Comment #7 on issue 30405 by [email protected]: CHECK failure in ExtensionsService::UnloadExtension
http://code.google.com/p/chromium/issues/detail?id=30405

I took a look. This does seem very similar to issue 29166, duplicate probably -- if we don't crash at the location in that bug (while reading extension->name()), we'll probably later on read garbage from extension->id() and pass it into this function --
which CHECKs because an extension with a garbage id isn't found.

At first I thought this was identical to a crash I saw when I fixed issue 30505. However, when I managed to replicate that crash I found it was in UninstallExtension,
not UnloadExtension (where this crash occurs).

So, as a test, I tried simulating multiple crashes in the extension process during a browser action popup being open and when an options page is open (that all worked as
expected).

I looked at the lifetime of the objects involved (didn't see anything wrong there at a
glance).

Unfortunately, we don't have access to the extension id passed in, which would probably
confirm my theory.

I'm tempted to add some debugging code to the failure case (to see what id is being passed in and what the extensions_ and disabled_extensions_ vectors contain), although that's not a quick fix (takes a cycle to get anything meaningful out of that)...

Comments?

--
You received this message because you are listed in the owner
or CC fields of this issue, or because you starred this issue.
You may adjust your issue notification preferences at:
http://code.google.com/hosting/settings
-- 
Automated mail from issue updates at http://crbug.com/
Subscription options: http://groups.google.com/group/chromium-bugs

Reply via email to