Crash in mesa::RealKMSOutput::max_refresh_rate() when hotplugging screens in host server

[Nick Dedekind]

Crash when hotplugging screen running mir_demo_server as a host server to qtmir.

Crash file attached.

[Nick Dedekind (nick-dedekind)]

== Stacktrace =================================
#0 0x00007effb88ff0b9 in mir::graphics::mesa::RealKMSOutput::max_refresh_rate (this=0x55c4b506e220) at /home/nick/Work/ubuntu/mir/mir-0.26.0+17.04.20170126.3/src/platforms/mesa/server/kms/real_kms_output.cpp:102
        current_mode = <error reading variable>
#1 0x00007effb88de663 in mir::graphics::mesa::DisplayBuffer::post (this=0x55c4b51d0200) at /home/nick/Work/ubuntu/mir/mir-0.26.0+17.04.20170126.3/src/platforms/mesa/server/kms/display_buffer.cpp:355
        output = std::shared_ptr (count 2, weak 0) 0x55c4b506e220
        min_frame_interval = {__r = 139636366146016}
        bufobj = 0x7effa00080e0
        predicted_render_time = {__r = 5}
#2 0x00007effbec63fce in mir::compositor::CompositingFunctor::operator() (this=0x55c4b51f9c30) at /home/nick/Work/ubuntu/mir/mir-0.26.0+17.04.20170126.3/src/server/compositor/multi_threaded_compositor.cpp:143
        delay = {__r = 139636366355200}
        pending = -1095108196
        lock = {_M_device = 0x55c4b51f9c68, _M_owns = false}
        disp_listener = std::shared_ptr (count 6, weak 2) 0x55c4b511b878
        display_registration = {deleter = {__this = 0x55c4b51f9c30, __disp_listener = std::shared_ptr (count 6, weak 2) 0x55c4b511b878}, owner = true}
        compositor_registration = {deleter = {__this = 0x55c4b51f9c30, __compositors = std::vector of length 1, capacity 1 = {std::tuple containing = {[1] = 0x55c4b51d0200, [2] = std::unique_ptr<mir::compositor::DisplayBufferCompositor> containing 0x7effa0009010}}}, owner = true}
        compositors = std::vector of length 1, capacity 1 = {std::tuple containing = {[1] = 0x55c4b51d0200, [2] = std::unique_ptr<mir::compositor::DisplayBufferCompositor> containing 0x7effa0009010}}
#3 0x00007effbec677ae in std::_Function_handler<void (), std::reference_wrapper<mir::compositor::CompositingFunctor> >::_M_invoke(std::_Any_data const&) (__functor=...) at /usr/include/c++/6/functional:1761
No locals.
#4 0x00007effbeb0cf96 in std::function<void ()>::operator()() const (this=0x7effaf7fdd80) at /usr/include/c++/6/functional:2127
No locals.
#5 0x00007effbedb75ef in (anonymous namespace)::Task::execute (this=0x7effaf7fdd80) at /home/nick/Work/ubuntu/mir/mir-0.26.0+17.04.20170126.3/src/server/thread/basic_thread_pool.cpp:40
No locals.
#6 0x00007effbedb7958 in (anonymous namespace)::Worker::operator() (this=0x55c4b528cde0) at /home/nick/Work/ubuntu/mir/mir-0.26.0+17.04.20170126.3/src/server/thread/basic_thread_pool.cpp:91
        task = {task = {<std::_Maybe_unary_or_binary_function<void>> = {<No data fields>}, <std::_Function_base> = {static _M_max_size = 16, static _M_max_align = 8, _M_functor = {_M_unused = {_M_object = 0x55c4b51f9c30, _M_const_object = 0x55c4b51f9c30, _M_function_pointer = 0x55c4b51f9c30, _M_member_pointer = (void (std::_Undefined_class::*)(std::_Undefined_class * const)) 0x55c4b51f9c30}, _M_pod_data = "0\234\037\265\304U\000\000\000\000\000\000\000\000\000"}, _M_manager = 0x7effbec677b1 <std::_Function_base::_Ref_manager<mir::compositor::CompositingFunctor>::_M_manager(std::_Any_data&, std::_Any_data const&, std::_Manager_operation)>}, _M_invoker = 0x7effbec67783 <std::_Function_handler<void ...

[Daniel van Vugt (vanvugt)]

I know this one. Looking at the offending source code, I remember previously having a fix written for it but for some reason never ended up needing or committing it.

[Daniel van Vugt (vanvugt)]

I take it back. Simply adding a range check on the array lookup won't really solve this properly. We'll need to find out why the output has no valid current mode when it's being posted to.

[Michał Sawicz (saviq)]

Syncing task from Mir.