chromedriver: forward unknown responses to children [chromium/src : main]

0 views
Skip to first unread message

Alex N. Jose (Gerrit)

unread,
Oct 29, 2025, 12:15:42 PM (11 days ago) Oct 29
to David Stevens, Alex Rudenko, chromium...@chromium.org, devtools...@chromium.org, Mathias Bynens
Attention needed from David Stevens

Alex N. Jose added 1 comment

Patchset-level comments
Open in Gerrit

Related details

Attention is currently required from:
  • David Stevens
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: Icb4ff89c07026388c8c8759bb6de2b77051b82df
Gerrit-Change-Number: 7080912
Gerrit-PatchSet: 1
Gerrit-Owner: David Stevens <stev...@chromium.org>
Gerrit-Reviewer: Alex N. Jose <ale...@chromium.org>
Gerrit-CC: Alex Rudenko <alexr...@chromium.org>
Gerrit-CC: Mathias Bynens <mat...@chromium.org>
Gerrit-Attention: David Stevens <stev...@chromium.org>
Gerrit-Comment-Date: Wed, 29 Oct 2025 16:15:33 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
satisfied_requirement
unsatisfied_requirement
open
diffy

David Stevens (Gerrit)

unread,
Oct 29, 2025, 7:13:30 PM (11 days ago) Oct 29
to Alex Rudenko, Alex N. Jose, chromium...@chromium.org, devtools...@chromium.org, Mathias Bynens
Attention needed from Alex N. Jose

David Stevens added 1 comment

Patchset-level comments
Alex N. Jose . unresolved
David Stevens

I've spent a while trying, and I can't manage to write a regression test that covers this issue. I've uploaded the chromedriver logs captured during a repro of this issue from the linked bug [1]. The specific command that ends up hanging in that trace is `Target.setAutoAttach (id=1384)`. It looks like that event is related to an ads frame, and it's racing with a Page.frameDetached event. Do you have any advice as to how to simulate that sort of sequence of events in the chromedriver tests?

[1] https://drive.google.com/file/d/1BVb9l2qfS6OSAhKZSMrdT3lYjBZYcFRs/view?usp=sharing

Open in Gerrit

Related details

Attention is currently required from:
  • Alex N. Jose
Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement is not satisfiedCode-Owners
    • requirement is not satisfiedCode-Review
    • requirement is not satisfiedNo-Unresolved-Comments
    • requirement is not satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: Icb4ff89c07026388c8c8759bb6de2b77051b82df
    Gerrit-Change-Number: 7080912
    Gerrit-PatchSet: 1
    Gerrit-Owner: David Stevens <stev...@chromium.org>
    Gerrit-Reviewer: Alex N. Jose <ale...@chromium.org>
    Gerrit-CC: Alex Rudenko <alexr...@chromium.org>
    Gerrit-CC: Mathias Bynens <mat...@chromium.org>
    Gerrit-Attention: Alex N. Jose <ale...@chromium.org>
    Gerrit-Comment-Date: Wed, 29 Oct 2025 23:13:21 +0000
    Gerrit-HasComments: Yes
    Gerrit-Has-Labels: No
    Comment-In-Reply-To: Alex N. Jose <ale...@chromium.org>
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy

    Alex N. Jose (Gerrit)

    unread,
    Oct 31, 2025, 8:04:54 PM (9 days ago) Oct 31
    to David Stevens, Code Review Nudger, Alex Rudenko, chromium...@chromium.org, devtools...@chromium.org, Mathias Bynens
    Attention needed from David Stevens

    Alex N. Jose added 1 comment

    Patchset-level comments
    Alex N. Jose . unresolved

    Can you add a test to [run_py_tests.py](https://source.chromium.org/chromium/chromium/src/+/main:chrome/test/chromedriver/test/run_py_tests.py;l=6317?q=run_py_tests.py&ss=chromium%2Fchromium%2Fsrc) that covers this scenario?

    + @alexr...@chromium.org, how does Puppeteer handle this?

    David Stevens

    I've spent a while trying, and I can't manage to write a regression test that covers this issue. I've uploaded the chromedriver logs captured during a repro of this issue from the linked bug [1]. The specific command that ends up hanging in that trace is `Target.setAutoAttach (id=1384)`. It looks like that event is related to an ads frame, and it's racing with a Page.frameDetached event. Do you have any advice as to how to simulate that sort of sequence of events in the chromedriver tests?

    [1] https://drive.google.com/file/d/1BVb9l2qfS6OSAhKZSMrdT3lYjBZYcFRs/view?usp=sharing

    Alex N. Jose

    I'll try to go through the log early next week. Can you include the python test you created so I can try correlating? I'm concerned if we've introduced a regression. Does the test work as expected without the change?

    Open in Gerrit

    Related details

    Attention is currently required from:
    • David Stevens
    Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement is not satisfiedCode-Owners
    • requirement is not satisfiedCode-Review
    • requirement is not satisfiedNo-Unresolved-Comments
    • requirement is not satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: Icb4ff89c07026388c8c8759bb6de2b77051b82df
    Gerrit-Change-Number: 7080912
    Gerrit-PatchSet: 1
    Gerrit-Owner: David Stevens <stev...@chromium.org>
    Gerrit-Reviewer: Alex N. Jose <ale...@chromium.org>
    Gerrit-CC: Alex Rudenko <alexr...@chromium.org>
    Gerrit-CC: Code Review Nudger <android-build...@prod.google.com>
    Gerrit-CC: Mathias Bynens <mat...@chromium.org>
    Gerrit-Attention: David Stevens <stev...@chromium.org>
    Gerrit-Comment-Date: Sat, 01 Nov 2025 00:04:46 +0000
    Gerrit-HasComments: Yes
    Gerrit-Has-Labels: No
    Comment-In-Reply-To: Alex N. Jose <ale...@chromium.org>
    Comment-In-Reply-To: David Stevens <stev...@chromium.org>
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy

    David Stevens (Gerrit)

    unread,
    Nov 3, 2025, 1:31:52 PM (6 days ago) Nov 3
    to Code Review Nudger, Alex Rudenko, Alex N. Jose, chromium...@chromium.org, devtools...@chromium.org, Mathias Bynens
    Attention needed from Alex N. Jose

    David Stevens added 1 comment

    Patchset-level comments
    Alex N. Jose . unresolved

    Can you add a test to [run_py_tests.py](https://source.chromium.org/chromium/chromium/src/+/main:chrome/test/chromedriver/test/run_py_tests.py;l=6317?q=run_py_tests.py&ss=chromium%2Fchromium%2Fsrc) that covers this scenario?

    + @alexr...@chromium.org, how does Puppeteer handle this?

    David Stevens

    I've spent a while trying, and I can't manage to write a regression test that covers this issue. I've uploaded the chromedriver logs captured during a repro of this issue from the linked bug [1]. The specific command that ends up hanging in that trace is `Target.setAutoAttach (id=1384)`. It looks like that event is related to an ads frame, and it's racing with a Page.frameDetached event. Do you have any advice as to how to simulate that sort of sequence of events in the chromedriver tests?

    [1] https://drive.google.com/file/d/1BVb9l2qfS6OSAhKZSMrdT3lYjBZYcFRs/view?usp=sharing

    Alex N. Jose

    I'll try to go through the log early next week. Can you include the python test you created so I can try correlating? I'm concerned if we've introduced a regression. Does the test work as expected without the change?

    David Stevens

    The logs are from one of my team's performance tests [1]. Running on an Android desktop device with 4GB of ram, the test fails at least 20% of the time due to this issue hanging web driver.

    What I wasn't able to do was write a test in run_py_tests.py that reproduces the hang. Specifically, the issue seems to be caused by chromedriver issuing a `Target.setAutoAttach` command (id=1384 in the log) racing with a frame swap (the `Page.frameDetached` event at timestamp 1761773007.690) in a way that causes the browser to return a "Session with given id not found" response for the `Target.setAutoAttach` command. I tried causing the test page to navigate or close itself, but that resulted in a `Inspector.detached` event, which properly causes chromedriver to go down a different path that doesn't hang. I'm having trouble figuring out how to set up iframes in a way that will trigger the same `Page.frameDetached` path that we've observed in the performance test.

    [1] https://source.chromium.org/chromium/chromium/src/+/main:third_party/crossbench-web-tests/cuj/crossbench/cujs/page-click/

    Open in Gerrit

    Related details

    Attention is currently required from:
    • Alex N. Jose
    Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement is not satisfiedCode-Owners
    • requirement is not satisfiedCode-Review
    • requirement is not satisfiedNo-Unresolved-Comments
    • requirement is not satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: Icb4ff89c07026388c8c8759bb6de2b77051b82df
    Gerrit-Change-Number: 7080912
    Gerrit-PatchSet: 1
    Gerrit-Owner: David Stevens <stev...@chromium.org>
    Gerrit-Reviewer: Alex N. Jose <ale...@chromium.org>
    Gerrit-CC: Alex Rudenko <alexr...@chromium.org>
    Gerrit-CC: Code Review Nudger <android-build...@prod.google.com>
    Gerrit-CC: Mathias Bynens <mat...@chromium.org>
    Gerrit-Attention: Alex N. Jose <ale...@chromium.org>
    Gerrit-Comment-Date: Mon, 03 Nov 2025 18:31:41 +0000
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy

    Andrey Kosyakov (Gerrit)

    unread,
    Nov 3, 2025, 4:29:58 PM (6 days ago) Nov 3
    to David Stevens, Code Review Nudger, Alex Rudenko, Alex N. Jose, chromium...@chromium.org, devtools...@chromium.org, Mathias Bynens
    Attention needed from Alex N. Jose and David Stevens

    Andrey Kosyakov added 2 comments

    Commit Message
    Line 13, Patchset 1 (Latest):child client from being blocked indefinitely, it's necessary for the
    Andrey Kosyakov . unresolved

    We're generally supposed to know when a session is disconnected, through Target.detachedFromTarget event. This would be the right place to resolve all pending callbacks within the session.

    File chrome/test/chromedriver/chrome/devtools_client_impl.cc
    Line 1228, Patchset 1 (Latest): auto result = client->ProcessOrphanedCommandResponse(response);
    Andrey Kosyakov . unresolved

    You can't just send a response to a random session, given that command ids are per-session.

    Open in Gerrit

    Related details

    Attention is currently required from:
    • Alex N. Jose
    • David Stevens
    Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement is not satisfiedCode-Owners
    • requirement is not satisfiedCode-Review
    • requirement is not satisfiedNo-Unresolved-Comments
    • requirement is not satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: Icb4ff89c07026388c8c8759bb6de2b77051b82df
    Gerrit-Change-Number: 7080912
    Gerrit-PatchSet: 1
    Gerrit-Owner: David Stevens <stev...@chromium.org>
    Gerrit-Reviewer: Alex N. Jose <ale...@chromium.org>
    Gerrit-CC: Alex Rudenko <alexr...@chromium.org>
    Gerrit-CC: Andrey Kosyakov <ca...@chromium.org>
    Gerrit-CC: Code Review Nudger <android-build...@prod.google.com>
    Gerrit-CC: Mathias Bynens <mat...@chromium.org>
    Gerrit-Attention: Alex N. Jose <ale...@chromium.org>
    Gerrit-Attention: David Stevens <stev...@chromium.org>
    Gerrit-Comment-Date: Mon, 03 Nov 2025 21:29:49 +0000
    Gerrit-HasComments: Yes
    Gerrit-Has-Labels: No
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy

    David Stevens (Gerrit)

    unread,
    Nov 4, 2025, 12:07:32 AM (5 days ago) Nov 4
    to Andrey Kosyakov, Code Review Nudger, Alex Rudenko, Alex N. Jose, chromium...@chromium.org, devtools...@chromium.org, Mathias Bynens
    Attention needed from Alex N. Jose and Andrey Kosyakov

    David Stevens added 2 comments

    Commit Message
    Line 13, Patchset 1 (Latest):child client from being blocked indefinitely, it's necessary for the
    Andrey Kosyakov . unresolved

    We're generally supposed to know when a session is disconnected, through Target.detachedFromTarget event. This would be the right place to resolve all pending callbacks within the session.

    David Stevens

    There isn't a `Target.detachedFromTarget` for the session that's getting hung up.

    That said, are frames supposed to be hierarchical? In trace [1], session 98137CE7779FEECC578D7EC1ED14D650 is the one that gets hung up. It never gets a Target.detachedFromTarget. However, there is a Target.detachedFromTarget for the session associated with its parentFrameId. Similarly in trace [2], session 08776C2E070D71D35250C2ABA796AE24 gets hung up, doesn't receive a Target.detachedFromTarget, but its parentFrameId does.

    [1] https://drive.google.com/file/d/1BVb9l2qfS6OSAhKZSMrdT3lYjBZYcFRs/view?usp=sharing
    [2] https://drive.google.com/file/d/13o1FccDYYGrL1ZOBz4oJoVXvAaGY8T4J/view?usp=sharing

    File chrome/test/chromedriver/chrome/devtools_client_impl.cc
    Line 1228, Patchset 1 (Latest): auto result = client->ProcessOrphanedCommandResponse(response);
    Andrey Kosyakov . unresolved

    You can't just send a response to a random session, given that command ids are per-session.

    David Stevens

    I thought child sessions always allocated their command ids from their parent session [1]. If the parent and all children are unique command ids from a shared namespace, then only the child that actually used the command id will process the response. I don't know if that's part of the CDP spec, but I think it should work as long as chromedriver stays consistent. Although I guess things could get weird if you try to do log replay on a trace that doesn't provide the guarantee.

    [1] https://source.chromium.org/chromium/chromium/src/+/main:chrome/test/chromedriver/chrome/devtools_client_impl.cc;drc=35d26d364efb57d0386b98312ba739f7f65ae97e;l=814

    Open in Gerrit

    Related details

    Attention is currently required from:
    • Alex N. Jose
    • Andrey Kosyakov
    Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement is not satisfiedCode-Owners
    • requirement is not satisfiedCode-Review
    • requirement is not satisfiedNo-Unresolved-Comments
    • requirement is not satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: Icb4ff89c07026388c8c8759bb6de2b77051b82df
    Gerrit-Change-Number: 7080912
    Gerrit-PatchSet: 1
    Gerrit-Owner: David Stevens <stev...@chromium.org>
    Gerrit-Reviewer: Alex N. Jose <ale...@chromium.org>
    Gerrit-CC: Alex Rudenko <alexr...@chromium.org>
    Gerrit-CC: Andrey Kosyakov <ca...@chromium.org>
    Gerrit-CC: Code Review Nudger <android-build...@prod.google.com>
    Gerrit-CC: Mathias Bynens <mat...@chromium.org>
    Gerrit-Attention: Alex N. Jose <ale...@chromium.org>
    Gerrit-Attention: Andrey Kosyakov <ca...@chromium.org>
    Gerrit-Comment-Date: Tue, 04 Nov 2025 05:07:19 +0000
    Gerrit-HasComments: Yes
    Gerrit-Has-Labels: No
    Comment-In-Reply-To: Andrey Kosyakov <ca...@chromium.org>
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy

    David Stevens (Gerrit)

    unread,
    Nov 4, 2025, 1:02:43 PM (5 days ago) Nov 4
    to Andrey Kosyakov, Code Review Nudger, Alex Rudenko, Alex N. Jose, chromium...@chromium.org, devtools...@chromium.org, Mathias Bynens
    Attention needed from Alex N. Jose and Andrey Kosyakov

    David Stevens added 1 comment

    Commit Message
    Line 13, Patchset 1 (Latest):child client from being blocked indefinitely, it's necessary for the
    Andrey Kosyakov . unresolved

    We're generally supposed to know when a session is disconnected, through Target.detachedFromTarget event. This would be the right place to resolve all pending callbacks within the session.

    David Stevens

    There isn't a `Target.detachedFromTarget` for the session that's getting hung up.

    That said, are frames supposed to be hierarchical? In trace [1], session 98137CE7779FEECC578D7EC1ED14D650 is the one that gets hung up. It never gets a Target.detachedFromTarget. However, there is a Target.detachedFromTarget for the session associated with its parentFrameId. Similarly in trace [2], session 08776C2E070D71D35250C2ABA796AE24 gets hung up, doesn't receive a Target.detachedFromTarget, but its parentFrameId does.

    [1] https://drive.google.com/file/d/1BVb9l2qfS6OSAhKZSMrdT3lYjBZYcFRs/view?usp=sharing
    [2] https://drive.google.com/file/d/13o1FccDYYGrL1ZOBz4oJoVXvAaGY8T4J/view?usp=sharing

    David Stevens

    After going through the browser devtools implementation, the session that hangs doesn't get a `Target.detachedFromTarget` event because of this check [1]. The parent frame's session is being detached first, which causes that check to drop the child frame's `Target.detachedFromTarget` event.

    [1] https://source.chromium.org/chromium/chromium/src/+/main:content/browser/devtools/protocol/target_handler.cc;l=587;drc=128f35b3fb019f2fa67e1e798e113ed95f766096

    Gerrit-Comment-Date: Tue, 04 Nov 2025 18:02:32 +0000
    Gerrit-HasComments: Yes
    Gerrit-Has-Labels: No
    Comment-In-Reply-To: Andrey Kosyakov <ca...@chromium.org>
    Comment-In-Reply-To: David Stevens <stev...@chromium.org>
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy

    Andrey Kosyakov (Gerrit)

    unread,
    Nov 4, 2025, 1:53:02 PM (5 days ago) Nov 4
    to David Stevens, Code Review Nudger, Alex Rudenko, Alex N. Jose, chromium...@chromium.org, devtools...@chromium.org, Mathias Bynens
    Attention needed from Alex N. Jose and David Stevens

    Andrey Kosyakov added 2 comments

    Commit Message
    Line 13, Patchset 1 (Latest):child client from being blocked indefinitely, it's necessary for the
    Andrey Kosyakov . unresolved

    We're generally supposed to know when a session is disconnected, through Target.detachedFromTarget event. This would be the right place to resolve all pending callbacks within the session.

    David Stevens

    There isn't a `Target.detachedFromTarget` for the session that's getting hung up.

    That said, are frames supposed to be hierarchical? In trace [1], session 98137CE7779FEECC578D7EC1ED14D650 is the one that gets hung up. It never gets a Target.detachedFromTarget. However, there is a Target.detachedFromTarget for the session associated with its parentFrameId. Similarly in trace [2], session 08776C2E070D71D35250C2ABA796AE24 gets hung up, doesn't receive a Target.detachedFromTarget, but its parentFrameId does.

    [1] https://drive.google.com/file/d/1BVb9l2qfS6OSAhKZSMrdT3lYjBZYcFRs/view?usp=sharing
    [2] https://drive.google.com/file/d/13o1FccDYYGrL1ZOBz4oJoVXvAaGY8T4J/view?usp=sharing

    David Stevens

    After going through the browser devtools implementation, the session that hangs doesn't get a `Target.detachedFromTarget` event because of this check [1]. The parent frame's session is being detached first, which causes that check to drop the child frame's `Target.detachedFromTarget` event.

    [1] https://source.chromium.org/chromium/chromium/src/+/main:content/browser/devtools/protocol/target_handler.cc;l=587;drc=128f35b3fb019f2fa67e1e798e113ed95f766096

    Andrey Kosyakov

    Well, frames are hierarchical, but sessions, provided are just 2 tiers (provided {flatten: true} in `Target.setAutoAttach`, which it is. It looks like [1] in your last comment may be something we should fix on the backend side then, thanks a lot for investigating!

    File chrome/test/chromedriver/chrome/devtools_client_impl.cc
    Line 1228, Patchset 1 (Latest): auto result = client->ProcessOrphanedCommandResponse(response);
    Andrey Kosyakov . unresolved

    You can't just send a response to a random session, given that command ids are per-session.

    David Stevens

    I thought child sessions always allocated their command ids from their parent session [1]. If the parent and all children are unique command ids from a shared namespace, then only the child that actually used the command id will process the response. I don't know if that's part of the CDP spec, but I think it should work as long as chromedriver stays consistent. Although I guess things could get weird if you try to do log replay on a trace that doesn't provide the guarantee.

    [1] https://source.chromium.org/chromium/chromium/src/+/main:chrome/test/chromedriver/chrome/devtools_client_impl.cc;drc=35d26d364efb57d0386b98312ba739f7f65ae97e;l=814

    Andrey Kosyakov

    Thanks for pointing out, I missed that (I'm not well faimiliar with the chromedriver implmentation and had a bit of expectation bias based on other client implementations). I still think we better fix `Target.detachedFromTarget` to be properly dispatched.

    Open in Gerrit

    Related details

    Attention is currently required from:
    • Alex N. Jose
    • David Stevens
    Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement is not satisfiedCode-Owners
    • requirement is not satisfiedCode-Review
    • requirement is not satisfiedNo-Unresolved-Comments
    • requirement is not satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: Icb4ff89c07026388c8c8759bb6de2b77051b82df
    Gerrit-Change-Number: 7080912
    Gerrit-PatchSet: 1
    Gerrit-Owner: David Stevens <stev...@chromium.org>
    Gerrit-Reviewer: Alex N. Jose <ale...@chromium.org>
    Gerrit-CC: Alex Rudenko <alexr...@chromium.org>
    Gerrit-CC: Andrey Kosyakov <ca...@chromium.org>
    Gerrit-CC: Code Review Nudger <android-build...@prod.google.com>
    Gerrit-CC: Mathias Bynens <mat...@chromium.org>
    Gerrit-Attention: Alex N. Jose <ale...@chromium.org>
    Gerrit-Attention: David Stevens <stev...@chromium.org>
    Gerrit-Comment-Date: Tue, 04 Nov 2025 18:52:51 +0000
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy
    Reply all
    Reply to author
    Forward
    0 new messages