-
Notifications
You must be signed in to change notification settings - Fork 26.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Canvas.drawVertices() with valid input crashes OpenGL ES driver on Google Pixel 6 Pro #115919
Comments
@flutter-symbolizer-bot #115919 (comment) android release arm64 |
@jonahwilliams apologies, this was a debug build, so the bot can't symbolicate. I've added symbolicated info in the Logs section? |
I am not sure if this is due to alignment or OOB access. Either way, I'll try to reproduce and bring it to the attention of the Skia folks. |
Reproduced in my own app on OnePlus 6, Android 11, Adreno gpu, with different list sizes and method call counts. It seems the issue is device independent and
|
Reproduced this on a Pixel 6a. This started with google/skia@8a85ab0 A segfault is happening in the device's implementation of Looked into this and noticed what appears to be an off-by-one between the size of the bound vertex buffer and the I can get this app to render without crashing by replacing |
Landed a fix in Skia: https://skia-review.googlesource.com/c/skia/+/631396 |
Fantastic! Is there an ETA when this will land in Flutter?
…On Thu, Jan 19, 2023, 00:08 Jason Simmons ***@***.***> wrote:
Landed a fix in Skia: https://skia-review.googlesource.com/c/skia/+/631396
—
Reply to this email directly, view it on GitHub
<#115919 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAD5QBDFMI6WFPEXBOXWPATWTBZVTANCNFSM6AAAAAASI53WEQ>
.
You are receiving this because you authored the thread.Message ID:
***@***.***>
|
The Skia patch landed and was rolled into the engine in flutter/engine#39024. |
@chinmaygarde sorry for one more question: this hasn't made it into Flutter 3.7.0, has it? Unless I made an error in my testing, the issue still persists with 3.7.0. edit: verified my test setup. The issue is present in 3.7.0 as well as latest from the beta channel. It is fixed in the master channel. |
This thread has been automatically locked since there has not been any recent activity after it was closed. If you are still experiencing a similar issue, please open a new bug, including the output of |
Steps to Reproduce
Expected results:
The repro app should display 12 instances of a simple textured triangle mesh. Desktop output:
Actual results:
The app crashes on a Google Pixel 6 Pro with the follwing stack trace:
I did some digging based on the symbolicated stack trace (see below) and have a theory what's going on.
The repro app constructs a single
Vertices
instance from a bunch of typed arrays with native backing. I've traced the construction of the instance through native code.Vertices.raw()
calls intoVertices::init()
in vertices.cc, which builds aDlVertices
instances via theDlVertices::Builder
class. All the atttribute arrays like positions, uvs, etc. are actually deep copied, so it's unlikely to be GC issues.The native side vertices are eventually handed to the OpenGL ES driver through
gles2_draw_draw_range_elements()
, which crashes inmemcpy()
.I assume the Flutter engine is batching
Vertices
instances that have the samePaint
and vertex attributes.memcpy()
on AARCH64 is notorious for being really picky about memory alignement. My guess is that somewhere in the batching process, the alignement goes bad, the batched vertices/indices are passed to the OpenGL ES driver throughgles2_draw_draw_range_elements()
andmemcpy()
says "no can do".This is somewhat supported by the fact, that the crash does not happen if the dart side
Vertices
are rendered less than 12 times. On the other hand, the same alignement would likely happen on my other Android devices, so either theirmemcpy()
version is more lenient, or my theory is wrong :)Code sample
A minimal reproduction sample can be found here: https://github.com/badlogic/flutter-mali-crashThe sample loads mesh data from a text file and converts it to a
Vertices
instance. It also loads an image and constructs anImageShader
basedPaint
from it. It then proceeds to render the vertices instance 12 times at random locations on the screen viaCanvas.drawVertices()
.The app uses Flame to minimize the LOC count. Flame itself does not interfere with the rendering in any meaningful way other than setting a transform on the
Canvas
instance used for rendering.Logs
Relevant portion from
flutter run --verbose -d <google-pixel-6-pro-device-id>
Symbolicated stack entries for
libflutter.so
:Output of
flutter doctor -v
The text was updated successfully, but these errors were encountered: