Crash in glClientWaitSync

1

Greetings,

I had a crash in glClientWaitSync. This is the callstack within the driver:

#0 0x0000007f9cbc3574 in IsSync (gc=0x7f8c121040, psSyncObject=0x7f8c301e00) at opengles3/fencesync.c:255
psSyncObjectCursor = 0x180
#1 0x0000007f9cbc39dc in glClientWaitSync (sync=0x7f8c301e00, flags=1, timeout=0) at opengles3/fencesync.c:417
psSyncObject = 0x7f8c301e00
ui64LastTime_us = 0
ui64Timeout_us = 547819354640
eReturnValue = 0
gc = 0x7f8c121040

I have a multithreaded scenario with multiple OpenGL contextes and resource sharing. I upload data using glBufferData in the upload thread, then create a sync object like this:

sync = ::glFenceSync( GL_SYNC_GPU_COMMANDS_COMPLETE, 0 );
glClientWaitSync( sync, GL_SYNC_FLUSH_COMMANDS_BIT, 0 );

It seems that the method IsSync tries to dereference a pointer called psSyncObjectCursor that can point to invalid memory:

Dump of assembler code for function IsSync:
0x0000007f9cbc3534 <+0>: sub sp, sp, #0x20
0x0000007f9cbc3538 <+4>: str x0, [sp, #8]
0x0000007f9cbc353c <+8>: str x1, [sp]
0x0000007f9cbc3540 <+12>: ldr x0, [sp, #8]
0x0000007f9cbc3544 <+16>: add x0, x0, #0x8, lsl #12
0x0000007f9cbc3548 <+20>: ldr x0, [x0, #1040]
0x0000007f9cbc354c <+24>: ldr x0, [x0, #200]
0x0000007f9cbc3550 <+28>: str x0, [sp, #24]
0x0000007f9cbc3554 <+32>: b 0x7f9cbc357c <IsSync+72>
0x0000007f9cbc3558 <+36>: ldr x1, [sp, #24]
0x0000007f9cbc355c <+40>: ldr x0, [sp]
0x0000007f9cbc3560 <+44>: cmp x1, x0
0x0000007f9cbc3564 <+48>: b.ne 0x7f9cbc3570 <IsSync+60> // b.any
0x0000007f9cbc3568 <+52>: mov w0, #0x1 // #1
0x0000007f9cbc356c <+56>: b 0x7f9cbc358c <IsSync+88>
0x0000007f9cbc3570 <+60>: ldr x0, [sp, #24]
=> 0x0000007f9cbc3574 <+64>: ldr x0, [x0]
0x0000007f9cbc3578 <+68>: str x0, [sp, #24]
0x0000007f9cbc357c <+72>: ldr x0, [sp, #24]
0x0000007f9cbc3580 <+76>: cmp x0, #0x0
0x0000007f9cbc3584 <+80>: b.ne 0x7f9cbc3558 <IsSync+36> // b.any
0x0000007f9cbc3588 <+84>: mov w0, #0x0 // #0
0x0000007f9cbc358c <+88>: add sp, sp, #0x20
0x0000007f9cbc3590 <+92>: ret
End of assembler dump.
(gdb) info locals
psSyncObjectCursor = 0x180

I tried to register at ticket system and submit a ticket but I never get the registration confirmation email, thus I’m here.

Driver version: 1.10@5187610

2

Hi,

Many thanks for reporting this problem in our drivers, we will try to replicate it here and we will file it. I will keep you informed of any progress.
I am very sorry about the registration problems with our support portal. We are now investigating why the emails are not sent and we will fix it as soon as we can.

Best regards.

Carlos.

3

Hi,

The support portal seems to be working fine and it sends the verification emails. Could you check to see whether your received it? Maybe it was blocked at your end.

Regards.

Carlos.