[Impeller] In the AHBTextureSourceVK destructor, do not call Vulkan APIs if the VkDevice has been destroyed#189666
Merged
Conversation
…PIs if the VkDevice has been destroyed The ASurfaceTransaction completion callback holds a reference to the AHBTextureSourceVK. Android manages the lifetime of the callback, and the callback can be deleted after the VkDevice has been destroyed. If that happens, the AHBTextureSourceVK destructor must release its Vulkan objects to avoid calling Vulkan APIs using the invalid VkDevice. Also extends the mock Vulkan test framework to detect if a deleted VkDevice is passed to a Vulkan API. See b/525524577
github-actions
Bot
added
engine
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request modifies the Impeller Vulkan backend to prevent calling Vulkan APIs on a destroyed VkDevice during AHBTextureSourceVK destruction, and updates the mock Vulkan test framework to track device lifetimes using weak pointers. The review feedback identifies two issues: first, a potential crash during AHBTextureSourceVK destruction if yuv_conversion_ is present, as its destructor will still attempt to call Vulkan APIs on the destroyed device; second, a Use-After-Free vulnerability in the mock Vulkan framework's vkDestroyDevice where subsequent API calls using a destroyed VkDevice handle will dereference a deleted heap-allocated weak pointer.
b-luk
previously approved these changes
Jul 17, 2026
…apchainImplVK::AcquireNextDrawable to return a surface
Member
Author
|
Updated a test to match the new capabilities of the Vulkan mocks - PTAL |
b-luk
approved these changes
Jul 20, 2026
jason-simmons
added
the
autosubmit
flutter-dashboard
Bot
removed
the
autosubmit
auto-submit Bot
pushed a commit
to flutter/packages
that referenced
this pull request
Jul 21, 2026
flutter/flutter@cab057d...1ac2e82 2026-07-21 [email protected] Add BaseWindowController.isDestroyed flag (flutter/flutter#189061) 2026-07-21 [email protected] Roll Dart SDK from 666e1e2133b7 to 3b2f5ad7718d (1 revision) (flutter/flutter#189745) 2026-07-21 [email protected] Roll Skia from 3c52d80c960d to 569534e9fa59 (5 revisions) (flutter/flutter#189766) 2026-07-21 [email protected] Roll Skia from 11426cf7aaa1 to 3c52d80c960d (2 revisions) (flutter/flutter#189758) 2026-07-21 [email protected] Roll pub packages (flutter/flutter#189760) 2026-07-21 [email protected] [iOS] Inject DisplayLinkManager into FlutterKeyboardInsetManager (flutter/flutter#189751) 2026-07-21 [email protected] Treat package:stack_trace async-gap marker as asynchronous suspension (flutter/flutter#185791) 2026-07-21 [email protected] [iOS] Inject DisplayLinkManager into VsyncWaiterIOS (flutter/flutter#189749) 2026-07-20 [email protected] Use String builder in `InputConnectionAdaptorTest.java` (flutter/flutter#189281) 2026-07-20 [email protected] Fix non-independant tests in draggable_test.dart (flutter/flutter#186898) 2026-07-20 [email protected] Stop using ReLinker to load libflutter.so on Android 17 (API 37+) (flutter/flutter#189146) 2026-07-20 [email protected] [et] Refactor gn post-processing, fix minor clang[++] regex match bug (flutter/flutter#189685) 2026-07-20 [email protected] Take plugin_test_darwin out of bringup (flutter/flutter#189594) 2026-07-20 [email protected] Roll pub packages (flutter/flutter#189596) 2026-07-20 [email protected] widgets layer re-export ScrollCacheExtent (flutter/flutter#189483) 2026-07-20 [email protected] Roll Skia from 47143b6fa402 to 11426cf7aaa1 (7 revisions) (flutter/flutter#189740) 2026-07-20 [email protected] Sync CHANGELOG.md from stable (flutter/flutter#189735) 2026-07-20 [email protected] [Impeller] In the AHBTextureSourceVK destructor, do not call Vulkan APIs if the VkDevice has been destroyed (flutter/flutter#189666) 2026-07-20 [email protected] Add AutofillHints.emailOTPCode for Android AUTOFILL_HINT_EMAIL_OTP (flutter/flutter#188123) 2026-07-20 [email protected] Add a github workflow to remove flutteractionsbot branches after the PRs are merged or closed. (flutter/flutter#189668) 2026-07-20 [email protected] Roll ANGLE to cc08479fbcc1 (flutter/flutter#189595) 2026-07-20 [email protected] Roll Fuchsia Linux SDK from NL8xtzr8cxr5E8r8E... to GswhlPRO-D1qSNclx... (flutter/flutter#189715) 2026-07-20 [email protected] Roll Skia from ba90f98535de to 47143b6fa402 (4 revisions) (flutter/flutter#189721) If this roll has caused a breakage, revert this CL and stop the roller using the controls here: https://autoroll.skia.org/r/flutter-packages Please CC [email protected],[email protected] on the revert to ensure that a human is aware of the problem. To file a bug in Packages: https://github.com/flutter/flutter/issues/new/choose To report a problem with the AutoRoller itself, please file a bug: https://issues.skia.org/issues/new?component=1389291&template=1850622 Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+doc/main/autoroll/README.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The ASurfaceTransaction completion callback holds a reference to the AHBTextureSourceVK. Android manages the lifetime of the callback, and the callback can be deleted after the VkDevice has been destroyed. If that happens, the AHBTextureSourceVK destructor must release its Vulkan objects to avoid calling Vulkan APIs using the invalid VkDevice.
Also extends the mock Vulkan test framework to detect if a deleted VkDevice is passed to a Vulkan API.
See b/525524577