This repository has been archived by the owner on Aug 8, 2023. It is now read-only.
[core] Fix issue #11538 (race condition crash for heavily modified annotations) #11551
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
First half of fix for issue #11538. Testing `if (pendingData)` didn't work if there _was_ a data update, but the update was "the data for this tile is now null". In that case, the tile's FeatureIndex would be updated, but the tile's data member would remain unchanged. In the case of a tile's data being deleted, the matching FeatureIndex would have an empty set of bucketLayerIDs, but the _old_ data would still be in place for querying, and the symbolBuckets might not be updated yet (pending onPlacement). In this case `bucketLayerIDs.at(indexedFeature.bucketName)` could throw an out-of-range exception.
Second half of fix for issue #11538. If a global placement took place between the time a tile's non-symbol layout updated and the time new symbol buckets arrived, the tile's new FeatureIndex would be committed, but the global CollisionIndex would be generated against the old symbolBuckets. The mismatch could cause the CollisionIndex to contain indices that didn't exist in the new FeatureIndex, and attempting to access them would generate an out-of-bounds exception.
jfirebaugh
approved these changes
Mar 29, 2018
10 tasks
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains two fixes for issue #11538.
The first fix closes a logic error that would prevent the
GeometryTile"data" member from updating if the data went from non-null to null. This could allow the tile to have an emptyFeatureIndexwith non-empty data (since it would keep the previous non-null data). This could lead to an out of bounds exception being thrown here:mapbox-gl-native/src/mbgl/geometry/feature_index.cpp
Line 109 in 553efa3
The crash that would be generated doesn't match the stack trace reported in #11538, but it would be likely to happen in the same sort of stress case (quickly adding and removing annotations).
The second fix closes a race condition in which the
FeatureIndex/GeometryTileDatareceived inGeometryTile::onLayoutcould be committed before the corresponding updatedsymbolBucketsarrived inGeometryTile::onPlacement. Because the contents of the globalCollisionIndexare based on thesymbolBuckets, this would allow theCollisionIndexto end up "behind" the correspondingFeatureIndex/GeometryTileData, and if an item in theCollisionIndexhad been removed from the new data, it would be possible to get an out-of-bounds exception at:mapbox-gl-native/src/mbgl/geometry/feature_index.cpp
Line 119 in 553efa3
... which matches the stack trace in #11538.
A more satisfying fix for these issues would be to do the "one-phase" refactoring suggested in #10457 -- the split between "layout" and "placement" that allowed the race condition is mostly vestigial after that global collision detection changes.
@julianrex Since you were able to reproduce the original crash much more reliably than me, can you try to reproduce the crash off of this branch?
/cc @friedbunny @tobrun @jfirebaugh @lilykaiser