Bug 1619882 Comment 76 Edit History

Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.

Yes, it's definitely use-after-free scenario, there's a log from my debug build where surface UID is used across the processes. It's 100% reproducible when CPU usage is 100% and then video with overlay is played (I use Firefox compilation as the CPU utilization :-)). When the video overlay is not used the vaapi playback is ok even when 100% CPU is used.

Created dmabuf UID = 63 HW surface 4000014
Creating TextureClient(), UID = 63
Create WaylandDMABUFTextureData UID = 63
Creating WaylandDMABUFTextureHostOGL() UID = 63
WaylandDMABUFTextureHostOGL::CreateRenderTexture() UID = 63
Created RenderWaylandDMABUFTextureHostOGL() UID = 63
WaylandDMABUFTextureHostOGL::PushResourceUpdates() UID = 63
RenderWaylandDMABUFTextureHostOGL::Lock() UID = 63
RenderWaylandDMABUFTextureHostOGL::Lock() UID = 63

Releasing WaylandDMABUFSurfaceImage(), UID = 63 <<< released HW surface

WaylandDMABUFTextureData::Forget UID = 63
WaylandDMABufSurfaceNV12 Release UID = 63
RenderWaylandDMABUFTextureHostOGL::Unlock() UID = 63
RenderWaylandDMABUFTextureHostOGL::Unlock() UID = 63
RenderWaylandDMABUFTextureHostOGL::Lock() UID = 63
RenderWaylandDMABUFTextureHostOGL::Lock() UID = 63
RenderWaylandDMABUFTextureHostOGL::Unlock() UID = 63
RenderWaylandDMABUFTextureHostOGL::Unlock() UID = 63
Yes, it's definitely use-after-free scenario, there's a log from my debug build where surface UID is used across the processes. It's 100% reproducible when CPU usage is 100% and then video with overlay is played (I use Firefox compilation as the CPU utilization :-)). When the video overlay is not used the vaapi playback is ok even when 100% CPU is used.

Created dmabuf UID = 63 HW surface 4000014
Creating TextureClient(), UID = 63
Create WaylandDMABUFTextureData UID = 63
Creating WaylandDMABUFTextureHostOGL() UID = 63
WaylandDMABUFTextureHostOGL::CreateRenderTexture() UID = 63
Created RenderWaylandDMABUFTextureHostOGL() UID = 63
WaylandDMABUFTextureHostOGL::PushResourceUpdates() UID = 63
RenderWaylandDMABUFTextureHostOGL::Lock() UID = 63

Releasing WaylandDMABUFSurfaceImage(), UID = 63 <<< released HW surface

WaylandDMABUFTextureData::Forget UID = 63
WaylandDMABufSurfaceNV12 Release UID = 63
RenderWaylandDMABUFTextureHostOGL::Unlock() UID = 63
RenderWaylandDMABUFTextureHostOGL::Lock() UID = 63
RenderWaylandDMABUFTextureHostOGL::Unlock() UID = 63

Back to Bug 1619882 Comment 76