Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(752)

Issue 642813007: Drop CreateChildFrame messages when swapping out. (Closed)

Created:
6 years, 2 months ago by nasko
Modified:
6 years, 2 months ago
CC:
chromium-reviews, darin-cc_chromium.org, nasko+codewatch_chromium.org, jam, creis+watch_chromium.org
Base URL:
https://chromium.googlesource.com/chromium/src.git@master
Project:
chromium
Visibility:
Public.

Description

Drop CreateChildFrame messages when swapping out. There is a race condition in the current state of the code where in cross-process navigation we swap the existing RenderFrameHost with a new RenderFrameHost. If the existing host sends an IPC message to create a new child frame, it arrives on the IO thread, allocates a routing id based of the existing process (p1) and does a PostTask to the UI thread. If there is a CommitPending event either executing on the UI thread or in the task queue before the task posted from the IO thread, it will end up putting the existing RenderFrameHost in swapped out state (or waiting for swapped out). When the task to create a child frame is executed after that, it creates a new RenderFrameHost, but it uses the "current" process (p2), which is different than the process that sent the message (p1). This manifests sometimes as adding duplicate routing ids to RenderProcessHost and is in general really bad bug. BUG=415059, 423691, 381990 Committed: https://crrev.com/dcdb02fab210ec5f7b8b560075ce96d0f48f344c Cr-Commit-Position: refs/heads/master@{#299939}

Patch Set 1 #

Total comments: 10

Patch Set 2 : Fixes based on Charlie's review. #

Total comments: 4

Patch Set 3 : Another round of fixes. #

Unified diffs Side-by-side diffs Delta from patch set Stats (+131 lines, -26 lines) Patch
M content/browser/frame_host/frame_tree.h View 1 1 chunk +1 line, -0 lines 0 comments Download
M content/browser/frame_host/frame_tree.cc View 1 2 2 chunks +9 lines, -1 line 0 comments Download
M content/browser/frame_host/frame_tree_node.h View 1 2 1 chunk +3 lines, -1 line 0 comments Download
M content/browser/frame_host/frame_tree_node.cc View 1 2 1 chunk +4 lines, -0 lines 0 comments Download
M content/browser/frame_host/frame_tree_unittest.cc View 1 2 5 chunks +34 lines, -16 lines 0 comments Download
M content/browser/frame_host/navigator_impl_unittest.cc View 1 2 chunks +6 lines, -6 lines 0 comments Download
M content/browser/frame_host/render_frame_host_impl.cc View 1 1 chunk +10 lines, -1 line 0 comments Download
M content/browser/frame_host/render_frame_host_manager_unittest.cc View 1 3 chunks +64 lines, -1 line 0 comments Download

Messages

Total messages: 12 (2 generated)
nasko
Hey Charlie, Can you review this patch for me? Hajime, feel free to patch this ...
6 years, 2 months ago (2014-10-15 23:19:08 UTC) #2
Hajime Morrita
Running tests, no crash so far.
6 years, 2 months ago (2014-10-15 23:46:22 UTC) #3
Charlie Reis
Wow! Great job connecting the rogue CreateChildFrame message to the duplicate routing ID issue. I ...
6 years, 2 months ago (2014-10-15 23:54:18 UTC) #4
nasko
https://codereview.chromium.org/642813007/diff/1/content/browser/frame_host/render_frame_host_impl.cc File content/browser/frame_host/render_frame_host_impl.cc (right): https://codereview.chromium.org/642813007/diff/1/content/browser/frame_host/render_frame_host_impl.cc#newcode621 content/browser/frame_host/render_frame_host_impl.cc:621: RenderFrameHostImpl* new_frame = frame_tree_->AddFrame( On 2014/10/15 23:54:18, Charlie Reis ...
6 years, 2 months ago (2014-10-16 17:08:36 UTC) #5
Charlie Reis
Thanks! LGTM with one additional CHECK. https://codereview.chromium.org/642813007/diff/20001/content/browser/frame_host/frame_tree.cc File content/browser/frame_host/frame_tree.cc (right): https://codereview.chromium.org/642813007/diff/20001/content/browser/frame_host/frame_tree.cc#newcode165 content/browser/frame_host/frame_tree.cc:165: parent->AddChild(node.Pass(), new_routing_id); Can ...
6 years, 2 months ago (2014-10-16 17:22:11 UTC) #6
nasko
https://codereview.chromium.org/642813007/diff/20001/content/browser/frame_host/frame_tree.cc File content/browser/frame_host/frame_tree.cc (right): https://codereview.chromium.org/642813007/diff/20001/content/browser/frame_host/frame_tree.cc#newcode165 content/browser/frame_host/frame_tree.cc:165: parent->AddChild(node.Pass(), new_routing_id); On 2014/10/16 17:22:11, Charlie Reis wrote: > ...
6 years, 2 months ago (2014-10-16 17:41:31 UTC) #7
Charlie Reis
Thanks-- still LGTM.
6 years, 2 months ago (2014-10-16 18:03:31 UTC) #8
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/642813007/40001
6 years, 2 months ago (2014-10-16 18:07:23 UTC) #10
commit-bot: I haz the power
Committed patchset #3 (id:40001)
6 years, 2 months ago (2014-10-16 18:33:23 UTC) #11
commit-bot: I haz the power
6 years, 2 months ago (2014-10-16 18:35:11 UTC) #12
Message was sent while issue was closed.
Patchset 3 (id:??) landed as
https://crrev.com/dcdb02fab210ec5f7b8b560075ce96d0f48f344c
Cr-Commit-Position: refs/heads/master@{#299939}

Powered by Google App Engine
This is Rietveld 408576698