Updates:
Cc: [email protected]
Comment #3 on issue 27874 by [email protected]: Crash - (anonymous
namespace)::DeleteMapBlock(int, int, disk_cache::BlockFileHeader*)
http://code.google.com/p/chromium/issues/detail?id=27874
This is process shutdown
0x00934422 [linux-gate.so + 0x00000422]
0x08535168 [chrome - platform_thread_posix.cc:119]
PlatformThread::Join(unsigned long)
0x0854a153 [chrome - thread.cc:109] base::Thread::Stop()
0x0854a3cc [chrome - thread.cc:47] base::Thread::~Thread()
0x08388dbe [chrome - scoped_ptr.h:72]
PasswordStoreDefault::~PasswordStoreDefault()
0x0819f1b9 [chrome - ref_counted.h:146]
ProfileImpl::~ProfileImpl()
0x081a2530 [chrome - profile_manager.cc:55]
ProfileManager::~ProfileManager()
0x0806bbe5 [chrome - scoped_ptr.h:81]
BrowserProcessImpl::~BrowserProcessImpl()
0x0806d185 [chrome - browser_shutdown.cc:141]
browser_shutdown::Shutdown()
0x08069829 [chrome - browser_main.cc:895]
BrowserMain(MainFunctionParams
const&)
0x0806480a [chrome - chrome_dll_main.cc:635] ChromeMain
0x080631de [chrome - chrome_exe_main_gtk.cc:33] main
The Profile destructor is running and tasks to release the request contexts
were already posted (the UI thread is now
waiting for the password store thread).
1. If the task to release the request context executed already, the cache
destructor should have been called. Deleting
the cache destroys Eviction and BlockFiles (both members of the cache).
Here the IO thread is executing a
RunnableMethod of Eviction, and if Eviction is gone (with the cache), the
posted task to execute the method should just
do nothing.
2. If the request context is still alive, everything is still unaware of
shutdown so the task to evict an entry from
the cache should execute as it always does. In this crash, deleting the
data for an entry finds itself with invalid
data for the header of a block file (as if the object was already gone).
All crashes have the same pattern on both threads, so the most likely
scenario is #1. That means that somehow
ScopedRunnableMethodFactory is not working as intended, and the method is
executing on a deleted object... with enough
data remaining to live through a few function calls until it finds
something actually reused.
John, any ideas?
--
You received this message because you are listed in the owner
or CC fields of this issue, or because you starred this issue.
You may adjust your issue notification preferences at:
http://code.google.com/hosting/settings
--
Automated mail from issue updates at http://crbug.com/
Subscription options: http://groups.google.com/group/chromium-bugs
