Commit 8cb47e19 authored by Ken Rockot's avatar Ken Rockot Committed by Commit Bot

Fix Resource Coordinator client registration

Child processes send a message to BrowserChildProcessHostImpl to
have the host register Resource Coordinator client pipes on their
behalf.

The implementation of this message accesses the corresponding
ChildProcessLauncher's PID indiscriminately. Meanwhile the process
may have died by the time the message is actually dispatched, and
it's invalid to access that PID after process termination.

While this race doesn't seem to affect security or stability of
production code in practice, it does cause browser tests to hit
a DCHECK on PID access, causing fairly common flake.

This fixes the race by ensuring the Process is still valid before
attempting to grab its PID.

Fixed: 1029627
Change-Id: I3f8eb6e9f6cd5c94c4011b76446e7fce63c0d12c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1944618Reviewed-by: default avatarJohn Abd-El-Malek <jam@chromium.org>
Commit-Queue: Ken Rockot <rockot@google.com>
Cr-Commit-Position: refs/heads/master@{#721726}
parent caeb5244
......@@ -648,6 +648,11 @@ void BrowserChildProcessHostImpl::RegisterCoordinatorClient(
mojo::PendingReceiver<memory_instrumentation::mojom::Coordinator> receiver,
mojo::PendingRemote<memory_instrumentation::mojom::ClientProcess>
client_process) {
// The child process may have already terminated by the time this message is
// dispatched. We do nothing in that case.
if (!IsProcessLaunched())
return;
base::PostTask(
FROM_HERE, BrowserThread::UI,
base::BindOnce(
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment