Skip to content

Passing an implemented dart:ui NativeFieldClassWrapper2 type to the engine segfaults #64598

Closed
Closed
Passing an implemented dart:ui NativeFieldClassWrapper2 type to the engine segfaults#64598
Labels
P2Important issues not at the top of the work lista: tests"flutter test", flutter_test, or one of our testsc: crashStack traces logged to the consoledependency: dartDart team may need to help usengineflutter/engine related. See also e: labels.found in release: 1.22Found to occur in 1.22has reproducible stepsThe issue has been confirmed reproducible and is ready to work on

Description

@dnfield
dnfield
opened on Aug 25, 2020

There are a lot of ways this could happen, but consider the following test:

import 'dart:typed_data';
import 'dart:ui';

import 'package:flutter_test/flutter_test.dart';

void main() {
  test('another', () async {
    const TestImage image = TestImage();
    final PictureRecorder recorder = PictureRecorder();
    final Canvas canvas = Canvas(recorder);
    canvas.drawImage(image, Offset.zero, Paint());
    final Picture picture = recorder.endRecording();
  });
}

class TestImage implements Image {
  const TestImage([this.width = 10, this.height = 10]);

  @override
  final int height;

  @override
  final int width;

  @override
  Future<ByteData> toByteData({ImageByteFormat format = ImageByteFormat.rawRgba}) {
    throw UnimplementedError();
  }

  @override
  void dispose() {}
}

I don't think we should support this, but we shouldn't segfault either.

Activity

  1. dnfield
    added
    a: tests"flutter test", flutter_test, or one of our tests
    engineflutter/engine related. See also e: labels.
    on Aug 25, 2020

  2. dnfield commented on Aug 25, 2020

    @dnfield
    dnfield
    on Aug 25, 2020
    ContributorAuthor

    A backtrace of the fault:

    0  0x000000000364947e in dart::Api::GetNativeFieldsOfArgument (arguments=0x7fffffff9d70, arg_index=1, num_fields=2, field_values=0x7fffffff9ac0) at ../../third_party/dart/runtime/vm/dart_api_impl.cc:663
#1  dart::GetNativeFieldsOfArgument (arguments=0x7fffffff9d70, arg_index=1, num_fields=2, field_values=0x7fffffff9ac0, current_func=0x237b82 "Dart_GetNativeFieldsOfArgument") at ../../third_party/dart/runtime/vm/dart_api_impl.cc:255
#2  0x0000000001ddc4b8 in tonic::DartConverterWrappable::FromArguments (args=0x7fffffff9d70, index=1, exception=@0x7fffffff9b48: 0x0) at ../../flutter/third_party/tonic/dart_wrappable.cc:103
#3  0x0000000002fd2cd9 in tonic::DartConverter<flutter::CanvasImage const*, void>::FromArguments (args=0x7fffffff9d70, index=1, exception=@0x7fffffff9b48: 0x0, auto_scope=true) at ../../flutter/third_party/tonic/dart_wrappable.h:135
#4  0x0000000002fd2c75 in tonic::DartArgIterator::GetNext<flutter::CanvasImage const*> (this=0x7fffffff9be8) at ../../flutter/third_party/tonic/dart_args.h:27
#5  0x0000000002fd2c11 in tonic::DartArgHolder<0ul, flutter::CanvasImage const*>::DartArgHolder (this=0x7fffffff9c20, it=0x7fffffff9be8) at ../../flutter/third_party/tonic/dart_args.h:93
#6  0x0000000002fd2e17 in tonic::DartDispatcher<tonic::IndicesHolder<0ul, 1ul, 2ul, 3ul, 4ul, 5ul, 6ul, 7ul, 8ul, 9ul, 10ul>, void (flutter::Canvas::*)(flutter::CanvasImage const*, double, double, double, double, double, double, double, double, flutter::Paint const&, flutter::PaintData const&)>::DartDispatcher (
    this=0x7fffffff9c20, it=0x7fffffff9be8) at ../../flutter/third_party/tonic/dart_args.h:148
#7  0x0000000002fd2d54 in tonic::DartCall<void (flutter::Canvas::*)(flutter::CanvasImage const*, double, double, double, double, double, double, double, double, flutter::Paint const&, flutter::PaintData const&)> (func=
    (void (flutter::Canvas::*)(flutter::Canvas * const, const flutter::CanvasImage *, double, double, double, double, double, double, double, double, const flutter::Paint &, const flutter::PaintData &)) 0x2fcef30 <flutter::Canvas::drawImageRect(flutter::CanvasImage const*, double, double, double, double, double, double, double, double, flutter::Paint const&, flutter::PaintData const&)>, args=0x7fffffff9d70) at ../../flutter/third_party/tonic/dart_args.h:201
#8  0x0000000002fcdf95 in flutter::Canvas_drawImageRect (args=0x7fffffff9d70) at ../../flutter/lib/ui/painting/canvas.cc:68
#9  0x00000000032fb778 in dart::NativeEntry::AutoScopeNativeCallWrapperNoStackCheck (args=0x7fffffff9d70, func=0x2fcdf60 <flutter::Canvas_drawImageRect(_Dart_NativeArguments*)>) at ../../third_party/dart/runtime/vm/native_entry.cc:217
#10 0x00007fffead016b4 in ?? ()
#11 0x000000000384de00 in ?? ()
#12 0x000000000100000c in dart::observatory::observatory_assets_archive_ ()
#13 0x00007fffffff9e18 in ?? ()
#14 0x00007fffffff9db8 in ?? ()

    @rmacnak-google - is this something that the Dart VM could handle more gracefully? Return an error if the instance field isn't valid, rather than segfaulting?

    /cc @jason-simmons

  3. dnfield commented on Aug 25, 2020

    @dnfield
    dnfield
    on Aug 25, 2020
    ContributorAuthor

    (the backtrace is from a similar but slightly different test)

  4. dnfield commented on Aug 25, 2020

    @dnfield
    dnfield
    on Aug 25, 2020
    ContributorAuthor

    /cc @PixelToast who helped provide the backtrace.

  5. dnfield
    added
    dependency: dartDart team may need to help us
    P2Important issues not at the top of the work list
    c: crashStack traces logged to the console
    on Aug 25, 2020
  6. dart-bot
    added a commit that references this issue on Aug 26, 2020

    [vm] Fix Dart_GetNativeFieldsOfArgument when passed an object with no…

    ae37f48

  7. TahaTesser commented on Aug 27, 2020

    @TahaTesser
    TahaTesser
    on Aug 27, 2020
    Contributor
    logs 
    Shell subprocess crashed with segmentation fault after tests finished.
Test: /Users/tahatesser/AndroidStudioProjects/master_flutter/test/widget_test.dart
Shell: /Users/tahatesser/Code/flutter_master/bin/cache/artifacts/engine/darwin-x64/flutter_tester
dart:async/stream_controller.dart 634:44                       _StreamController.addError
dart:async/stream_controller.dart 904:13                       _StreamSinkWrapper.addError
package:stream_channel/src/guarantee_channel.dart 145:14       _GuaranteeSink._addError
package:stream_channel/src/guarantee_channel.dart 136:5        _GuaranteeSink.addError
package:flutter_tools/src/test/flutter_platform.dart 480:29    FlutterPlatform._startTest.<fn>
===== asynchronous gap ===========================
dart:async/zone.dart 1121:19                                   _CustomZone.registerUnaryCallback
dart:async-patch/async_patch.dart 83:23                        _asyncThenWrapperHelper
package:flutter_tools/src/test/flutter_platform.dart           FlutterPlatform._startTest.<fn>
package:flutter_tools/src/test/flutter_platform.dart 658:26    FlutterPlatform._startTest
===== asynchronous gap ===========================
dart:async/zone.dart 1121:19                                   _CustomZone.registerUnaryCallback
dart:async-patch/async_patch.dart 83:23                        _asyncThenWrapperHelper
package:flutter_tools/src/test/flutter_platform.dart 349:36    FlutterPlatform.loadChannel
package:flutter_tools/src/test/flutter_platform.dart 302:46    FlutterPlatform.load
package:test_core/src/runner/loader.dart 228:38                Loader.loadFile.<fn>
===== asynchronous gap ===========================
dart:async/zone.dart 1121:19                                   _CustomZone.registerUnaryCallback
dart:async-patch/async_patch.dart 83:23                        _asyncThenWrapperHelper
package:test_core/src/runner/loader.dart                       Loader.loadFile.<fn>
package:test_core/src/runner/load_suite.dart 98:31             new LoadSuite.<fn>.<fn>
package:test_core/src/runner/load_suite.dart 108:8             new LoadSuite.<fn>
package:test_api/src/backend/invoker.dart 231:15               Invoker.waitForOutstandingCallbacks.<fn>
dart:async/zone.dart 1190:13                                   _rootRun
dart:async/zone.dart 1093:19                                   _CustomZone.run
dart:async/zone.dart 1630:10                                   _runZoned
dart:async/zone.dart 1550:10                                   runZoned
package:test_api/src/backend/invoker.dart 228:5                Invoker.waitForOutstandingCallbacks
package:test_api/src/backend/invoker.dart 383:17               Invoker._onRun.<fn>.<fn>.<fn>
===== asynchronous gap ===========================
dart:async/zone.dart 1121:19                                   _CustomZone.registerUnaryCallback
dart:async-patch/async_patch.dart 83:23                        _asyncThenWrapperHelper
package:test_api/src/backend/invoker.dart                      Invoker._onRun.<fn>.<fn>.<fn>
dart:async/zone.dart 1190:13                                   _rootRun
dart:async/zone.dart 1093:19                                   _CustomZone.run
dart:async/zone.dart 1630:10                                   _runZoned
dart:async/zone.dart 1550:10                                   runZoned
package:test_api/src/backend/invoker.dart 370:9                Invoker._onRun.<fn>.<fn>
dart:async/zone.dart 1190:13                                   _rootRun
dart:async/zone.dart 1093:19                                   _CustomZone.run
dart:async/zone.dart 1630:10                                   _runZoned
dart:async/zone.dart 1550:10                                   runZoned
package:test_api/src/backend/invoker.dart 150:7                Invoker.guard
package:test_api/src/backend/invoker.dart 413:15               Invoker._guardIfGuarded
package:test_api/src/backend/invoker.dart 369:7                Invoker._onRun.<fn>
package:stack_trace/src/chain.dart 104:24                      Chain.capture.<fn>
dart:async/zone.dart 1190:13                                   _rootRun
dart:async/zone.dart 1093:19                                   _CustomZone.run
dart:async/zone.dart 1630:10                                   _runZoned
dart:async/zone.dart 1550:10                                   runZoned
package:stack_trace/src/chain.dart 102:12                      Chain.capture
package:test_api/src/backend/invoker.dart 368:11               Invoker._onRun
package:test_api/src/backend/live_test_controller.dart 153:11  LiveTestController.run
dart:async/future.dart 201:37                                  new Future.microtask.<fn>
dart:async/zone.dart 1182:47                                   _rootRun
dart:async/zone.dart 1093:19                                   _CustomZone.run
dart:async/zone.dart 997:7                                     _CustomZone.runGuarded
dart:async/zone.dart 1037:23                                   _CustomZone.bindCallbackGuarded.<fn>
dart:async/zone.dart 1190:13                                   _rootRun
dart:async/zone.dart 1093:19                                   _CustomZone.run
dart:async/zone.dart 997:7                                     _CustomZone.runGuarded
dart:async/zone.dart 1037:23                                   _CustomZone.bindCallbackGuarded.<fn>
dart:async/schedule_microtask.dart 41:21                       _microtaskLoop
dart:async/schedule_microtask.dart 50:5                        _startMicrotaskLoop
dart:isolate-patch/isolate_patch.dart 118:13                   _runPendingImmediateCallback
dart:isolate-patch/isolate_patch.dart 169:5                    _RawReceivePortImpl._handleMessage
✓ another
Exited (1)
    flutter doctor -v 
    [✓] Flutter (Channel master, 1.22.0-2.0.pre.93, on Mac OS X 10.15.6 19G2021,
    locale en-GB)
    • Flutter version 1.22.0-2.0.pre.93 at /Users/tahatesser/Code/flutter_master
    • Framework revision f35a8b7470 (5 hours ago), 2020-08-26 21:33:03 -0700
    • Engine revision 388193a67b
    • Dart version 2.10.0 (build 2.10.0-62.0.dev)

 
[✓] Android toolchain - develop for Android devices (Android SDK version 30.0.1)
    • Android SDK at /Users/tahatesser/Code/sdk
    • Platform android-30, build-tools 30.0.1
    • ANDROID_HOME = /Users/tahatesser/Code/sdk
    • Java binary at: /Applications/Android
      Studio.app/Contents/jre/jdk/Contents/Home/bin/java
    • Java version OpenJDK Runtime Environment (build
      1.8.0_242-release-1644-b3-6222593)
    • All Android licenses accepted.

[✓] Xcode - develop for iOS and macOS (Xcode 11.6)
    • Xcode at /Applications/Xcode.app/Contents/Developer
    • Xcode 11.6, Build version 11E708
    • CocoaPods version 1.9.3

[✓] Chrome - develop for the web
    • Chrome at /Applications/Google Chrome.app/Contents/MacOS/Google Chrome

[✓] Android Studio (version 4.0)
    • Android Studio at /Applications/Android Studio.app/Contents
    • Flutter plugin version 48.1.2
    • Dart plugin version 193.7547
    • Java version OpenJDK Runtime Environment (build
      1.8.0_242-release-1644-b3-6222593)

[✓] VS Code (version 1.48.2)
    • VS Code at /Applications/Visual Studio Code.app/Contents
    • Flutter extension version 3.13.2

[✓] Connected device (4 available)
    • iPhone 11 (mobile) • A63D6F51-59F3-4A75-961F-3769709F3A92 • ios
      • com.apple.CoreSimulator.SimRuntime.iOS-13-6 (simulator)
    • macOS (desktop)    • macos                                • darwin-x64
      • Mac OS X 10.15.6 19G2021
    • Web Server (web)   • web-server                           • web-javascript
      • Flutter Tools
    • Chrome (web)       • chrome                               • web-javascript
      • Google Chrome 84.0.4147.135

• No issues found!
  8. TahaTesser
    added
    found in release: 1.22Found to occur in 1.22
    has reproducible stepsThe issue has been confirmed reproducible and is ready to work on
    on Aug 27, 2020

  9. dnfield commented on Aug 27, 2020

    @dnfield
    dnfield
    on Aug 27, 2020
    ContributorAuthor

    Thanks for the quick fix @a-siva - this rolled into the framework in #64722 (via flutter-team-archive/engine#20804).

  10. dnfield
    closed this as completedon Aug 27, 2020

  11. dnfield commented on Aug 27, 2020

    @dnfield
    dnfield
    on Aug 27, 2020
    ContributorAuthor

    Output now is:

    00:10 +0 -1: another [E]                                                                                                                                                            
  Invalid argument.
  dart:ui                 Canvas.drawImage
  widget_test.dart 11:12  main.<fn>
  
00:10 +0 -1: Some tests failed.

    Which seems pretty acceptable to me.

  12. pingbird commented on Aug 27, 2020

    @pingbird
    pingbird
    on Aug 27, 2020
    Member

    The commit was actually https://dart-review.googlesource.com/c/sdk/+/160185
    Thanks @rmacnak-google !

  13. dnfield commented on Aug 27, 2020

    @dnfield
    dnfield
    on Aug 27, 2020
    ContributorAuthor

    Ahh, haha a-siva was the reviewer :)

  14. github-actions commented on Aug 13, 2021

    @github-actions
    github-actionsbot
    on Aug 13, 2021

    This thread has been automatically locked since there has not been any recent activity after it was closed. If you are still experiencing a similar issue, please open a new bug, including the output of flutter doctor -v and a minimal reproduction of the issue.

  15. github-actions
    locked as resolved and limited conversation to collaborators on Aug 13, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    P2Important issues not at the top of the work lista: tests"flutter test", flutter_test, or one of our testsc: crashStack traces logged to the consoledependency: dartDart team may need to help usengineflutter/engine related. See also e: labels.found in release: 1.22Found to occur in 1.22has reproducible stepsThe issue has been confirmed reproducible and is ready to work on

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions