1031949 - Crash in GonkDisplay::SwapBuffers() because Framebuffer tries to dup uninitialized Fence [SGS2][JB]

Status: RESOLVED FIXED

(Core Graveyard :: Widget: Gonk, defect)

Description

[Juan Gomez [:_AtilA_] (CET/CEST)]

I got this crash on SGS2, but it will probably crash any JellyBean based device that hits direct FrameBuffer rendering code path (not HWComposer).
The problem is that FramebufferSurface::GetPrevFBAcquireFd() is being called before mPrevFBAcquireFence has been properly initialized, so the mPrevFBAcquireFence->dup() is segfaulting.

Comment 1

[Juan Gomez [:_AtilA_] (CET/CEST)]

Attachment: 0001-Bug-1031949-Crash-in-GonkDisplay-SwapBuffers-because.patch

This fixes the issue.

Comment 2

[Sotaro Ikeda [:sotaro]]

Comment on attachment 8447772 [details] [diff] [review]
0001-Bug-1031949-Crash-in-GonkDisplay-SwapBuffers-because.patch

Review of attachment 8447772 [details] [diff] [review]:
-----------------------------------------------------------------

0 could be a valid file descriptor number. Can we use Fence::isValid() for validity check?

Comment 3

[Michael Wu [:mwu]]

(In reply to Sotaro Ikeda [:sotaro] from comment #2)
> Comment on attachment 8447772 [details] [diff] [review]
> 0001-Bug-1031949-Crash-in-GonkDisplay-SwapBuffers-because.patch
> 
> Review of attachment 8447772 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> 0 could be a valid file descriptor number. Can we use Fence::isValid() for
> validity check?

That's actually a pointer - http://hg.mozilla.org/mozilla-central/file/7c794981d046/widget/gonk/libdisplay/FramebufferSurface.h#l80 , so this check is fine AFAIK. isValid() won't work since there's no object to call it on.

Comment 4

[Sotaro Ikeda [:sotaro]]

Comment on attachment 8447772 [details] [diff] [review]
0001-Bug-1031949-Crash-in-GonkDisplay-SwapBuffers-because.patch

Review of attachment 8447772 [details] [diff] [review]:
-----------------------------------------------------------------

Sorry, I just misunderstood the patch.

Comment 5

[Michael Wu [:mwu]]

(In reply to Juan Gomez [:_AtilA_] from comment #0)
> I got this crash on SGS2, but it will probably crash any JellyBean based
> device that hits direct FrameBuffer rendering code path (not HWComposer).
> The problem is that FramebufferSurface::GetPrevFBAcquireFd() is being called
> before mPrevFBAcquireFence has been properly initialized, so the
> mPrevFBAcquireFence->dup() is segfaulting.

FWIW, I've only seen this on 4.2 devices.

Comment 6

[Juan Gomez [:_AtilA_] (CET/CEST)]

I have this issue in 4.3. Anyway, reproduce it should be as easy as renaming hwcomposer.device.so to force the device use the framebuffer render path.

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/b2g-inbound/rev/21cf986ec9fb

Comment 8

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/21cf986ec9fb