Closed Bug 1699075 Opened 7 months ago Closed 7 months ago

Crash in [@ gbm_bo_get_fd]

Categories

(Core :: Widget: Gtk, defect, P2)

defect

Tracking

()

RESOLVED FIXED
88 Branch
Tracking Status
thunderbird_esr78 --- unaffected
firefox-esr78 --- unaffected
firefox86 --- unaffected
firefox87 --- unaffected
firefox88 + fixed

People

(Reporter: sg, Assigned: stransky)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: crash, regression)

Crash Data

Attachments

(2 files)

Crash report: https://crash-stats.mozilla.org/report/index/15d54d08-bb7b-4a65-8f82-8477e0210317

Reason: SIGSEGV /SEGV_MAPERR

Top 10 frames of crashing thread:

0 libgbm.so.1 gbm_bo_get_fd src/gbm/main/gbm.c:334
1 libxul.so DMABufSurfaceYUV::OpenFileDescriptorForPlane widget/gtk/DMABufSurface.cpp:811
2 libxul.so DMABufSurfaceYUV::Serialize widget/gtk/DMABufSurface.cpp:1035
3 libxul.so mozilla::layers::TextureClient::InitIPDLActor gfx/layers/client/TextureClient.cpp:1055
4 libxul.so mozilla::layers::ImageClientSingle::UpdateImage gfx/layers/client/ImageClient.cpp:232
5 libxul.so mozilla::layers::ImageBridgeChild::UpdateImageClient gfx/layers/ipc/ImageBridgeChild.cpp:339
6 libxul.so mozilla::runnable_args_memfn<RefPtr<mozilla::layers::ImageBridgeChild>, void  dom/media/webrtc/transport/runnable_utils.h:121
7 libxul.so mozilla::detail::runnable_args_base< dom/media/webrtc/transport/runnable_utils.h:41
8 libxul.so nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1152
9 libxul.so mozilla::ipc::MessagePumpForNonMainThreads::Run ipc/glue/MessagePump.cpp:332

Started with Nightly build id 20210316162954, maybe a regression from Bug 1661572?

Flags: needinfo?(stransky)
Regressed by: 1661572

I see, we should not export third plane for NV12 format. Will fix that, Thanks.

Assignee: nobody → stransky
Flags: needinfo?(stransky)
Priority: -- → P2
Pushed by stransky@redhat.com:
https://hg.mozilla.org/integration/autoland/rev/441e90bf188b
[Linux] Check GBM buffer object before we get a file descriptor from it, r=jhorak
Status: NEW → RESOLVED
Closed: 7 months ago
Resolution: --- → FIXED
Target Milestone: --- → 88 Branch

I think the fix here isn't correct. The reason we crash here is that mBufferPlaneCount is set to some non-zero value but file descriptors / gmb object is cleared. It looks like the surface is already released but we try to use it after it.

Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Pushed by stransky@redhat.com:
https://hg.mozilla.org/integration/autoland/rev/416f46bfdcda
[Linux] Protect dmabuf release with a lock and clear dmabuf plane count there, r=jhorak
Status: REOPENED → RESOLVED
Closed: 7 months ago7 months ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.