Skip to content

[fml] Status keeps its own copy of the message - #194161

Draft
dzolotov wants to merge 1 commit into
flutter:masterfrom
pleiondev:gpu-fix/fml-status-owns-message
Draft

dzolotov wants to merge 1 commit into
flutter:masterfrom
pleiondev:gpu-fix/fml-status-owns-message

Conversation

@dzolotov

Copy link
Copy Markdown
Contributor

fml::Status stores its message as a std::string_view, and its constructor takes one, so passing a std::string compiles without a word and the status points into that string's buffer. CommandQueueVK::Submit does exactly that after a failed Vulkan submit: it builds the status from a local submit_error string inside the fence callback and returns it after the string is gone, so anyone who reads message() reads freed memory. Every other caller passes a literal, which is why it hasn't shown up.

Status::message_ is now a std::string. The constructor still takes a std::string_view and message() still returns one, so no caller changes, and the doc comment says how long that view stays valid. OK statuses have an empty message and don't allocate. I'd rather fix the type than the one caller, because the next caller that formats a message would fall into the same trap.

Where it was verified. macOS arm64, host_debug_unopt_arm64, rebased on current main. The new fml/status_unittests.cc covers a literal message, a runtime message changed or destroyed after the status is built, and a copied status. Without the change two of those fail every time (message() returns secon for second), and the one that reads freed memory fails reliably only under ASan; with it fml_unittests --gtest_filter='StatusTest.*' is 5/5 and the whole of fml_unittests 208/208. Because status.h is included widely I also built impeller_unittests, gpu_unittests, flow_unittests and flutter_tester, and ran the flow_unittests frame timing tests that check status messages (15/15); CI covers the rest of the tree.

Fixes #194151

Pre-launch Checklist

fml::Status stored the message as a std::string_view, so a status built
from a runtime string pointed into that string's buffer. CommandQueueVK
returns such a status from a lambda whose local string is gone by the
time the caller reads message(). The message is now a std::string;
message() still returns a std::string_view, so callers do not change.
@gaaclarke

Copy link
Copy Markdown
Member

Let's replace usages of fml::Status with absl::Status instead.

@gaaclarke gaaclarke closed this Oct 12, 2026
@gaaclarke gaaclarke reopened this Oct 12, 2026
@fluttergithubbot

Copy link
Copy Markdown
Contributor

An existing Git SHA, 6591a9662c592a18aeb134173789d95e7db274b3, was detected, and no actions were taken.

To re-trigger presubmits after closing or re-opeing a PR, or pushing a HEAD commit (i.e. with --force) that already was pushed before, push a blank commit (git commit --allow-empty -m "Trigger Build") or rebase to continue.

@gaaclarke gaaclarke left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oops meant to "request changes", not close the issue. we want absl::Status

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

engine flutter/engine related. See also e: labels.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[fml] fml::Status keeps a std::string_view, so a status built from a runtime string dangles

3 participants