Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-88199

Regression: Using QQuickWindow::createTextureFromImage on a QImage with RGBA8888 can cause the application to crash on certain Android devices.

    XMLWordPrintable

Details

    • Android

    Description

      Creating a QSGTexture * with QQuickWindow::createTextureFromImage on a QImage with format RGBA8888, and then binding this texture can cause the application to crash with "stack corruption detected (-fstack-protector)" depending on Android device, device load, and size of the QImage:

       

      10-22 15:03:49.115 1230 1230 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
10-22 15:03:49.115 1230 1230 F DEBUG : Build fingerprint: 'samsung/crownltexx/crownlte:10/QP1A.190711.020/N960FXXU6ETG3:user/release-keys'
10-22 15:03:49.115 1230 1230 F DEBUG : Revision: '28'
10-22 15:03:49.115 1230 1230 F DEBUG : ABI: 'arm64'
10-22 15:03:49.116 1230 1230 F DEBUG : Timestamp: 2020-10-22 15:03:49+0530
10-22 15:03:49.116 1230 1230 F DEBUG : pid: 656, tid: 854, name: QtThread >>> com.[package name removed] <<<
10-22 15:03:49.116 1230 1230 F DEBUG : uid: 10457
10-22 15:03:49.116 1230 1230 F DEBUG : signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr --------
10-22 15:03:49.116 1230 1230 F DEBUG : Abort message: 'stack corruption detected (-fstack-protector)'
10-22 15:03:49.116 1230 1230 F DEBUG : x0 0000000000000000 x1 0000000000000356 x2 0000000000000006 x3 0000007c74473930
10-22 15:03:49.116 1230 1230 F DEBUG : x4 0000000000000000 x5 0000000000000000 x6 0000000000000000 x7 0000000000000030
10-22 15:03:49.116 1230 1230 F DEBUG : x8 00000000000000f0 x9 0000007dbea2b5e0 x10 0000000000000000 x11 0000000000000001
10-22 15:03:49.116 1230 1230 F DEBUG : x12 0000000000000028 x13 000000005f9151fc x14 000d87b5e7c4ef00 x15 00004e881dd7ac4a
10-22 15:03:49.116 1230 1230 F DEBUG : x16 0000007dbeaf98c0 x17 0000007dbead6880 x18 0000007c6fb22000 x19 00000000000000ac
10-22 15:03:49.116 1230 1230 F DEBUG : x20 0000000000000290 x21 00000000000000b2 x22 0000000000000356 x23 00000000ffffffff
10-22 15:03:49.116 1230 1230 F DEBUG : x24 0000007c9bb6d288 x25 0000000000000400 x26 0000000000000000 x27 0000007c31600780
10-22 15:03:49.116 1230 1230 F DEBUG : x28 0000007c74475020 x29 0000007c744739e0
10-22 15:03:49.116 1230 1230 F DEBUG : sp 0000007c74473910 lr 0000007dbea8a330 pc 0000007dbea8a360
10-22 15:03:49.121 1230 1230 F DEBUG : 
10-22 15:03:49.121 1230 1230 F DEBUG : backtrace:
10-22 15:03:49.121 1230 1230 F DEBUG : #00 pc 0000000000083360 /apex/com.android.runtime/lib64/bionic/libc.so (abort+176) (BuildId: 13817077d0d892b63e2f982cf91d02fa)
10-22 15:03:49.121 1230 1230 F DEBUG : #01 pc 00000000000cec4c /apex/com.android.runtime/lib64/bionic/libc.so (__stack_chk_fail+20) (BuildId: 13817077d0d892b63e2f982cf91d02fa)
10-22 15:03:49.121 1230 1230 F DEBUG : #02 pc 0000000000a6f998 /vendor/lib64/egl/libGLES_mali.so (BuildId: cbd4af4cc98e8f34a81ee28e61acc6bc)
10-22 15:03:49.121 1230 1230 F DEBUG : #03 pc 0000000000a6f760 /vendor/lib64/egl/libGLES_mali.so (BuildId: cbd4af4cc98e8f34a81ee28e61acc6bc)
10-22 15:03:49.122 1230 1230 F DEBUG : #04 pc 0000000000a28bf0 /vendor/lib64/egl/libGLES_mali.so (glTexImage2D+120) (BuildId: cbd4af4cc98e8f34a81ee28e61acc6bc)
10-22 15:03:49.122 1230 1230 F DEBUG : #05 pc 000000000031a9e4 /data/app/com.[package name removed]-cSf9Lr_dR2FlS272OraF7A==/lib/arm64/libQt5Gui_arm64-v8a.so (QOpenGLTextureUploader::textureImage(unsigned int, QImage const&, QFlags<QOpenGLTextureUploader::BindOption>, QSize)+1760) (BuildId: 119f8044fb2b6558ce489e2f730305ed5aa1925b)

       

      As a workaround, changing the QImage format to RGBX8888 resolves the issue and the stack corruption does not happen. This crash is also not observed when using version 5.12.4 of Qt. The actual upload of the texture happens when QOpenGLTextureUploader::textureImage, and since setting the format to RGBX888 resolves the issue, we suspect that the conversion from Format_RGBA8888 to Format_RGBA8888_premultiplied is somehow causing this issue. Might it be related to some of the thread pools recently changed here: https://github.com/qt/qtbase/blob/5.15.1/src/gui/image/qimage_conversions.cpp ?

      From the stack trace above it might seem that this issue crashes in the libGLES_mali.so somehow, but after investigating the OpenGL calls, the call to glTexImage2d is identical between the Format_RGBA8888 and Format_RGBX8888 case, so we suspect that the stack corruption happens somewhere else. (But who knows in the case of a stack corruption?)

      I've tried to create a minimal reproducible example of this, by just creating a QImage with a big size inside the "updatePaintNode" in "beziercurve.cpp" in the customgeometry example, but have so far been unable to achieve the crash outside our product code. I won't spend more time trying to create a reproducible example of this, since we can resolve our issue with using Format_RGBX8888. 

      Attachments

        Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. QTBUG-90705 qtquick3d dependency update failed on 'dev'

          • P0: Blocker - MUST be fixed ASAP. This includes issues that prevent/block further Qt development; Legal issues & Serious data loss issues.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. QTBUG-90629 Deadlock in QImage conversion, convert_generic_inplace hangs on futex

          • P1: Critical - Urgent and Important, will STOP the release if matched with set FixVersion field. This includes regressions from the last version that are not edge cases; Data loss; Build issues; All but the most unlikely crashes/lockups/hanging; Serious usability issues and embarrassing bugs & Bugs critical to a deliverable. This is the highest possible priority for requirements.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. QTBUG-92188 Stack smashing detected using QImage::scaled

          • P1: Critical - Urgent and Important, will STOP the release if matched with set FixVersion field. This includes regressions from the last version that are not edge cases; Data loss; Build issues; All but the most unlikely crashes/lockups/hanging; Serious usability issues and embarrassing bugs & Bugs critical to a deliverable. This is the highest possible priority for requirements.
          • Closed
          No reviews matched the request. Check your Options in the drop-down menu of this sections header.

          Activity

            People

              lukasz.kosiorowski lukasz.kosiorowski
              tomana Tom Nœrland
              Votes:
              1 Vote for this issue
              Watchers:
              11 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Gerrit Reviews

                  There are no open Gerrit changes