Closed
Bug 966446
Opened 9 years ago
Closed 9 years ago
Use after free of PGrallocBufferParent by new texture when the child process is killed
Categories
(Core :: Graphics: Layers, defect)
Tracking
()
Tracking | Status | |
---|---|---|
b2g-v1.3T | --- | fixed |
People
(Reporter: sotaro, Assigned: sotaro)
References
Details
Attachments
(2 files, 2 obsolete files)
7.42 KB,
patch
|
sotaro
:
review+
|
Details | Diff | Splinter Review |
7.37 KB,
patch
|
Details | Diff | Splinter Review |
I faced this problem during Bug 946720 development. In the past same problem was fixed by Bug 862324. But it is only for deprecated texture.
Assignee | ||
Updated•9 years ago
|
OS: Windows 7 → Gonk (Firefox OS)
Hardware: x86_64 → ARM
Assignee | ||
Comment 1•9 years ago
|
||
Assignee | ||
Comment 2•9 years ago
|
||
Deprecated texture's problem was actually fixed by Bug 915869.
Assignee | ||
Updated•9 years ago
|
Assignee: nobody → sotaro.ikeda.g
Assignee | ||
Updated•9 years ago
|
Status: NEW → ASSIGNED
Assignee | ||
Comment 3•9 years ago
|
||
The problem is that GrallocTextureHostOGL calls PGrallocBufferParent::Send__delete__() after GrallocBufferActor deletion.
Assignee | ||
Comment 4•9 years ago
|
||
There are the following ways to fix the problem. - [1] Change GrallocBufferActor as reference counted and GrallocTextureHostOGL does not directly call PGrallocBufferParent::Send__delete__(). - [2] GrallocTextureHostOGL forget a pointer to GrallocBufferActor when GrallocBufferActor is destroyed by IPC error. [1] is ideal way to fix the problem. But the change becomes relatively large. It might be better to put off [1] to MozSurface implementation. [2] is not a better way, but relatively easy to implement. [2] is same way as in Bug 915869 for deprecated texture.
Assignee | ||
Comment 5•9 years ago
|
||
This is a hacky fix. Confirmed that problem in bug 946720 is fixed by the patch. In near future, MozSurface should fix the problem correctly.
Assignee | ||
Updated•9 years ago
|
Attachment #8370957 -
Flags: review?(nical.bugzilla)
Updated•9 years ago
|
Attachment #8370957 -
Flags: review?(nical.bugzilla) → review+
Assignee | ||
Comment 6•9 years ago
|
||
https://tbpl.mozilla.org/?tree=Try&rev=5f2cbc946c2b
Assignee | ||
Comment 7•9 years ago
|
||
Committable patch. Carry 'r=nical'.
Attachment #8368800 -
Attachment is obsolete: true
Attachment #8370957 -
Attachment is obsolete: true
Attachment #8371982 -
Flags: review+
Assignee | ||
Updated•9 years ago
|
Keywords: checkin-needed
Comment 8•9 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/eee6439dac17
Keywords: checkin-needed
Comment 9•9 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/eee6439dac17
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla30
Assignee | ||
Comment 10•8 years ago
|
||
Nominate to "1.3T+". This bug block's bug 994590.
Assignee | ||
Updated•8 years ago
|
blocking-b2g: --- → 1.3T?
Updated•8 years ago
|
blocking-b2g: 1.3T? → 1.3T+
Updated•8 years ago
|
status-b2g-v1.3T:
--- → affected
Comment 11•8 years ago
|
||
v1.3 patch conflict
Comment 12•8 years ago
|
||
Hi! Sotaro, Could you help? Thanks -- Keven
Flags: needinfo?(sotaro.ikeda.g)
You need to log in
before you can comment on or make changes to this bug.
Description
•