New issue
Advanced search Search tips

Issue 905665 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Nov 26
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Android
Pri: 2
Type: Bug



Sign in to add a comment

Renderer crash in cc::PaintOpWriter::WriteSimple<float> when showing page using web speech

Project Member Reported by ol...@opera.com, Nov 15

Issue description

Chrome Version: master
OS: android

What steps will reproduce the problem?

Build debug version of chrome for android and load any page that uses web speech api:
(1) gn gen --args='target_os="android" android_full_debug=true' out/Default
(2) ninja -C out/Default chrome_public_apk
(3) out/Default/bin/chrome_public_apk run https://www.google.com/intl/en/chrome/demos/speech.html

What is the expected result?

What happens instead?

Fatal signal 7 (SIGBUS), code 1, fault addr 0x78aaf40a in tid 20345 (CompositorTileW)

Does not crash in release builds, but full debug crashes always on all devices I tested on.

 
I get the following output from gdb when attached to the renderer process:

Thread 12 "CompositorTileW" received signal SIGBUS, Bus error.
[Switching to Thread 20948.21083]
0x8da336e2 in cc::PaintOpWriter::WriteSimple<float> (this=0x6c67ca90, val=@0x6c43bed0: 0) at ../../cc/paint/paint_op_writer.cc:99
99	  reinterpret_cast<T*>(memory_)[0] = val;

backtrace:
#0  0x8da336e2 in cc::PaintOpWriter::WriteSimple<float> (this=0x6c67ca90, val=@0x6c43bed0: 0) at ../../cc/paint/paint_op_writer.cc:99
#1  0x8da33e2a in cc::PaintOpWriter::Write (this=0x6c67ca90, shader=0x6c43bec0, quality=kNone_SkFilterQuality) at ../../cc/paint/paint_op_writer.cc:394
#2  0x8da33b36 in cc::PaintOpWriter::Write (this=0x6c67ca90, flags=...) at ../../cc/paint/paint_op_writer.cc:207
#3  0x8da1fa1a in cc::DrawRRectOp::Serialize (base_op=0x9cf79ea8, memory=0x78aaf260, size=64928, options=...) at ../../cc/paint/paint_op_buffer.cc:584
#4  0x8da25790 in cc::PaintOp::Serialize (this=0x9cf79ea8, memory=0x78aaf260, size=64928, options=...) at ../../cc/paint/paint_op_buffer.cc:1894
#5  0x87581ae4 in gpu::raster::RasterImplementation::PaintOpSerializer::Serialize (this=0x6c67eb0c, op=0x9cf79ea8, options=...) at ../../gpu/command_buffer/client/raster_implementation.cc:204
...
followed by a lot of more frames
Components: Internals>Compositing
Components: -Internals>Compositing Internals>Compositing>Rasterization
Owner: enne@chromium.org
Status: Assigned (was: Untriaged)
enne@, can you take a look or triage this PaintOpWriter issue?
Cc: khushals...@chromium.org
Components: -Internals>Compositing>Rasterization Internals>Compositing>OOP-Raster
Labels: -Pri-3 Pri-2
Looks like this is due to misaligned writes of floats.  The crash comes from the write of WriteSimple(end_radius) in Write(PaintShader*).  It's misaligned by 2 bytes.

The odd thing is that this only appears to happen with floats.  There's a misaligned uint32_t WriteSimple on the line right before it.  Interestingly, if I reinterpret_cast all WriteSimple/ReadSimple float types to be uint32_t, then it no longer crashes.  I can also pad out all WriteSimple sizes to write with an alignment of 4, and that also avoids the problem.

We could also AlignMemory(alignof(T)) in all WriteSimple calls as we used to do, but that got reverted for perf reasons a long time ago.
Project Member

Comment 6 by bugdroid1@chromium.org, Nov 21

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/281dd3dc34064e42b9683dbdf6353f0d7cb82eec

commit 281dd3dc34064e42b9683dbdf6353f0d7cb82eec
Author: Adrienne Walker <enne@chromium.org>
Date: Wed Nov 21 09:37:01 2018

cc: Fix some alignment issues in PaintOpWriter

Debug builds of Android were crashing because of misaligned read/writes
of float variables in PaintOpWriter::WriteSimple and the accompanying
reader.

Fix this by rounding up all WriteSimples to align the size they write
to 4 bytes.  This is just a spot fix, but fixes most of the alignment
issues on a few checked pages.  If we wanted to move to DCHECKing
the alignment, this would probably need more work.

This continues to avoid calling AlignMemory in Write/ReadSimple, as that
appears to cause about 30% slowdown in serializing/deserializing speed
in the cc_perftests --gtest_filter=PaintOp* tests.

Bug:  905665 
Change-Id: Ib6db27d7cafe22b40b96f841dc2df54c1b6a4f1c
Reviewed-on: https://chromium-review.googlesource.com/c/1343565
Commit-Queue: enne <enne@chromium.org>
Reviewed-by: Khushal <khushalsagar@chromium.org>
Cr-Commit-Position: refs/heads/master@{#609968}
[modify] https://crrev.com/281dd3dc34064e42b9683dbdf6353f0d7cb82eec/cc/paint/paint_op_reader.cc
[modify] https://crrev.com/281dd3dc34064e42b9683dbdf6353f0d7cb82eec/cc/paint/paint_op_writer.cc

I can just confirm the reported case doesn't crash for me after the patch. Thanks!
Status: Fixed (was: Assigned)

Sign in to add a comment