Crashing when releasing proxy on IO thread

[emerick]

I recently upgraded my app to use the 1084 CEF1 release branch. Now when I run my app, it crashes whenever I close a browser window. Long story short, I noticed that the following line in browser_impl.cc seems to trigger the problem:

Code: Select all

  // Release the proxy on the IO thread.
  CefThread::ReleaseSoon(CefThread::IO, FROM_HERE,
      request_context_proxy_.release());


Looking at the trunk version of browser_impl.cc, I noticed that this code has been changed to:

Code: Select all

  // Delete the proxy on the IO thread.
  CefThread::DeleteSoon(CefThread::IO, FROM_HERE,
      request_context_proxy_.release());


When I changed my version of CEF to use DeleteSoon instead of ReleaseSoon, the crash went away. Is there a reason why CEF calls ReleaseSoon in the 1084 branch but DeleteSoon on the trunk? If the call to ReleaseSoon is actually important, is there something I'm doing wrong in my app to trigger this bad behavior? It doesn't seem to affect CefClient.

[emerick]

In digging into this a little bit more, it seems that calling ReleaseSoon is appropriate when request_context_proxy_ is NULL and calling DeleteSoon is appropriate when it's non-NULL. I could be barking up the wrong tree with this, though.

[Czarek]

I've also had errors recently when closing browser, a fix turned out to be to call PostMessage(WM_DESTROY) instead of DestroyWindow().

Marshall is on vacation:)

[emerick]

Enjoy your well-deserved vacation, Marshall...

I'll just use this workaround for now (which I'm sure is wrong, but it seems to be working for me):

Code: Select all

  if (request_context_proxy_) {
    CefThread::ReleaseSoon(CefThread::IO, FROM_HERE,
        request_context_proxy_.release());
  } else {
    CefThread::DeleteSoon(CefThread::IO, FROM_HERE,
        request_context_proxy_.release());
  }


[magreenblatt]

In digging into this a little bit more, it seems that calling ReleaseSoon is appropriate when request_context_proxy_ is NULL and calling DeleteSoon is appropriate when it's non-NULL. I could be barking up the wrong tree with this, though.

The object changed from scoped_refptr in older versions to scoped_ptr (non ref counted) in new versions. ReleaseSoon is for ref counted types and DeleteSoon is for non ref counted types. Likely DeleteSoon (which calls operator delete) is more forgiving of NULL pointers than ReleaseSoon. Neither should be called if the pointer is NULL. Please add an issue to the issue tracker.

[emerick]

Thanks for the information, Marshall. I entered a new bug in the issue tracker here: http://code.google.com/p/chromiumembedd ... ail?id=677