Buffer leak during repeated mirscreencasts causes server to be killed

[Alan Pope 🍺🐧🐱 🦄]

Nexus 4 running latest stable image -

current build number: 25
device name: mako
channel: ubuntu-touch/stable/ubuntu
last update: 2015-12-08 11:53:16
version version: 25
version ubuntu: 20151118.2
version tag: OTA-8
version device: 20150911
version custom: 20151118.2

I'm running the following command to capture a screenshot of a running app, the unity shell, the splash screen when apps load etc.

  adb shell mirscreencast -m /var/run/mir_socket -n1

I'm doing this in a script, across many hundreds of apps, so I'm doing it a lot. I'm seeing my script get wedged fairly often with errors such as this one:-

[1449575031.562843] <ERROR> MirConnectionAPI: Caught exception at client library boundary (in release): /build/mir-AHj2eT/mir-0.17.1+15.04.20151105.1/src/client/rpc/stream_socket_transport.cpp(168): Throw in function virtual void mir::client::rpc::StreamSocketTransport::send_message(const std::vector<unsigned char>&, const std::vector<mir::Fd>&)
Dynamic exception type: N5boost16exception_detail10clone_implINS0_19error_info_injectorIN3mir25socket_disconnected_errorEEEEE
std::exception::what: Failed to send message to server: Broken pipe

[Cemil Azizoglu (cemil-azizoglu)]

N4 driver is not doing decRef when eglDestroyImageKHR() is called for the screencast DisplayBuffer.

Also, mir is not calling eglDestroyImageKHR() for the capture buffer (which is affecting both N4 and krillin).

 krillin : http://pastebin.ubuntu.com/14134610/
 N4 : http://pastebin.ubuntu.com/14134689/

[Daniel van Vugt (vanvugt)]

Surely both of those statements suggest we'd just leak (or freeze). How would leaking the image cause a crash?

[Cemil Azizoglu (cemil-azizoglu)]

>How would leaking the image cause a crash?

Server runs out of memory and is killed. Meanwhile, mirscreencast client fails to connect since there is no server.

[Daniel van Vugt (vanvugt)]

IIRC, the image data is ref-counted internally in the driver (per Khronos extension docs). So you not only need to remember to destroy the image, but also need to delete all associated GL textures. Only when all such references are gone will the buffer be freed.

[PS Jenkins bot (ps-jenkins)]

Fix committed into lp:mir at revision None, scheduled for release in mir, milestone 0.19.0

[Launchpad Janitor (janitor)]

This bug was fixed in the package mir - 0.19.0+16.04.20160128-0ubuntu1

---------------
mir (0.19.0+16.04.20160128-0ubuntu1) xenial; urgency=medium

  [ Brandon Schaefer ]
  * New upstream release 0.19.0
    - API summary:
      . mirclient abi unchanged at 9
      . mirserver abi bumped to 37
      . mircommon abi unchanged at 5
      . mirplatform abi unchanged at 11
      . mirprotobuf abi unchanged at 3
      . mirplatformgraphics abi bumped to 7
      . mirclientplatform abi bumped to 4
      . mirinputplatform abi bumped to 5
      . mircookie abi bumped to 2
    - Bug fix:
      . Mir servers crash on mouse input (LP: #1528438)
      . Pinch to zoom not working reliably (LP: #1531517)
      . Passing DisplayConfiguration scale property from
        nested server to host appears to not work (LP: #1535780)
      . Various TSan reports when running test suite
        on a mir tsan enabled build (LP: #1523647)
      . Buffer leak during repeated mirscreencasts
        causes server to be killed (LP: #1523900)
      . Cursor now displays correctly (LP: #1526779)
      .ProgramOption::parse_file() reports problems to cerr (LP: #1190165)
      . Nested servers can select wrong platform (LP: #1515558)
      . There seems to be missing RTTI information
         when linking with UBSan enabled (LP: #1521930)
      . Mir threadsanitizer build fails with GCC (LP: #1522581)
      . After "make install" mir_demo_server cannot
        find shared object file in /usr/local/lib (LP: #1522836)
      . Fixed a test in TestClientInput (LP: #1523965)
      . Mir servers choose graphics-dummy (or no driver at all)
        over mesa-kms on a desktop (LP: #1528082)
      . Function mir_event_get_close_surface_event is never used (LP: #1447690)
      . mir::input::Surface::consume(MirEvent const& event)
        should not take a reference to an opaque type (LP: #1450797)
      . lintian: E: mir-doc: privacy-breach-logo (LP: #1483471)

  [ CI Train Bot ]
  * No-change rebuild.

 -- Brandon Schaefer <email address hidden> Thu, 28 Jan 2016 12:19:47 +0000