My favorites | Sign in
Project Home Downloads Wiki Issues Code Search
New issue   Search
for
  Advanced search   Search tips   Subscriptions
Issue 64501: Data race on net::URLRequestThrottlerEntryInterface reference counter
1 person starred this issue and may be notified of changes. Back to list
Status:  Fixed
Owner:  joi@chromium.org
Closed:  Nov 2010
Cc:  yzs...@google.com, pkasting@chromium.org, willchan@chromium.org, eroman@chromium.org, si...@google.com

Restricted
  • Only users with Commit permission may comment.


Sign in to add a comment
 
Project Member Reported by timurrrr@chromium.org, Nov 26, 2010
This was found by ThreadSanitizer UI FYI bot:
http://build.chromium.org/p/chromium.fyi/builders/Linux%20Tests%20(tsan%20ui)(1)/builds/91/steps/memory%20test:%20ui/logs/stdio
WARNING: Possible data race during read of size 4 at 0xB101C84: {{{
   T0 (L{}):
    #0  base::subtle::RefCountedBase::Release() const base/ref_counted.cc:45
    #1  base::RefCounted<net::URLRequestThrottlerEntryInterface>::Release() const base/ref_counted.h:93
    #2  scoped_refptr<net::URLRequestThrottlerEntryInterface>::~scoped_refptr() base/ref_counted.h:240
    #3  URLFetcher::Core::~Core() chrome/common/net/url_fetcher.cc:230
    #4  base::RefCountedThreadSafe<URLFetcher::Core, base::DefaultRefCountedThreadSafeTraits<URLFetcher::Core> >::DeleteInternal(URLFetcher::Core const*) base/ref_counted.h:148
    #5  base::DefaultRefCountedThreadSafeTraits<URLFetcher::Core>::Destruct(URLFetcher::Core const*) base/ref_counted.h:113
    #6  base::RefCountedThreadSafe<URLFetcher::Core, base::DefaultRefCountedThreadSafeTraits<URLFetcher::Core> >::Release() const base/ref_counted.h:142
    #7  RunnableMethodTraits<URLFetcher::Core>::ReleaseCallee(URLFetcher::Core*) base/task.h:255
    #8  RunnableMethod<URLFetcher::Core, void (URLFetcher::Core::*)(URLRequestStatus const&), Tuple1<URLRequestStatus> >::ReleaseCallee() base/task.h:340
    #9  RunnableMethod<URLFetcher::Core, void (URLFetcher::Core::*)(URLRequestStatus const&), Tuple1<URLRequestStatus> >::~RunnableMethod() base/task.h:325
    #10 MessageLoop::RunTask(Task*) base/message_loop.cc:420
  Concurrent write(s) happened at (OR AFTER) these points:
   T8 (Chrome_IOThread) (L{}):
    #0  base::subtle::RefCountedBase::Release() const base/ref_counted.cc:38
    #1  base::RefCounted<net::URLRequestThrottlerEntryInterface>::Release() const base/ref_counted.h:93
    #2  scoped_refptr<net::URLRequestThrottlerEntryInterface>::~scoped_refptr() base/ref_counted.h:240
    #3  URLRequestHttpJob::~URLRequestHttpJob() net/url_request/url_request_http_job.cc:130
    #4  base::RefCounted<URLRequestJob>::Release() const base/ref_counted.h:94
    #5  RunnableMethodTraits<URLRequestJob>::ReleaseCallee(URLRequestJob*) base/task.h:255
    #6  RunnableMethod<URLRequestJob, void (URLRequestJob::*)(), Tuple0>::ReleaseCallee() base/task.h:340
    #7  RunnableMethod<URLRequestJob, void (URLRequestJob::*)(), Tuple0>::~RunnableMethod() base/task.h:325
    #8  MessageLoop::RunTask(Task*) base/message_loop.cc:420
    #9  MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const&) base/message_loop.cc:427
}}}

Seems like net::URLRequestThrottlerEntryInterface should inherit RefCountedThreadSafe OR is shouldn't be passed between threads.

Please note that data races on refcounters may corrupt heap (see top crasher -  issue 18488 ), hence P1.
Nov 26, 2010
#1 bugdroid1@gmail.com
The following revision refers to this bug:
    http://src.chromium.org/viewvc/chrome?view=rev&revision=67458

------------------------------------------------------------------------
r67458 | timurrrr@chromium.org | Fri Nov 26 08:40:59 PST 2010

Changed paths:
 M http://src.chromium.org/viewvc/chrome/trunk/src/tools/valgrind/tsan/suppressions.txt?r1=67458&r2=67457&pathrev=67458

Suppress a data race on net::URLRequestThrottlerEntryInterface reference counter
BUG=64501
TBR=glider
TEST=TSan/UI should go greener
Review URL: http://codereview.chromium.org/5284005
------------------------------------------------------------------------
Nov 26, 2010
#3 bugdroid1@gmail.com
The following revision refers to this bug:
    http://src.chromium.org/viewvc/chrome?view=rev&revision=67471

------------------------------------------------------------------------
r67471 | joi@chromium.org | Fri Nov 26 12:56:39 PST 2010

Changed paths:
 M http://src.chromium.org/viewvc/chrome/trunk/src/tools/valgrind/tsan/suppressions.txt?r1=67471&r2=67470&pathrev=67471
 M http://src.chromium.org/viewvc/chrome/trunk/src/net/url_request/url_request_throttler_entry_interface.h?r1=67471&r2=67470&pathrev=67471

Make URLRequestThrottlerEntryInterface inherit RefCountedThreadSafe,
as a quick fix for  bug 64501 . yzshen is planning to refactor these
classes significantly, so I won't make a bigger change at this point
(e.g. to prevent use of the interface on different threads).

BUG=64501
TEST=ThreadSanitizer complains no more.

Review URL: http://codereview.chromium.org/5364003
------------------------------------------------------------------------
Oct 12, 2012
#4 bugdro...@chromium.org
This issue has been closed for some time. No one will pay attention to new comments.
If you are seeing this bug or have new data, please click New Issue to start a new bug.
Labels: Restrict-AddIssueComment-Commit
Mar 10, 2013
#5 bugdro...@chromium.org
(No comment was entered for this change.)
Labels: -Area-Internals Cr-Internals
Sign in to add a comment

Powered by Google Project Hosting