1699075 - Crash in [@ gbm_bo_get_fd]

Status: RESOLVED FIXED

(Core :: Widget: Gtk, defect, P2)

Description

[Simon Giesecke [:sg] [he/him]]

Crash report: https://crash-stats.mozilla.org/report/index/15d54d08-bb7b-4a65-8f82-8477e0210317

Reason: SIGSEGV /SEGV_MAPERR

Top 10 frames of crashing thread:

0 libgbm.so.1 gbm_bo_get_fd src/gbm/main/gbm.c:334
1 libxul.so DMABufSurfaceYUV::OpenFileDescriptorForPlane widget/gtk/DMABufSurface.cpp:811
2 libxul.so DMABufSurfaceYUV::Serialize widget/gtk/DMABufSurface.cpp:1035
3 libxul.so mozilla::layers::TextureClient::InitIPDLActor gfx/layers/client/TextureClient.cpp:1055
4 libxul.so mozilla::layers::ImageClientSingle::UpdateImage gfx/layers/client/ImageClient.cpp:232
5 libxul.so mozilla::layers::ImageBridgeChild::UpdateImageClient gfx/layers/ipc/ImageBridgeChild.cpp:339
6 libxul.so mozilla::runnable_args_memfn<RefPtr<mozilla::layers::ImageBridgeChild>, void  dom/media/webrtc/transport/runnable_utils.h:121
7 libxul.so mozilla::detail::runnable_args_base< dom/media/webrtc/transport/runnable_utils.h:41
8 libxul.so nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1152
9 libxul.so mozilla::ipc::MessagePumpForNonMainThreads::Run ipc/glue/MessagePump.cpp:332

Started with Nightly build id 20210316162954, maybe a regression from Bug 1661572?

Comment 1

[Martin Stránský [:stransky] (ni? me)]

I see, we should not export third plane for NV12 format. Will fix that, Thanks.

Comment 2

[Martin Stránský [:stransky] (ni? me)]

Attachment: Bug 1699075 [Linux] Check GBM buffer object before we get a file descriptor from it, r?jhorak

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/441e90bf188b
[Linux] Check GBM buffer object before we get a file descriptor from it, r=jhorak

Comment 4

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/441e90bf188b

Comment 5

[Martin Stránský [:stransky] (ni? me)]

I think the fix here isn't correct. The reason we crash here is that mBufferPlaneCount is set to some non-zero value but file descriptors / gmb object is cleared. It looks like the surface is already released but we try to use it after it.

Comment 6

[Martin Stránský [:stransky] (ni? me)]

Attachment: Bug 1699075 [Linux] Protect dmabuf release with a lock and clear dmabuf plane count there, r?jhorak

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/416f46bfdcda
[Linux] Protect dmabuf release with a lock and clear dmabuf plane count there, r=jhorak

Comment 8

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/416f46bfdcda