<div dir="ltr">Correction:<br>I modified VirtualBox GUI to<b> NOT </b>show close dialog.<div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Apr 19, 2013 at 4:53 PM, Ribhi Kamal <span dir="ltr"><<a href="mailto:rbhkamal@gmail.com" target="_blank">rbhkamal@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div><div><div>Michael,<br></div><div>I spent all day testing/comparing builds, below is my test result:<br>
<br></div>I compared the behaviour between unmodified vbox 4.2.8 and vbox 4.2.8 with your patch. Before the patch, Entering/Leaving fullscreen crashed virtualbox.exe 3 out of 4 attempts. After the patch, virtualbox crashed 2 out of 40+ attempts. The two crashes happened in different places, so it seems that your patch truly fixes the issue but other bugs (faults) got uncovered.<br>
<br></div><div>Test steps:<br></div><div>1- Create a linux VM with two virtual monitors (GA needed)<br></div><div>2- Start the VM<br></div><div>3- Enable all monitors inside the guest (mirror or spanning)<br></div><div>4- Run the following script:<br>
</div><div>#!/bin/bash<br><br></div><div>while true<br>do<br></div><div>xrandr --output VBOX1 --mode 1280x768 # Change this mode if needed<br>xrandr --output VBOX1 --mode 1440x1050 # Change this mode if needed<br></div>
<div>done<br>#-------------------<br></div><div>5- While the script the running, enter then exit full screen repeatedly.<br></div><div>
<br>
</div><div>The other area that is of interest to me is closing the VM while a resize event is happening. This issue seem to only affects me because I modified VirtualBox GUI to<b> NOT </b>show the close dialog. Instead, it pauses the machine and proceeds to power down the VM immediately as if the user selected the "Power off the machine" option.<br>
<br></div><div>I applied my change along with your fix and then tested closing the machine from inside the fullscreen window. So far, I'm unable to make virtualbox crash but this issue requires time (more time).<br><br>
</div><div>Test steps:<br></div><div>1- Do the same steps as before from 1-4<br></div><div>2- In normal view, make sure the the window is not Maximized (both windows)<br></div><div>3- Enter fullscreen and then run the script<br>
</div><div>4- After a few seconds, exit the machine. Be sure to disable the close dialog.<br></div><div><br></div><div>Finally, I tried to reproduce the bug using a Debug build. But the problem did not happen at all because everything was running slow.<br>
<br></div><div>So to sum things up, the patch fixed the issue but two new crashes surfaced. Both seem like a variation of use-after-free. Attached is one new crash that happened with 4.2.8 with your fix and no code modification on my part. The old crash file that I attached previously still applies (attached again).<br>
</div><div>
<br></div><div>Sorry I didn't have time to dig deeper than this. Once I have more time, I will try to pin point the source of these two crashes. <br></div></div><br></div><div class="gmail_extra"><div><div class="h5">
<br><br><div class="gmail_quote">
On Thu, Apr 18, 2013 at 11:49 AM, Ribhi Kamal <span dir="ltr"><<a href="mailto:rbhkamal@gmail.com" target="_blank">rbhkamal@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">Sorry about the delay, I'm still unable to confirm if the patch fixed the issue. I should be able to give an affirmative yea or nay by tomorrow. I have a bunch of projects due and didn't get enough time to test it with a clean build, but I already did the build so all that is left is to test it tomorrow.<div>
<br></div><div>Sorry again,</div><div>Ribhi</div></div><div class="gmail_extra"><div><div><br><br><div class="gmail_quote">On Thu, Apr 18, 2013 at 10:10 AM, Michael Thayer <span dir="ltr"><<a href="mailto:michael.thayer@oracle.com" target="_blank">michael.thayer@oracle.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hello Ribhi,<br>
<br>
Any update here? The crash that you reported after applying my patch looked like it was in a completely different area of the VirtualBox code, so I still have hope that my patch fixes the issue. I would be particularly interested if you happened to prove me wrong on that, but no worries if it is not currently as important for you as it was.<br>
<br>
Regards,<br>
<br>
Michael<div><br>
<br>
On 16/04/13 23:06, Ribhi Kamal wrote:<br>
</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>
I did a quick test against V4.2.12 and, I'm sorry, it did not work. The<br>
crash seems to have moved somewhere else.<br>
<br>
Steps:<br>
1- Boot up the VM with dual monitors (physical and virtual)<br>
2- Enter fullscreen<br>
3- Exit the VM from within fullscreen view.<br>
<br>
There is a small chance that the crash happened due to my changes or<br>
changes in V4.2.12 (vs V4.2.8). I'm still on campus now, but once I'm<br>
home or work I'll do a debug build a test it again against an unmodified<br>
V4.2.8. For now, attached is the dump analysis.<br>
<br>
Thanks,<br>
Ribhi<br>
<br>
<br>
<br>
On Tue, Apr 16, 2013 at 2:51 PM, Michael Thayer<br></div><div>
<<a href="mailto:michael.thayer@oracle.com" target="_blank">michael.thayer@oracle.com</a> <mailto:<a href="mailto:michael.thayer@oracle.com" target="_blank">michael.thayer@oracle.<u></u>com</a>>> wrote:<br>
<br>
Hello Ribhi,<br>
<br>
Does this patch look good to you?<br>
<br>
Regards,<br>
<br>
Michael<br>
<br></div>
Index: src/VBox/Frontends/VirtualBox/<u></u>__src/runtime/UIFrameBuffer.<u></u>cpp<br>
==============================<u></u>__============================<u></u>==__=======<br>
--- src/VBox/Frontends/VirtualBox/<u></u>__src/runtime/UIFrameBuffer.<u></u>cpp<br>
(revision 85072)<br>
+++ src/VBox/Frontends/VirtualBox/<u></u>__src/runtime/UIFrameBuffer.<u></u>cpp<div><br>
(revision 85073)<br>
@@ -158,24 +158,19 @@<br>
return E_FAIL;<br>
<br>
NOREF(uScreenId);<br>
- /* A resize event can happen while we are switching machine<br>
view classes,<br>
- * but we synchronise afterwards so that shouldn't be a<br>
problem. We must<br>
- * temporarily remove the framebuffer in Display though while<br>
switching<br>
- * to respect the thread synchronisation logic (see<br>
UIFrameBuffer.h). */<br>
+ *pbFinished = FALSE;<br>
+ lock(); /* See comment in setView(). */<br>
if (m_pMachineView)<br></div>
QApplication::postEvent(m___<u></u>pMachineView,<div><br>
new UIResizeEvent(uPixelFormat, pVRAM,<br>
uBitsPerPixel,<br>
uBytesPerLine,<br>
uWidth, uHeight));<br>
else<br>
- {<br>
/* Report to the VM thread that we finished resizing and<br>
rely on the<br>
* synchronisation when the new view is attached. */<br>
*pbFinished = TRUE;<br>
- return S_OK;<br>
- }<br>
+ unlock();<br>
<br>
- *pbFinished = FALSE;<br>
return S_OK;<br>
}<br>
<br>
@@ -200,9 +195,11 @@<br>
return E_POINTER;<br>
*pbSupported = TRUE;<br>
<br>
- if (!m_pMachineView)<br>
- return S_OK;<br></div>
- QSize screen = m_pMachineView->maxGuestSize()<u></u>__;<div><br>
+ lock(); /* See comment in setView(). */<br>
+ QSize screen;<br>
+ if (m_pMachineView)<br></div>
+ screen = m_pMachineView->maxGuestSize()<u></u>__;<div><br>
+ unlock();<br>
if ( (screen.width() != 0)<br>
&& (uWidth > (ULONG)screen.width())<br>
&& (uWidth > (ULONG)width()))<br>
@@ -249,7 +246,10 @@<br>
reg += rect;<br>
++ rects;<br>
}<br></div>
- QApplication::postEvent(m___<u></u>pMachineView, new<div><br>
UISetRegionEvent(reg));<br>
+ lock(); /* See comment in setView(). */<br>
+ if (m_pMachineView)<br></div>
+ QApplication::postEvent(m___<u></u>pMachineView, new<div><br>
UISetRegionEvent(reg));<br>
+ unlock();<br>
<br>
return S_OK;<br>
}<br>
@@ -271,6 +271,12 @@<br>
<br></div>
void UIFrameBuffer::setView(__<u></u>UIMachineView * pView)<div><br>
{<br>
+ /* We are not supposed to use locking for things which are done<br>
+ * on the GUI thread. Unfortunately I am not clever enough to<br>
+ * understand the original author's wise synchronisation logic<br>
+ * so I will do it anyway. */<br>
+ lock();<br>
m_pMachineView = pView;<br>
m_WinId = (m_pMachineView && m_pMachineView->viewport()) ?<br></div>
(LONG64)m_pMachineView->__<u></u>viewport()->winId() : 0;<div><div><br>
+ unlock();<br>
<br>
}<br>
<br>
<br>
On 28/03/13 01:30, Ribhi Kamal wrote:<br>
<br>
It seems that UIMachineView::maxGuestSize() continues to execute<br>
while<br>
some other thread/process destroys the UIMachineView object. To test<br>
this out, I put in a hack in UIMachineView to basically SpinLock<br>
until<br>
any existing maxGuestSize exits. Then it sets a flag using a static<br>
variable to prevent maxGuestSize from using any member variables<br>
after<br>
the view has been destroyed. When the view is recreated, the<br>
flag is reset.<br>
<br>
I've attached is my hack (based on 4.2.10), it works pretty well and<br>
seems to stop the crash. I hope this will help you put in a<br>
better fix<br>
in the future.<br>
<br>
Just one question, Which process/thread executes maxGuestSize?<br>
An EMT<br>
thread?<br>
<br>
Cheers!<br>
<br>
fyi, There are cases where this hack will not work (in theory)<br>
so please<br>
don't use it.<br>
<br>
<br>
On Sat, Mar 16, 2013 at 4:09 PM, Ribhi Kamal <<a href="mailto:rbhkamal@gmail.com" target="_blank">rbhkamal@gmail.com</a><br>
<mailto:<a href="mailto:rbhkamal@gmail.com" target="_blank">rbhkamal@gmail.com</a>><br></div></div><div>
<mailto:<a href="mailto:rbhkamal@gmail.com" target="_blank">rbhkamal@gmail.com</a> <mailto:<a href="mailto:rbhkamal@gmail.com" target="_blank">rbhkamal@gmail.com</a>>>> wrote:<br>
<br>
Just happened while switching from full screen back to<br>
normal view.<br>
This is something new, only in 4.2, because the virtual<br>
machine used<br>
to crash only while closing it so it wasn't a big deal.<br>
I'll open a<br>
bug once I reproduce it with the released binaries... don't<br>
wait.<br>
<br>
Meanwhile, please let me know if you need any additional<br>
information/testing.<br>
<br>
Thanks,<br>
Ribhi<br>
<br>
<br>
<br>
On Fri, Mar 15, 2013 at 8:26 PM, Ribhi Kamal<br>
<<a href="mailto:rbhkamal@gmail.com" target="_blank">rbhkamal@gmail.com</a> <mailto:<a href="mailto:rbhkamal@gmail.com" target="_blank">rbhkamal@gmail.com</a>><br></div><div>
<mailto:<a href="mailto:rbhkamal@gmail.com" target="_blank">rbhkamal@gmail.com</a> <mailto:<a href="mailto:rbhkamal@gmail.com" target="_blank">rbhkamal@gmail.com</a>>>> wrote:<br>
<br>
"Unfortunately, I can't find the log files"<br>
<br>
Obviously that is not true, I uploaded the logs to my<br>
dropbox<br>
<br>
<br>
On Fri, Mar 15, 2013 at 8:25 PM, Ribhi Kamal<br>
<<a href="mailto:rbhkamal@gmail.com" target="_blank">rbhkamal@gmail.com</a> <mailto:<a href="mailto:rbhkamal@gmail.com" target="_blank">rbhkamal@gmail.com</a>><br></div>
<mailto:<a href="mailto:rbhkamal@gmail.com" target="_blank">rbhkamal@gmail.com</a><div><br>
<mailto:<a href="mailto:rbhkamal@gmail.com" target="_blank">rbhkamal@gmail.com</a>>>> wrote:<br>
<br>
I've been seeing a crash when closing<br>
VirtualBox.exe that is<br>
almost never reproducible. Few days ago I managed<br>
to get a<br>
crash dump and ran the analysis, see below. At the<br>
time of<br>
the crash, I was closing the virtual machine after<br>
it had<br>
been running for ~24 hours. Unfortunately, I can't<br>
find the<br>
log files<br>
<br>
I'm using the following:<br>
VirtualBox 4.2.8 (Cross compiled with VS2010-SP1 on<br>
windows<br>
7 64bit, Target Host = x86)<br>
Host Win7 32bit<br>
Guest Linux 2.6 32bit<br>
Build Type: Release<br>
<br>
Please let me know if you have any questions.<br>
<br>
Thanks,<br>
Ribhi<br>
<br>
Log files:<br>
Successful:<br></div>
<a href="https://www.dropbox.com/s/__xrvcr8sud4z63ia/Success.log" target="_blank">https://www.dropbox.com/s/__<u></u>xrvcr8sud4z63ia/Success.log</a><br>
<<a href="https://www.dropbox.com/s/xrvcr8sud4z63ia/Success.log" target="_blank">https://www.dropbox.com/s/<u></u>xrvcr8sud4z63ia/Success.log</a>><br>
Crash:<br>
<a href="https://www.dropbox.com/s/__p5pslbt3sl9cpeo/Crash.log" target="_blank">https://www.dropbox.com/s/__<u></u>p5pslbt3sl9cpeo/Crash.log</a><div><br>
<<a href="https://www.dropbox.com/s/p5pslbt3sl9cpeo/Crash.log" target="_blank">https://www.dropbox.com/s/<u></u>p5pslbt3sl9cpeo/Crash.log</a>><br>
<br>
<br>
0:000> !analyze -v -f<br>
<br></div>
******************************<u></u>__****************************<u></u>**__*******************<div><br>
<br>
*<br>
*<br>
* Exception<br>
Analysis *<br>
*<br>
*<br>
<br></div>
******************************<u></u>__****************************<u></u>**__*******************<div><br>
<br>
<br>
GetPageUrlData failed, server returned HTTP status 404<br>
URL requested:<br></div>
<a href="http://watson.microsoft.com/__StageOne/VirtualBox_exe/4_2_8___0/51420e3b/unknown/0_0_0_0/__bbbbbbb4/80000003/00000000.__htm?Retriage=1" target="_blank">http://watson.microsoft.com/__<u></u>StageOne/VirtualBox_exe/4_2_8_<u></u>__0/51420e3b/unknown/0_0_0_0/_<u></u>_bbbbbbb4/80000003/00000000.__<u></u>htm?Retriage=1</a><br>
<<a href="http://watson.microsoft.com/StageOne/VirtualBox_exe/4_2_8_0/51420e3b/unknown/0_0_0_0/bbbbbbb4/80000003/00000000.htm?Retriage=1" target="_blank">http://watson.microsoft.com/<u></u>StageOne/VirtualBox_exe/4_2_8_<u></u>0/51420e3b/unknown/0_0_0_0/<u></u>bbbbbbb4/80000003/00000000.<u></u>htm?Retriage=1</a>><br>
<br>
<br>
FAULTING_IP:<br>
VirtualBox!UIMachineView::__<u></u>maxGuestSize+18<br>
<br>
[c:\vboxbuild\virtualbox\4.2._<u></u>_8\src\src\vbox\frontends\__<u></u>virtualbox\src\runtime\__<u></u>uimachineview.cpp<div><div><br>
@ 702]<br>
*0145ed68 f00fc70f lock cmpxchg8b qword ptr<br>
[edi] *<br>
<br>
<br>
EXCEPTION_RECORD: ffffffff -- (.exr<br>
0xffffffffffffffff)<br>
ExceptionAddress: 00000000<br>
ExceptionCode: 80000003 (Break instruction<br>
exception)<br>
ExceptionFlags: 00000000<br>
NumberParameters: 0<br>
<br>
FAULTING_THREAD: 00000ef4<br>
<br>
DEFAULT_BUCKET_ID: STATUS_BREAKPOINT<br>
<br>
PROCESS_NAME: VirtualBox.exe<br>
<br>
ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION}<br>
Breakpoint<br>
A breakpoint has been reached.<br>
<br>
EXCEPTION_CODE: (HRESULT) 0x80000003 <a href="tel:%282147483651" value="+12147483651" target="_blank">(2147483651</a><br>
<tel:%282147483651><br>
<tel:%282147483651>) - One or more arguments are<br>
invalid<br>
<br>
<br>
MOD_LIST: <ANALYSIS/><br>
<br>
NTGLOBALFLAG: 0<br>
<br>
APPLICATION_VERIFIER_FLAGS: 0<br>
<br>
ADDITIONAL_DEBUG_TEXT: Followup set based on attribute<br>
[Is_ChosenCrashFollowupThread] from Frame:[0] on<br>
thread:[PSEUDO_THREAD]<br>
<br>
LAST_CONTROL_TRANSFER: from 0143bea0 to 0145ed68<br>
<br>
PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT<br>
<br>
BUGCHECK_STR:<br></div></div>
APPLICATION_FAULT_STATUS___<u></u>BREAKPOINT_NULL_POINTER_READ<br>
<br>
STACK_TEXT:<br>
03a3ca98 0145ed68<br>
virtualbox!UIMachineView::__<u></u>maxGuestSize+0x18<br>
03a3cab0 0143bea0<br>
virtualbox!UIFrameBuffer::__<u></u>VideoModeSupported+0x30<br>
03a3cac8 6927c724 vboxc!__<u></u>vmmdevVideoModeSupported+0x74<br>
03a3caec 690b4edc vboxdd!vmmdevRequestHandler+__<u></u>0xecc<div><br>
03a3fb5c 72f198d1 vboxvmm!IOMIOPortWrite+0x91<br>
03a3fb84 72f0891f<br></div>
vboxvmm!__<u></u>HWACCMR3RestartPendingIOInstr+<u></u>__0xcf<br>
03a3fba4 72ea303c<br>
vboxvmm!__<u></u>emR3ExecuteIOInstruction+0x1c<br>
03a3fc78 72ea3589 vboxvmm!emR3HwaccmHandleRC+__<u></u>0x189<div><br>
03a3fc8c 72ea3788 vboxvmm!emR3HwAccExecute+0x168<br>
03a3fcb0 72ea0d84 vboxvmm!EMR3ExecuteVM+0x274<br>
03a3fcd8 72efb2aa<br></div>
vboxvmm!__<u></u>vmR3EmulationThreadWithId+__<u></u>0x45a<br>
03a3fcf8 72efb2f4 vboxvmm!vmR3EmulationThread+__<u></u>0x14<div><br>
03a3fd0c 69ca1523 vboxrt!rtThreadMain+0x33<br>
03a3fd38 69ce539b vboxrt!rtThreadNativeMain+0x6b<br>
03a3fd58 6bb6c556 msvcr100!_endthreadex+0x3f<br>
03a3fd90 6bb6c600 msvcr100!_endthreadex+0xce<br></div>
03a3fd9c 76b4ed6c kernel32!BaseThreadInitThunk+_<u></u>_0xe<br>
03a3fda8 7722377b ntdll!__RtlUserThreadStart+__<u></u>0x70<div><br>
03a3fde8 7722374e ntdll!_RtlUserThreadStart+0x1b<br>
<br>
<br>
STACK_COMMAND: .cxr 0000000003A3C7B4 ; kb ; dds<br>
3a3ca98 ; kb<br>
<br>
FOLLOWUP_IP:<br></div>
VirtualBox!UIMachineView::__<u></u>maxGuestSize+0<br>
<br>
[c:\vboxbuild\virtualbox\4.2._<u></u>_8\src\src\vbox\frontends\__<u></u>virtualbox\src\runtime\__<u></u>uimachineview.cpp<div><br>
@ 701]<br>
0145ed50 83ec0c sub esp,0Ch<br>
<br>
FAULTING_SOURCE_CODE:<br>
697:<br>
RT_MAKE_U64(maxSize.height(),<br>
maxSize.width()));<br>
698: }<br>
699:<br>
700: QSize UIMachineView::maxGuestSize()<br>
> 701: {<br>
702: uint64_t u64Size =<br></div>
ASMAtomicReadU64(&m___<u></u>u64MaxGuestSize);<div><br>
703: return QSize(int(RT_HI_U32(u64Size)),<br>
int(RT_LO_U32(u64Size)));<br>
704: }<br>
705:<br>
706: QSize UIMachineView::guestSizeHint()<br>
<br>
<br>
SYMBOL_NAME:<br></div>
virtualbox!UIMachineView::__<u></u>maxGuestSize+0<div><br>
<br>
FOLLOWUP_NAME: MachineOwner<br>
<br>
MODULE_NAME: VirtualBox<br>
<br>
IMAGE_NAME: VirtualBox.exe<br>
<br>
DEBUG_FLR_IMAGE_TIMESTAMP: 51420e3b<br>
<br>
FAILURE_BUCKET_ID:<br>
<br></div>
STATUS_BREAKPOINT_80000003___<u></u>VirtualBox.exe!UIMachineView::<u></u>__maxGuestSize<br>
<br>
<br>
BUCKET_ID:<br>
<br>
APPLICATION_FAULT_STATUS___<u></u>BREAKPOINT_NULL_POINTER_READ__<u></u>_virtualbox!UIMachineView::__<u></u>maxGuestSize+0<br>
<br>
<br>
WATSON_STAGEONE_URL:<br>
<a href="http://watson.microsoft.com/__StageOne/VirtualBox_exe/4_2_8___0/51420e3b/unknown/0_0_0_0/__bbbbbbb4/80000003/00000000.__htm?Retriage=1" target="_blank">http://watson.microsoft.com/__<u></u>StageOne/VirtualBox_exe/4_2_8_<u></u>__0/51420e3b/unknown/0_0_0_0/_<u></u>_bbbbbbb4/80000003/00000000.__<u></u>htm?Retriage=1</a><div>
<br>
<<a href="http://watson.microsoft.com/StageOne/VirtualBox_exe/4_2_8_0/51420e3b/unknown/0_0_0_0/bbbbbbb4/80000003/00000000.htm?Retriage=1" target="_blank">http://watson.microsoft.com/<u></u>StageOne/VirtualBox_exe/4_2_8_<u></u>0/51420e3b/unknown/0_0_0_0/<u></u>bbbbbbb4/80000003/00000000.<u></u>htm?Retriage=1</a>><br>
<br>
<br>
Followup: MachineOwner<br>
---------<br>
</div></blockquote>
<br>
<br>
-- <br><div><div>
ORACLE Deutschland B.V. & Co. KG Michael Thayer<br>
Werkstrasse 24 VirtualBox engineering<br>
71384 Weinstadt, Germany mailto:<a href="mailto:michael.thayer@oracle.com" target="_blank">michael.thayer@oracle.<u></u>com</a><br>
<br>
Hauptverwaltung: Riesstr. 25, D-80992 München<br>
Registergericht: Amtsgericht München, HRA 95603<br>
Geschäftsführer: Jürgen Kunz<br>
<br>
Komplementärin: ORACLE Deutschland Verwaltung B.V.<br>
Hertogswetering 163/167, 3543 AS Utrecht, Niederlande<br>
Handelsregister der Handelskammer Midden-Niederlande, Nr. 30143697<br>
Geschäftsführer: Alexander van der Ven, Astrid Kepper, Val Maher<br>
</div></div></blockquote></div><br><br clear="all"><div><br></div></div></div><span><font color="#888888">-- <br>-- Ribhi
</font></span></div>
</blockquote></div><br><br clear="all"><br></div></div><span class=""><font color="#888888">-- <br>-- Ribhi
</font></span></div>
</blockquote></div><br><br clear="all"><br>-- <br>-- Ribhi
</div></div></div>