cleared in the timeout, leak the WaitableEvent
-  // so that there's no race to reference it in Signal().
-  if (!done_writing->TimedWait(
-      base::TimeDelta::FromSeconds(kEndSessionTimeoutSeconds))) {
-    ignore_result(done_writing.release());
-  }
+  rundown_counter->TimedWait(
+      base::TimeDelta::FromSeconds(kEndSessionTimeoutSeconds));
 #else
   NOTIMPLEMENTED();
 #endif
 }
 
 MetricsServicesManager* BrowserProcessImpl::GetMetricsServicesManager() {
   DCHECK(CalledOnValidThread());
   if (!metrics_services_manager_)
     metrics_services_manager_.reset(new MetricsServicesManager(local_state()));
   return metrics_services_manager_.get();
@@ skipping 662 matching lines @@
 }
 
 void BrowserProcessImpl::OnAutoupdateTimer() {
   if (CanAutorestartForUpdate()) {
     DLOG(WARNING) << "Detected update.  Restarting browser.";
     RestartBackgroundInstance();
   }
 }
 
 #endif  // (defined(OS_WIN) || defined(OS_LINUX)) && !defined(OS_CHROMEOS)