Renderer crash in cc::PaintOpWriter::WriteSimple<float> when showing page using web speech |
|||||
Issue descriptionChrome Version: master OS: android What steps will reproduce the problem? Build debug version of chrome for android and load any page that uses web speech api: (1) gn gen --args='target_os="android" android_full_debug=true' out/Default (2) ninja -C out/Default chrome_public_apk (3) out/Default/bin/chrome_public_apk run https://www.google.com/intl/en/chrome/demos/speech.html What is the expected result? What happens instead? Fatal signal 7 (SIGBUS), code 1, fault addr 0x78aaf40a in tid 20345 (CompositorTileW) Does not crash in release builds, but full debug crashes always on all devices I tested on.
,
Nov 16
,
Nov 16
enne@, can you take a look or triage this PaintOpWriter issue?
,
Nov 16
,
Nov 19
Looks like this is due to misaligned writes of floats. The crash comes from the write of WriteSimple(end_radius) in Write(PaintShader*). It's misaligned by 2 bytes. The odd thing is that this only appears to happen with floats. There's a misaligned uint32_t WriteSimple on the line right before it. Interestingly, if I reinterpret_cast all WriteSimple/ReadSimple float types to be uint32_t, then it no longer crashes. I can also pad out all WriteSimple sizes to write with an alignment of 4, and that also avoids the problem. We could also AlignMemory(alignof(T)) in all WriteSimple calls as we used to do, but that got reverted for perf reasons a long time ago.
,
Nov 21
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/281dd3dc34064e42b9683dbdf6353f0d7cb82eec commit 281dd3dc34064e42b9683dbdf6353f0d7cb82eec Author: Adrienne Walker <enne@chromium.org> Date: Wed Nov 21 09:37:01 2018 cc: Fix some alignment issues in PaintOpWriter Debug builds of Android were crashing because of misaligned read/writes of float variables in PaintOpWriter::WriteSimple and the accompanying reader. Fix this by rounding up all WriteSimples to align the size they write to 4 bytes. This is just a spot fix, but fixes most of the alignment issues on a few checked pages. If we wanted to move to DCHECKing the alignment, this would probably need more work. This continues to avoid calling AlignMemory in Write/ReadSimple, as that appears to cause about 30% slowdown in serializing/deserializing speed in the cc_perftests --gtest_filter=PaintOp* tests. Bug: 905665 Change-Id: Ib6db27d7cafe22b40b96f841dc2df54c1b6a4f1c Reviewed-on: https://chromium-review.googlesource.com/c/1343565 Commit-Queue: enne <enne@chromium.org> Reviewed-by: Khushal <khushalsagar@chromium.org> Cr-Commit-Position: refs/heads/master@{#609968} [modify] https://crrev.com/281dd3dc34064e42b9683dbdf6353f0d7cb82eec/cc/paint/paint_op_reader.cc [modify] https://crrev.com/281dd3dc34064e42b9683dbdf6353f0d7cb82eec/cc/paint/paint_op_writer.cc
,
Nov 21
I can just confirm the reported case doesn't crash for me after the patch. Thanks!
,
Nov 26
|
|||||
►
Sign in to add a comment |
|||||
Comment 1 by ol...@opera.com
, Nov 15