New issue
Advanced search Search tips

Issue 848444 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: Jun 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 1
Type: Bug



Sign in to add a comment

crash in ForwardingDisplayDelegate

Project Member Reported by est...@chromium.org, May 31 2018

Issue description

Starting up chromeos-on-linux on ToT (c524918d8b7ee4ae8f0e91e5), with --enable-features=Mash and a fresh user data dir, I get this crash:

#0 0x7fee25ac2e5c base::debug::StackTrace::StackTrace()
#1 0x7fee25ac2951 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#2 0x7fee192650c0 <unknown>
#3 0x7fee17bb4fcf gsignal
#4 0x7fee17bb63fa abort
#5 0x7fee25ac17e5 base::debug::BreakDebugger()
#6 0x7fee25a135a8 logging::LogMessage::~LogMessage()
#7 0x7fee1fbe8e11 mojo::internal::Serializer<>::Serialize()
#8 0x7fee1fbe67e8 display::mojom::NativeDisplayDelegateProxy::SetColorMatrix()
#9 0x7fee1fbca78b display::ForwardingDisplayDelegate::SetColorMatrix()
#10 0x7fee1fbd7d42 display::(anonymous namespace)::RunColorCorrectionClosureSync()
#11 0x7fee1fbd7c82 display::DisplayConfigurator::SetColorMatrix()
#12 0x7fee1f6c51d2 ash::DisplayColorManager::ApplyDisplayColorCalibration()
#13 0x7fee1f6c4fb5 ash::DisplayColorManager::OnDisplayModeChanged()
#14 0x7fee1fbd8095 display::DisplayConfigurator::NotifyDisplayStateObservers()
#15 0x7fee1fbd5e8a display::DisplayConfigurator::OnConfigured()
#16 0x7fee1fbda01c _ZN4base8internal7InvokerINS0_9BindStateIMN7display19DisplayConfiguratorEFvbRKNSt3__16vectorIPNS3_15DisplaySnapshotENS5_9allocatorIS8_EEEENS3_20MultipleDisplayStateEN8chromeos17DisplayPowerStateEEJNS_7WeakPtrIS4_EEEEEFvbSD_SE_SG_EE3RunEPNS0_13BindStateBaseEbSD_SE_SG_
#17 0x7fee1fbe499f display::UpdateDisplayConfigurationTask::OnStateEntered()
#18 0x7fee1fbe4cff _ZN4base8internal7InvokerINS0_9BindStateIMN7display30UpdateDisplayConfigurationTaskEFvNS3_21ConfigureDisplaysTask6StatusEEJNS_7WeakPtrIS4_EEEEEFvS6_EE3RunEPNS0_13BindStateBaseES6_
#19 0x7fee1fbd0bea display::ConfigureDisplaysTask::Run()
#20 0x7fee1fbd0f01 display::ConfigureDisplaysTask::OnConfigured()
#21 0x7fee1fbd14b4 _ZN4base8internal7InvokerINS0_9BindStateIMN7display21ConfigureDisplaysTaskEFvmbEJNS_7WeakPtrIS4_EEmEEEFvbEE3RunEPNS0_13BindStateBaseEb
#22 0x7fee1fbe78ca display::mojom::NativeDisplayDelegate_Configure_ForwardToCallback::Accept()
#23 0x7fee24d6dac6 mojo::InterfaceEndpointClient::HandleValidatedMessage()
 

Comment 1 by est...@chromium.org, May 31 2018

no crash seen after I revert ef2d15e4db34387f0e591cb
estade, see a logging::LogMessage::~LogMessage(), was there any log message from a DCHECK() or something else that can help me figure out what went wrong?
sorry for cutting that off, I'll check again later today --- are you unable to reproduce?
No worries if you don't have it now. I'll attempt to repro myself later when I'm done with the task at hand.
afakhry@ which component can we use here?
Components: Internals>Services>Ash
Cc: dcasta...@chromium.org dcheng@chromium.org
[57702:57702:0601/154403.468898:FATAL:array_serialization.h(489)] The outgoing message will trigger VALIDATION_ERROR_UNEXPECTED_ARRAY_HEADER at the receiving side (fixed-size array has wrong number of elements: array size - 0; expected size - 9).


This is because ResetDisplayColorCalibration() applies an empty matrix, and we changed the `native_display_delegate.mojom` to expect `array<float, 9>` for the color matrix, hence the crash. We can change the code to never set an empty matrix and instead use the identity one.

Here's the full stack trace:





#0 0x7f6f5d953c5d base::debug::StackTrace::StackTrace()
#1 0x7f6f5d6a605c base::debug::StackTrace::StackTrace()
#2 0x7f6f5d70f9ed logging::LogMessage::~LogMessage()
#3 0x7f6f4c5ce75d mojo::internal::Serializer<>::Serialize()
#4 0x7f6f4c5c4ae9 _ZN4mojo8internal9SerializeINS_13ArrayDataViewIfEERKNSt3__16vectorIfNS4_9allocatorIfEEEEJRPNS0_6BufferEPNS0_10Array_DataIfE12BufferWriterEPKNS0_23ContainerValidateParamsEPNS0_20SerializationContextEELPv0EEEvOT0_DpOT1_
#5 0x7f6f4c5bab30 display::mojom::NativeDisplayDelegateProxy::SetColorMatrix()
#6 0x7f6f4c54ea94 display::ForwardingDisplayDelegate::SetColorMatrix()
#7 0x7f6f4c583b70 _ZN4base8internal13FunctorTraitsIMN7display21NativeDisplayDelegateEFblRKNSt3__16vectorIfNS4_9allocatorIfEEEEEvE6InvokeISC_PS3_JlS8_EEEbT_OT0_DpOT1_
#8 0x7f6f4c583a8a _ZN4base8internal12InvokeHelperILb0EbE8MakeItSoIMN7display21NativeDisplayDelegateEFblRKNSt3__16vectorIfNS6_9allocatorIfEEEEEJPS5_lSA_EEEbOT_DpOT0_
#9 0x7f6f4c5839fd _ZN4base8internal7InvokerINS0_9BindStateIMN7display21NativeDisplayDelegateEFblRKNSt3__16vectorIfNS5_9allocatorIfEEEEEJNS0_17UnretainedWrapperIS4_EElS9_EEEFbvEE7RunImplISD_NS5_5tupleIJSF_lS9_EEEJLm0ELm1ELm2EEEEbOT_OT0_NS5_16integer_sequenceImJXspT1_EEEE
#10 0x7f6f4c5838c9 _ZN4base8internal7InvokerINS0_9BindStateIMN7display21NativeDisplayDelegateEFblRKNSt3__16vectorIfNS5_9allocatorIfEEEEEJNS0_17UnretainedWrapperIS4_EElS9_EEEFbvEE7RunOnceEPNS0_13BindStateBaseE
#11 0x7f6f4c57ce4e _ZNO4base12OnceCallbackIFbvEE3RunEv
#12 0x7f6f4c574a06 display::(anonymous namespace)::RunColorCorrectionClosureSync()
#13 0x7f6f4c574847 display::DisplayConfigurator::SetColorMatrix()
#14 0x7f6f4a6bd53c ash::DisplayColorManager::ApplyDisplayColorCalibration()
#15 0x7f6f4a6bda4d ash::DisplayColorManager::ResetDisplayColorCalibration()
#16 0x7f6f4a6bd33f ash::DisplayColorManager::OnDisplayModeChanged()
#17 0x7f6f4c574e5c display::DisplayConfigurator::NotifyDisplayStateObservers()
#18 0x7f6f4c571d46 display::DisplayConfigurator::OnConfigured()
#19 0x7f6f4c57f625 _ZN4base8internal13FunctorTraitsIMN7display19DisplayConfiguratorEFvbRKNSt3__16vectorIPNS2_15DisplaySnapshotENS4_9allocatorIS7_EEEENS2_20MultipleDisplayStateEN8chromeos17DisplayPowerStateEEvE6InvokeISH_RKNS_7WeakPtrIS3_EEJbSC_SD_SF_EEEvT_OT0_DpOT1_
#20 0x7f6f4c57f537 _ZN4base8internal12InvokeHelperILb1EvE8MakeItSoIRKMN7display19DisplayConfiguratorEFvbRKNSt3__16vectorIPNS4_15DisplaySnapshotENS6_9allocatorIS9_EEEENS4_20MultipleDisplayStateEN8chromeos17DisplayPowerStateEERKNS_7WeakPtrIS5_EEJbSE_SF_SH_EEEvOT_OT0_DpOT1_
#21 0x7f6f4c57f473 _ZN4base8internal7InvokerINS0_9BindStateIMN7display19DisplayConfiguratorEFvbRKNSt3__16vectorIPNS3_15DisplaySnapshotENS5_9allocatorIS8_EEEENS3_20MultipleDisplayStateEN8chromeos17DisplayPowerStateEEJNS_7WeakPtrIS4_EEEEEFvbSD_SE_SG_EE7RunImplIRKSI_RKNS5_5tupleIJSK_EEEJLm0EEEEvOT_OT0_NS5_16integer_sequenceImJXspT1_EEEEObSD_OSE_OSG_
#22 0x7f6f4c57f37d _ZN4base8internal7InvokerINS0_9BindStateIMN7display19DisplayConfiguratorEFvbRKNSt3__16vectorIPNS3_15DisplaySnapshotENS5_9allocatorIS8_EEEENS3_20MultipleDisplayStateEN8chromeos17DisplayPowerStateEEJNS_7WeakPtrIS4_EEEEEFvbSD_SE_SG_EE3RunEPNS0_13BindStateBaseEbSD_SE_SG_
#23 0x7f6f4c5af6f0 _ZNKR4base17RepeatingCallbackIFvbRKNSt3__16vectorIPN7display15DisplaySnapshotENS1_9allocatorIS5_EEEENS3_20MultipleDisplayStateEN8chromeos17DisplayPowerStateEEE3RunEbSA_SB_SD_
#24 0x7f6f4c5af407 display::UpdateDisplayConfigurationTask::FinishConfiguration()
#25 0x7f6f4c5af3b8 display::UpdateDisplayConfigurationTask::OnStateEntered()
#26 0x7f6f4c5aff81 _ZN4base8internal13FunctorTraitsIMN7display30UpdateDisplayConfigurationTaskEFvNS2_21ConfigureDisplaysTask6StatusEEvE6InvokeIS7_RKNS_7WeakPtrIS3_EEJS5_EEEvT_OT0_DpOT1_
#27 0x7f6f4c5afee5 _ZN4base8internal12InvokeHelperILb1EvE8MakeItSoIRKMN7display30UpdateDisplayConfigurationTaskEFvNS4_21ConfigureDisplaysTask6StatusEERKNS_7WeakPtrIS5_EEJS7_EEEvOT_OT0_DpOT1_
#28 0x7f6f4c5afe60 _ZN4base8internal7InvokerINS0_9BindStateIMN7display30UpdateDisplayConfigurationTaskEFvNS3_21ConfigureDisplaysTask6StatusEEJNS_7WeakPtrIS4_EEEEEFvS6_EE7RunImplIRKS8_RKNSt3__15tupleIJSA_EEEJLm0EEEEvOT_OT0_NSH_16integer_sequenceImJXspT1_EEEEOS6_
#29 0x7f6f4c5afd9b _ZN4base8internal7InvokerINS0_9BindStateIMN7display30UpdateDisplayConfigurationTaskEFvNS3_21ConfigureDisplaysTask6StatusEEJNS_7WeakPtrIS4_EEEEEFvS6_EE3RunEPNS0_13BindStateBaseES6_
#30 0x7f6f4c564b8e _ZNKR4base17RepeatingCallbackIFvN7display21ConfigureDisplaysTask6StatusEEE3RunES3_
#31 0x7f6f4c564221 display::ConfigureDisplaysTask::Run()
#32 0x7f6f4c5645ad display::ConfigureDisplaysTask::OnConfigured()
#33 0x7f6f4c565daa _ZN4base8internal13FunctorTraitsIMN7display21ConfigureDisplaysTaskEFvmbEvE6InvokeIS5_RKNS_7WeakPtrIS3_EEJRKmbEEEvT_OT0_DpOT1_
#34 0x7f6f4c565cf5 _ZN4base8internal12InvokeHelperILb1EvE8MakeItSoIRKMN7display21ConfigureDisplaysTaskEFvmbERKNS_7WeakPtrIS5_EEJRKmbEEEvOT_OT0_DpOT1_
#35 0x7f6f4c565c5d _ZN4base8internal7InvokerINS0_9BindStateIMN7display21ConfigureDisplaysTaskEFvmbEJNS_7WeakPtrIS4_EEmEEEFvbEE7RunImplIRKS6_RKNSt3__15tupleIJS8_mEEEJLm0ELm1EEEEvOT_OT0_NSF_16integer_sequenceImJXspT1_EEEEOb
#36 0x7f6f4c565b60 _ZN4base8internal7InvokerINS0_9BindStateIMN7display21ConfigureDisplaysTaskEFvmbEJNS_7WeakPtrIS4_EEmEEEFvbEE3RunEPNS0_13BindStateBaseEb
#37 0x7f6f4c543fba _ZNO4base12OnceCallbackIFvbEE3RunEb
#38 0x7f6f4c5bd0b1 display::mojom::NativeDisplayDelegate_Configure_ForwardToCallback::Accept()
#39 0x7f6f5dc01fca mojo::InterfaceEndpointClient::HandleValidatedMessage()
#40 0x7f6f5dc00bf1 mojo::InterfaceEndpointClient::HandleIncomingMessageThunk::Accept()
#41 0x7f6f5dbff0a8 mojo::FilterChain::Accept()
#42 0x7f6f5dc04ac6 mojo::InterfaceEndpointClient::HandleIncomingMessage()
#43 0x7f6f5dc10ed2 mojo::internal::MultiplexRouter::ProcessIncomingMessage()
#44 0x7f6f5dc104f5 mojo::internal::MultiplexRouter::Accept()
#45 0x7f6f5dbff0a8 mojo::FilterChain::Accept()
#46 0x7f6f5dbf1e92 mojo::Connector::ReadSingleMessage()
#47 0x7f6f5dbf2c71 mojo::Connector::ReadAllAvailableMessages()
#48 0x7f6f5dbf2ac8 mojo::Connector::OnHandleReadyInternal()
#49 0x7f6f5dbf29cb mojo::Connector::OnWatcherHandleReady()
#50 0x7f6f5dbf616f _ZN4base8internal13FunctorTraitsIMN4mojo9ConnectorEFvjEvE6InvokeIS5_PS3_JjEEEvT_OT0_DpOT1_
#51 0x7f6f5dbf609f _ZN4base8internal12InvokeHelperILb0EvE8MakeItSoIRKMN4mojo9ConnectorEFvjEJPS5_jEEEvOT_DpOT0_
#52 0x7f6f5dbf6035 _ZN4base8internal7InvokerINS0_9BindStateIMN4mojo9ConnectorEFvjEJNS0_17UnretainedWrapperIS4_EEEEEFvjEE7RunImplIRKS6_RKNSt3__15tupleIJS8_EEEJLm0EEEEvOT_OT0_NSF_16integer_sequenceImJXspT1_EEEEOj
#53 0x7f6f5dbf5f6b _ZN4base8internal7InvokerINS0_9BindStateIMN4mojo9ConnectorEFvjEJNS0_17UnretainedWrapperIS4_EEEEEFvjEE3RunEPNS0_13BindStateBaseEj
#54 0x7f6f5dbedb9e _ZNKR4base17RepeatingCallbackIFvjEE3RunEj
#55 0x7f6f5dbf52ef mojo::SimpleWatcher::DiscardReadyState()
#56 0x7f6f5dbf556f _ZN4base8internal13FunctorTraitsIPFvRKNS_17RepeatingCallbackIFvjEEEjRKN4mojo18HandleSignalsStateEEvE6InvokeIRKSC_JS6_jSA_EEEvOT_DpOT0_
#57 0x7f6f5dbf550d _ZN4base8internal12InvokeHelperILb0EvE8MakeItSoIRKPFvRKNS_17RepeatingCallbackIFvjEEEjRKN4mojo18HandleSignalsStateEEJS8_jSC_EEEvOT_DpOT0_
#58 0x7f6f5dbf54b0 _ZN4base8internal7InvokerINS0_9BindStateIPFvRKNS_17RepeatingCallbackIFvjEEEjRKN4mojo18HandleSignalsStateEEJS5_EEEFvjSB_EE7RunImplIRKSD_RKNSt3__15tupleIJS5_EEEJLm0EEEEvOT_OT0_NSK_16integer_sequenceImJXspT1_EEEEOjSB_
#59 0x7f6f5dbf53e6 _ZN4base8internal7InvokerINS0_9BindStateIPFvRKNS_17RepeatingCallbackIFvjEEEjRKN4mojo18HandleSignalsStateEEJS5_EEEFvjSB_EE3RunEPNS0_13BindStateBaseEjSB_
#60 0x7f6f5db8ef9e _ZNKR4base17RepeatingCallbackIFvjRKN4mojo18HandleSignalsStateEEE3RunEjS4_
#61 0x7f6f5db8e90b mojo::SimpleWatcher::OnHandleReady()
This CL by dcastgna can fix it: https://chromium-review.googlesource.com/c/chromium/src/+/1045867

Daniele, are you going to go ahead with that CL?
Project Member

Comment 9 by bugdroid1@chromium.org, Jun 4 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/626fc8068e894ea148b370e517cce8afb5cecf2c

commit 626fc8068e894ea148b370e517cce8afb5cecf2c
Author: Daniele Castagna <dcastagna@chromium.org>
Date: Mon Jun 04 19:07:35 2018

ash: Initialize color matrix to identity

DisplayColorManager::ResetDisplayColorCalibration is supposed to
reset the display color calibration. It creates a default initialized
ColorCalibrationData with an empty correction_matrix, that will
get ignored.


This CL initialize ColorCalibrationData::correction_matrix to the
identity matrix.

Bug:  848444 , 839672
Change-Id: Ic922d0a357b411692364badffd61b45530b4a4c8
Reviewed-on: https://chromium-review.googlesource.com/1045867
Commit-Queue: Daniele Castagna <dcastagna@chromium.org>
Reviewed-by: Ahmed Fakhry <afakhry@chromium.org>
Cr-Commit-Position: refs/heads/master@{#564175}
[modify] https://crrev.com/626fc8068e894ea148b370e517cce8afb5cecf2c/ash/display/display_color_manager.cc
[modify] https://crrev.com/626fc8068e894ea148b370e517cce8afb5cecf2c/ash/display/display_color_manager.h
[modify] https://crrev.com/626fc8068e894ea148b370e517cce8afb5cecf2c/ash/display/display_color_manager_unittest.cc

Cc: -dcasta...@chromium.org afakhry@chromium.org
Owner: dcasta...@chromium.org
Status: Fixed (was: Assigned)
Daniele fixed this.

Sign in to add a comment