[Impeller] Do not capture the temporary ImpellerMapping struct pointer when storing release callbacks in libImpeller #56411
Conversation
…r when storing release callbacks in libImpeller Fixes flutter/flutter#158285
|
It looks like this pull request may not have tests. Please make sure to add tests before merging. If you need an exemption, contact "@test-exemption-reviewer" in the #hackers channel in Discord (don't just cc them here, they won't see it!). If you are not sure if you need tests, consider this rule of thumb: the purpose of a test is to make sure someone doesn't accidentally revert the fix. Ask yourself, is there anything in your PR that you feel it is important we not accidentally revert back to how it was before your fix? Reviewers: Read the Tree Hygiene page and make sure this patch meets those guidelines before LGTMing. The test exemption team is a small volunteer group, so all reviewers should feel empowered to ask for tests, without delegating that responsibility entirely to the test exemption group. |
|
Since this wasn't failing in CI, do we have a way to ensure that this doesn't break again for local testing? |
chinmaygarde
left a comment
chinmaygarde
left a comment
There was a problem hiding this comment.
How did you catch this? The asan builds?
Running the tests locally before pushing a change. |
|
This is a use-after-free where libImpeller's usage of the freed pointer works most of the time. I don't know of a way to make the crash happen on demand. |
jason-simmons
added
the
autosubmit
…uct pointer when storing release callbacks in libImpeller (flutter/engine#56411)
…uct pointer when storing release callbacks in libImpeller (flutter/engine#56411)
…158295) flutter/engine@58ac1da...b36ca33 2024-11-06 [email protected] [skwasm] Fix empty backdrop drawing. (flutter/engine#56385) 2024-11-06 [email protected] [Impeller] generate stroke vertices into point arena. (flutter/engine#56390) 2024-11-06 [email protected] [Impeller] Do not capture the temporary ImpellerMapping struct pointer when storing release callbacks in libImpeller (flutter/engine#56411) 2024-11-06 6844906[email protected] Roll ICU from 9408c6fd4a39 to 4239b1559d11 (2 revisions) (flutter/engine#56407) 2024-11-06 [email protected] iOS,macOS: Add Obj-C cflags to all Obj-C targets (flutter/engine#56386) 2024-11-06 [email protected] Roll Skia from afaed8923682 to cf33c4e96e81 (5 revisions) (flutter/engine#56408) 2024-11-06 [email protected] Manual roll Dart SDK from 1c1d0420539f to d456f613465a (6 revisions) (flutter/engine#56406) 2024-11-06 [email protected] [Impeller] Avoid errors due to triangle fans usage on Molten. (flutter/engine#56321) 2024-11-06 [email protected] Roll Skia from b4df8dda7ffc to afaed8923682 (14 revisions) (flutter/engine#56404) If this roll has caused a breakage, revert this CL and stop the roller using the controls here: https://autoroll.skia.org/r/flutter-engine-flutter-autoroll Please CC [email protected],[email protected] on the revert to ensure that a human is aware of the problem. To file a bug in Flutter: https://github.com/flutter/flutter/issues/new/choose To report a problem with the AutoRoller itself, please file a bug: https://issues.skia.org/issues/new?component=1389291&template=1850622 Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+doc/main/autoroll/README.md
…r when storing release callbacks in libImpeller (flutter/engine#56411) Fixes flutter#158285
3 participants
Fixes flutter/flutter#158285