Crash in mesa::RealKMSOutput::max_refresh_rate() when hotplugging screens in host server

Bug #1664180 reported by Nick Dedekind
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Mir
New
High
Unassigned
mir (Ubuntu)
New
High
Unassigned

Bug Description

Crash when hotplugging screen running mir_demo_server as a host server to qtmir.

Crash file attached.

Tags: multimonitor
Revision history for this message
Nick Dedekind (nick-dedekind) wrote :
Download full text (5.4 KiB)

== Stacktrace =================================
#0 0x00007effb88ff0b9 in mir::graphics::mesa::RealKMSOutput::max_refresh_rate (this=0x55c4b506e220) at /home/nick/Work/ubuntu/mir/mir-0.26.0+17.04.20170126.3/src/platforms/mesa/server/kms/real_kms_output.cpp:102
        current_mode = <error reading variable>
#1 0x00007effb88de663 in mir::graphics::mesa::DisplayBuffer::post (this=0x55c4b51d0200) at /home/nick/Work/ubuntu/mir/mir-0.26.0+17.04.20170126.3/src/platforms/mesa/server/kms/display_buffer.cpp:355
        output = std::shared_ptr (count 2, weak 0) 0x55c4b506e220
        min_frame_interval = {__r = 139636366146016}
        bufobj = 0x7effa00080e0
        predicted_render_time = {__r = 5}
#2 0x00007effbec63fce in mir::compositor::CompositingFunctor::operator() (this=0x55c4b51f9c30) at /home/nick/Work/ubuntu/mir/mir-0.26.0+17.04.20170126.3/src/server/compositor/multi_threaded_compositor.cpp:143
        delay = {__r = 139636366355200}
        pending = -1095108196
        lock = {_M_device = 0x55c4b51f9c68, _M_owns = false}
        disp_listener = std::shared_ptr (count 6, weak 2) 0x55c4b511b878
        display_registration = {deleter = {__this = 0x55c4b51f9c30, __disp_listener = std::shared_ptr (count 6, weak 2) 0x55c4b511b878}, owner = true}
        compositor_registration = {deleter = {__this = 0x55c4b51f9c30, __compositors = std::vector of length 1, capacity 1 = {std::tuple containing = {[1] = 0x55c4b51d0200, [2] = std::unique_ptr<mir::compositor::DisplayBufferCompositor> containing 0x7effa0009010}}}, owner = true}
        compositors = std::vector of length 1, capacity 1 = {std::tuple containing = {[1] = 0x55c4b51d0200, [2] = std::unique_ptr<mir::compositor::DisplayBufferCompositor> containing 0x7effa0009010}}
#3 0x00007effbec677ae in std::_Function_handler<void (), std::reference_wrapper<mir::compositor::CompositingFunctor> >::_M_invoke(std::_Any_data const&) (__functor=...) at /usr/include/c++/6/functional:1761
No locals.
#4 0x00007effbeb0cf96 in std::function<void ()>::operator()() const (this=0x7effaf7fdd80) at /usr/include/c++/6/functional:2127
No locals.
#5 0x00007effbedb75ef in (anonymous namespace)::Task::execute (this=0x7effaf7fdd80) at /home/nick/Work/ubuntu/mir/mir-0.26.0+17.04.20170126.3/src/server/thread/basic_thread_pool.cpp:40
No locals.
#6 0x00007effbedb7958 in (anonymous namespace)::Worker::operator() (this=0x55c4b528cde0) at /home/nick/Work/ubuntu/mir/mir-0.26.0+17.04.20170126.3/src/server/thread/basic_thread_pool.cpp:91
        task = {task = {<std::_Maybe_unary_or_binary_function<void>> = {<No data fields>}, <std::_Function_base> = {static _M_max_size = 16, static _M_max_align = 8, _M_functor = {_M_unused = {_M_object = 0x55c4b51f9c30, _M_const_object = 0x55c4b51f9c30, _M_function_pointer = 0x55c4b51f9c30, _M_member_pointer = (void (std::_Undefined_class::*)(std::_Undefined_class * const)) 0x55c4b51f9c30}, _M_pod_data = "0\234\037\265\304U\000\000\000\000\000\000\000\000\000"}, _M_manager = 0x7effbec677b1 <std::_Function_base::_Ref_manager<mir::compositor::CompositingFunctor>::_M_manager(std::_Any_data&, std::_Any_data const&, std::_Manager_operation)>}, _M_invoker = 0x7effbec67783 <std::_Function_handler<void ...

Read more...

Revision history for this message
Nick Dedekind (nick-dedekind) wrote :
Revision history for this message
Daniel van Vugt (vanvugt) wrote :

I know this one. Looking at the offending source code, I remember previously having a fix written for it but for some reason never ended up needing or committing it.

tags: added: multimonitor
Changed in mir:
importance: Undecided → High
assignee: nobody → Daniel van Vugt (vanvugt)
milestone: none → 1.0.0
status: New → Triaged
Revision history for this message
Daniel van Vugt (vanvugt) wrote :

I take it back. Simply adding a range check on the array lookup won't really solve this properly. We'll need to find out why the output has no valid current mode when it's being posted to.

Changed in mir:
assignee: Daniel van Vugt (vanvugt) → nobody
status: Triaged → New
summary: - Crashing when hotpluggin screens in host server
+ Crash in mesa::RealKMSOutput::max_refresh_rate() when hotplugging
+ screens in host server
Changed in mir:
milestone: 0.27.0 → 0.28.0
Revision history for this message
Michał Sawicz (saviq) wrote :

Syncing task from Mir.

Changed in mir (Ubuntu):
importance: Undecided → High
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.