Mir server crashed with SIGSEGV in mir::compositor::TemporaryBuffer::size() called from mir::gl::tessellate_renderable_into_rectangle()
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Mir |
Fix Released
|
High
|
Michał Kuchta | ||
0.26 |
Fix Released
|
High
|
Michał Kuchta | ||
mir (Ubuntu) |
Fix Released
|
High
|
Unassigned |
Bug Description
I run mir exempla:
./bin/mir_
mir_demo_server crash when I move central animated object to right border and back.
Cause of crash is to call size() function from invalid pointer in temporaty_
I have checked why pointer is invalid:
In function:
std::shared_
auto& last_entry = onscreen_
last_
if (mode == mc::MultiMonito
last_entry reference pointing not existing object (object is not longer in onscreen_buffers) after calling clean_onscreen_
clean_onscreen_
Related branches
- Mir CI Bot: Approve (continuous-integration)
- Daniel van Vugt: Approve
-
Diff: 43 lines (+19/-1)2 files modifiedsrc/server/compositor/multi_monitor_arbiter.cpp (+2/-1)
tests/unit-tests/compositor/test_multi_monitor_arbiter.cpp (+17/-0)
- Michał Sawicz: Disapprove
-
Diff: 13 lines (+6/-0)1 file modifieddebian/changelog (+6/-0)
Changed in mir: | |
importance: | Undecided → High |
status: | New → Confirmed |
milestone: | none → 1.0.0 |
Changed in mir: | |
assignee: | nobody → Michał Kuchta (kuchtam) |
Changed in mir: | |
status: | Confirmed → In Progress |
summary: |
- mir_demo_server crashed with SIGSEGV in + Mir server crashed with SIGSEGV in mir::compositor::TemporaryBuffer::size() called from mir::gl::tessellate_renderable_into_rectangle() |
Changed in mir (Ubuntu): | |
status: | New → Triaged |
importance: | Undecided → High |
Changed in mir: | |
status: | Fix Committed → Fix Released |
Thread 4 "Mir/Comp" received signal SIGSEGV, Segmentation fault. ::TemporaryBuff er::size ( 0x7fffe80084f0) bzr/mir/ trunk/src/ server/ compositor/ temporary_ buffers. cpp:60 ::TemporaryBuff er::size ( 0x7fffe80084f0) bzr/mir/ trunk/src/ server/ compositor/ temporary_ buffers. cpp:60 :tessellate_ renderable_ into_rectangle ( bzr/mir/ trunk/src/ gl/tessellation _helpers. cpp:29 :gl::Renderer: :tessellate ( 0x7fffe80008c0, std::vector of length 1, capacity 1 = {...}, renderable=...) bzr/mir/ trunk/src/ renderers/ gl/renderer. cpp:200 :gl::Renderer: :draw ( 0x7fffe80008c0, renderable=..., prog=...) bzr/mir/ trunk/src/ renderers/ gl/renderer. cpp:253 :gl::Renderer: :render ( 0x7fffe80008c0, =std::vector of length 4, capacity 4 = {...}) bzr/mir/ trunk/src/ renderers/ gl/renderer. cpp:213 ::DefaultDispla yBufferComposit or::composite( std::vector< std::shared_ ptr<mir: :compositor: :SceneElement> , std::allocator< std::shared_ ptr<mir: :compositor: :SceneElement> > >&&) (this=0x7fffe80 08620, elements= <unknown type in /home/dan/ bzr/mir/ trunk/build/ bin/../ lib/libmirserve r.so.44, CU 0x66b90b, DIE 0x673525>) bzr/mir/ trunk/src/ server/ compositor/ default_ display_ buffer_ compositor. cpp:84 ::CompositingFu nctor:: operator( ) ( 0x5555559ded70) bzr/mir/ trunk/src/ server/ compositor/ multi_threaded_ compositor. cpp:141 handler< void (), std::reference_ wrapper< mir::compositor ::CompositingFu nctor> >::_M_invoke( std::_Any_ data const&) ( c++/6/functiona l:1761 0x7fffecac2d80) at /usr/include/ c++/6/functiona l:2127
[Switching to Thread 0x7fffecac3700 (LWP 11311)]
0x00007ffff5cc0150 in mir::compositor
this=
at /home/dan/
60 return buffer->size();
(gdb) bt
#0 0x00007ffff5cc0150 in mir::compositor
this=
at /home/dan/
#1 0x00007ffff5e2d98c in mir::gl:
renderable=..., offset=...)
at /home/dan/
#2 0x00007ffff5e25f8f in mir::renderer:
this=
primitives=
at /home/dan/
#3 0x00007ffff5e264f4 in mir::renderer:
this=
at /home/dan/
#4 0x00007ffff5e26182 in mir::renderer:
this=
renderables
at /home/dan/
#5 0x00007ffff5cbddd8 in mir::compositor
scene_
at /home/dan/
#6 0x00007ffff5cc5798 in mir::compositor
this=
at /home/dan/
#7 0x00007ffff5cc8fc0 in std::_Function_
__functor=...) at /usr/include/
#8 0x00007ffff5b6a9f6 in std::function<void ()>::operator()() const (
this=