touch-packages team mailing list archive

Thread
Date
[Bug 1379848] [NEW] Crash in mir::compositor::BufferQueue::give_buffer_to_client

To: touch-packages@xxxxxxxxxxxxxxxxxxx
From: Michael Terry <michael.terry@xxxxxxxxxxxxx>
Date: Fri, 10 Oct 2014 16:20:51 -0000
Reply-to: Bug 1379848 <1379848@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx
Public bug reported:

Ken was testing a silo and saw a crash in unity-system-compositor (and a
crash in the welcome wizard, which I'm assuming is due to the crash in
USC).

Here's what I've gotten out of the USC crash file, attached:

(gdb) bt
#0  __libc_do_syscall ()
    at ../ports/sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:44
#1  0xb67d2e5e in __GI_raise (sig=sig@entry=6)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#2  0xb67d3b4e in __GI_abort () at abort.c:89
#3  0xb67fc3f8 in __libc_message (do_abort=<optimized out>,
    fmt=0xb687a518 "*** Error in `%s': %s: 0x%s ***\n")
    at ../sysdeps/posix/libc_fatal.c:175
#4  0xb6800296 in malloc_printerr (action=1,
    str=0xb687a71c "free(): invalid pointer", ptr=<optimized out>)
    at malloc.c:4996
#5  0xb6800d76 in _int_free (av=<optimized out>, p=<optimized out>,
    have_lock=0) at malloc.c:3840
#6  0xb6953528 in std::string::_M_mutate(unsigned int, unsigned int, unsigned int) () from /usr/lib/arm-linux-gnueabihf/libstdc++.so.6
#7  0xb6953894 in std::string::_M_replace_safe(unsigned int, unsigned int, char const*, unsigned int) () from /usr/lib/arm-linux-gnueabihf/libstdc++.so.6
#8  0xb69538ec in std::string::assign(char const*, unsigned int) ()
   from /usr/lib/arm-linux-gnueabihf/libstdc++.so.6
#9  0xb6ad97b8 in set_response (size=4, value=0xae242138, this=0xac600588)
    at /build/buildd/mir-0.7.3+14.10.20140918.1/obj-arm-linux-gnueabihf/src/shared/protobuf/mir_protobuf_wire.pb.h:532
#10 mir::frontend::detail::ProtobufResponder::send_response (this=0xac600574,
    id=<optimized out>, response=0xac602a1c, fd_sets=...)
    at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/frontend/protobuf_responder.cpp:47
#11 0xb6ad6204 in mir::frontend::detail::ProtobufMessageProcessor::send_response (this=<optimized out>, id=1006, response=0xac602a1c)
    at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/frontend/protobuf_message_processor.cpp:225
#12 0xb6ad7f70 in google::protobuf::internal::MethodClosure2<mir::frontend::detail::ProtobufMessageProcessor, unsigned int, std::shared_ptr<mir::protobuf::Buffer> >::Run (this=0xac601400) at /usr/include/google/protobuf/stubs/common.h:987
#13 0xb6ac7e22 in operator() (__args#0=<optimized out>, this=0xae242a0c)
    at /usr/include/c++/4.9/functional:2439
#14 mir::compositor::BufferQueue::give_buffer_to_client (
    this=this@entry=0xac600d20, buffer=<optimized out>, lock=...)
    at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/compositor/buffer_queue.cpp:442
#15 0xb6ac80ae in mir::compositor::BufferQueue::release (
    this=this@entry=0xac600d20, buffer=buffer@entry=0xac60171c, lock=...)
    at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/compositor/buffer_queue.cpp:465
#16 0xb6ac87ee in mir::compositor::BufferQueue::compositor_release (
    this=0xac600d20, buffer=...)
    at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/compositor/buffer_queue.cpp:324
#17 0xb6abdfb4 in mir::compositor::TemporaryCompositorBuffer::~TemporaryCompositorBuffer (this=0xac99f93c, __in_chrg=<optimized out>)
    at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/compositor/temporary_buffers.cpp:40
#18 0xb47ee8b8 in ?? ()
   from /usr/lib/arm-linux-gnueabihf/mir/platformgraphics/android/libmirplatformgraphics.so
#19 0xb6abd456 in mir::compositor::DefaultDisplayBufferCompositor::composite (
    this=0xac9a3b98)
    at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/compositor/default_display_buffer_compositor.cpp:76
#20 0xb6ac12d0 in operator() (this=0x10c2b38)
    at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/compositor/multi_threaded_compositor.cpp:145
#21 std::_Function_handler<void (), std::reference_wrapper<mir::compositor::CompositingFunctor> >::_M_invoke(std::_Any_data const&) (__functor=...)
    at /usr/include/c++/4.9/functional:2069
#22 0xb6b03638 in operator() (this=0xac900468)
    at /usr/include/c++/4.9/future:1264
#23 std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<void>, std::__future_base::_Result_base::_Deleter>, void> >::_M_invoke(std::_Any_data const&) (__functor=...)
    at /usr/include/c++/4.9/functional:2025
#24 0xb6b021c2 in operator() (this=<optimized out>)
    at /usr/include/c++/4.9/functional:2439
#25 std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>&, bool&) (this=0x10c2fb0, __f=..., __set=@0xae242d30: false)
    at /usr/include/c++/4.9/future:485
#26 0xb6a3b092 in pthread_once () from /lib/arm-linux-gnueabihf/libpthread.so.0
#27 0xb6b0077e in __gthread_once (__func=<optimized out>, __once=0x10c3004)
    at /usr/include/arm-linux-gnueabihf/c++/4.9/bits/gthr-default.h:699
#28 call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>()>&, bool&), std::__future_base::_State_baseV2*, std::reference_wrapper<std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>()> >, std::reference_wrapper<bool> > (
    __f=<optimized out>, __once=...) at /usr/include/c++/4.9/mutex:751
#29 _M_set_result (__ignore_failure=false, __res=..., this=0x10c2fb0)
    at /usr/include/c++/4.9/future:372
#30 _M_run (this=0x10c2fb0) at /usr/include/c++/4.9/future:1319
#31 operator() (this=<optimized out>) at /usr/include/c++/4.9/future:1453
#32 operator() (this=0x10c2ba8)
    at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/thread/basic_thread_pool.cpp:55
#33 __invoke<(anonymous namespace)::Worker> (__f=...)
    at /usr/include/c++/4.9/functional:202
#34 operator()<> (this=<optimized out>) at /usr/include/c++/4.9/functional:435
#35 _M_invoke<> (this=<optimized out>) at /usr/include/c++/4.9/functional:1700
#36 operator() (this=<optimized out>) at /usr/include/c++/4.9/functional:1688
#37 std::thread::_Impl<std::_Bind_simple<std::reference_wrapper<(anonymous namespace)::Worker>()> >::_M_run(void) (this=<optimized out>)
    at /usr/include/c++/4.9/thread:115
#38 0xb694d5a4 in ?? () from /usr/lib/arm-linux-gnueabihf/libstdc++.so.6
#39 0xb6a36f98 in start_thread () from /lib/arm-linux-gnueabihf/libpthread.so.0
#40 0xb684022c in ?? ()
    at ../ports/sysdeps/unix/sysv/linux/arm/nptl/../clone.S:92
   from /lib/arm-linux-gnueabihf/libc.so.6
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

** Affects: mir (Ubuntu)
     Importance: Undecided
         Status: New

** Attachment added: "_usr_sbin_unity-system-compositor.0.crash"
   https://bugs.launchpad.net/bugs/1379848/+attachment/4230816/+files/_usr_sbin_unity-system-compositor.0.crash

** Description changed:

- Ken was testing a silo and saw a crash in unity-system-compositor, which
- took down the welcome wizard.
+ Ken was testing a silo and saw a crash in unity-system-compositor (and a
+ crash in the welcome wizard, which I'm assuming is due to the crash in
+ USC).
  
  Here's what I've gotten out of the USC crash file, attached:
  
  (gdb) bt
  #0  __libc_do_syscall ()
-     at ../ports/sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:44
+     at ../ports/sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:44
  #1  0xb67d2e5e in __GI_raise (sig=sig@entry=6)
-     at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
+     at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
  #2  0xb67d3b4e in __GI_abort () at abort.c:89
- #3  0xb67fc3f8 in __libc_message (do_abort=<optimized out>, 
-     fmt=0xb687a518 "*** Error in `%s': %s: 0x%s ***\n")
-     at ../sysdeps/posix/libc_fatal.c:175
- #4  0xb6800296 in malloc_printerr (action=1, 
-     str=0xb687a71c "free(): invalid pointer", ptr=<optimized out>)
-     at malloc.c:4996
- #5  0xb6800d76 in _int_free (av=<optimized out>, p=<optimized out>, 
-     have_lock=0) at malloc.c:3840
+ #3  0xb67fc3f8 in __libc_message (do_abort=<optimized out>,
+     fmt=0xb687a518 "*** Error in `%s': %s: 0x%s ***\n")
+     at ../sysdeps/posix/libc_fatal.c:175
+ #4  0xb6800296 in malloc_printerr (action=1,
+     str=0xb687a71c "free(): invalid pointer", ptr=<optimized out>)
+     at malloc.c:4996
+ #5  0xb6800d76 in _int_free (av=<optimized out>, p=<optimized out>,
+     have_lock=0) at malloc.c:3840
  #6  0xb6953528 in std::string::_M_mutate(unsigned int, unsigned int, unsigned int) () from /usr/lib/arm-linux-gnueabihf/libstdc++.so.6
  #7  0xb6953894 in std::string::_M_replace_safe(unsigned int, unsigned int, char const*, unsigned int) () from /usr/lib/arm-linux-gnueabihf/libstdc++.so.6
  #8  0xb69538ec in std::string::assign(char const*, unsigned int) ()
-    from /usr/lib/arm-linux-gnueabihf/libstdc++.so.6
+    from /usr/lib/arm-linux-gnueabihf/libstdc++.so.6
  #9  0xb6ad97b8 in set_response (size=4, value=0xae242138, this=0xac600588)
-     at /build/buildd/mir-0.7.3+14.10.20140918.1/obj-arm-linux-gnueabihf/src/shared/protobuf/mir_protobuf_wire.pb.h:532
- #10 mir::frontend::detail::ProtobufResponder::send_response (this=0xac600574, 
-     id=<optimized out>, response=0xac602a1c, fd_sets=...)
-     at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/frontend/protobuf_responder.cpp:47
+     at /build/buildd/mir-0.7.3+14.10.20140918.1/obj-arm-linux-gnueabihf/src/shared/protobuf/mir_protobuf_wire.pb.h:532
+ #10 mir::frontend::detail::ProtobufResponder::send_response (this=0xac600574,
+     id=<optimized out>, response=0xac602a1c, fd_sets=...)
+     at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/frontend/protobuf_responder.cpp:47
  #11 0xb6ad6204 in mir::frontend::detail::ProtobufMessageProcessor::send_response (this=<optimized out>, id=1006, response=0xac602a1c)
-     at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/frontend/protobuf_message_processor.cpp:225
+     at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/frontend/protobuf_message_processor.cpp:225
  #12 0xb6ad7f70 in google::protobuf::internal::MethodClosure2<mir::frontend::detail::ProtobufMessageProcessor, unsigned int, std::shared_ptr<mir::protobuf::Buffer> >::Run (this=0xac601400) at /usr/include/google/protobuf/stubs/common.h:987
  #13 0xb6ac7e22 in operator() (__args#0=<optimized out>, this=0xae242a0c)
-     at /usr/include/c++/4.9/functional:2439
+     at /usr/include/c++/4.9/functional:2439
  #14 mir::compositor::BufferQueue::give_buffer_to_client (
-     this=this@entry=0xac600d20, buffer=<optimized out>, lock=...)
-     at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/compositor/buffer_queue.cpp:442
+     this=this@entry=0xac600d20, buffer=<optimized out>, lock=...)
+     at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/compositor/buffer_queue.cpp:442
  #15 0xb6ac80ae in mir::compositor::BufferQueue::release (
-     this=this@entry=0xac600d20, buffer=buffer@entry=0xac60171c, lock=...)
-     at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/compositor/buffer_queue.cpp:465
+     this=this@entry=0xac600d20, buffer=buffer@entry=0xac60171c, lock=...)
+     at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/compositor/buffer_queue.cpp:465
  #16 0xb6ac87ee in mir::compositor::BufferQueue::compositor_release (
-     this=0xac600d20, buffer=...)
-     at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/compositor/buffer_queue.cpp:324
+     this=0xac600d20, buffer=...)
+     at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/compositor/buffer_queue.cpp:324
  #17 0xb6abdfb4 in mir::compositor::TemporaryCompositorBuffer::~TemporaryCompositorBuffer (this=0xac99f93c, __in_chrg=<optimized out>)
-     at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/compositor/temporary_buffers.cpp:40
+     at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/compositor/temporary_buffers.cpp:40
  #18 0xb47ee8b8 in ?? ()
-    from /usr/lib/arm-linux-gnueabihf/mir/platformgraphics/android/libmirplatformgraphics.so
+    from /usr/lib/arm-linux-gnueabihf/mir/platformgraphics/android/libmirplatformgraphics.so
  #19 0xb6abd456 in mir::compositor::DefaultDisplayBufferCompositor::composite (
-     this=0xac9a3b98)
-     at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/compositor/default_display_buffer_compositor.cpp:76
+     this=0xac9a3b98)
+     at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/compositor/default_display_buffer_compositor.cpp:76
  #20 0xb6ac12d0 in operator() (this=0x10c2b38)
-     at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/compositor/multi_threaded_compositor.cpp:145
+     at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/compositor/multi_threaded_compositor.cpp:145
  #21 std::_Function_handler<void (), std::reference_wrapper<mir::compositor::CompositingFunctor> >::_M_invoke(std::_Any_data const&) (__functor=...)
-     at /usr/include/c++/4.9/functional:2069
+     at /usr/include/c++/4.9/functional:2069
  #22 0xb6b03638 in operator() (this=0xac900468)
-     at /usr/include/c++/4.9/future:1264
+     at /usr/include/c++/4.9/future:1264
  #23 std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<void>, std::__future_base::_Result_base::_Deleter>, void> >::_M_invoke(std::_Any_data const&) (__functor=...)
-     at /usr/include/c++/4.9/functional:2025
+     at /usr/include/c++/4.9/functional:2025
  #24 0xb6b021c2 in operator() (this=<optimized out>)
-     at /usr/include/c++/4.9/functional:2439
+     at /usr/include/c++/4.9/functional:2439
  #25 std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>&, bool&) (this=0x10c2fb0, __f=..., __set=@0xae242d30: false)
-     at /usr/include/c++/4.9/future:485
+     at /usr/include/c++/4.9/future:485
  #26 0xb6a3b092 in pthread_once () from /lib/arm-linux-gnueabihf/libpthread.so.0
  #27 0xb6b0077e in __gthread_once (__func=<optimized out>, __once=0x10c3004)
-     at /usr/include/arm-linux-gnueabihf/c++/4.9/bits/gthr-default.h:699
+     at /usr/include/arm-linux-gnueabihf/c++/4.9/bits/gthr-default.h:699
  #28 call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>()>&, bool&), std::__future_base::_State_baseV2*, std::reference_wrapper<std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>()> >, std::reference_wrapper<bool> > (
-     __f=<optimized out>, __once=...) at /usr/include/c++/4.9/mutex:751
+     __f=<optimized out>, __once=...) at /usr/include/c++/4.9/mutex:751
  #29 _M_set_result (__ignore_failure=false, __res=..., this=0x10c2fb0)
-     at /usr/include/c++/4.9/future:372
+     at /usr/include/c++/4.9/future:372
  #30 _M_run (this=0x10c2fb0) at /usr/include/c++/4.9/future:1319
  #31 operator() (this=<optimized out>) at /usr/include/c++/4.9/future:1453
  #32 operator() (this=0x10c2ba8)
-     at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/thread/basic_thread_pool.cpp:55
+     at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/thread/basic_thread_pool.cpp:55
  #33 __invoke<(anonymous namespace)::Worker> (__f=...)
-     at /usr/include/c++/4.9/functional:202
+     at /usr/include/c++/4.9/functional:202
  #34 operator()<> (this=<optimized out>) at /usr/include/c++/4.9/functional:435
  #35 _M_invoke<> (this=<optimized out>) at /usr/include/c++/4.9/functional:1700
  #36 operator() (this=<optimized out>) at /usr/include/c++/4.9/functional:1688
  #37 std::thread::_Impl<std::_Bind_simple<std::reference_wrapper<(anonymous namespace)::Worker>()> >::_M_run(void) (this=<optimized out>)
-     at /usr/include/c++/4.9/thread:115
+     at /usr/include/c++/4.9/thread:115
  #38 0xb694d5a4 in ?? () from /usr/lib/arm-linux-gnueabihf/libstdc++.so.6
  #39 0xb6a36f98 in start_thread () from /lib/arm-linux-gnueabihf/libpthread.so.0
  #40 0xb684022c in ?? ()
-     at ../ports/sysdeps/unix/sysv/linux/arm/nptl/../clone.S:92
-    from /lib/arm-linux-gnueabihf/libc.so.6
+     at ../ports/sysdeps/unix/sysv/linux/arm/nptl/../clone.S:92
+    from /lib/arm-linux-gnueabihf/libc.so.6
  Backtrace stopped: previous frame identical to this frame (corrupt stack?)

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to mir in Ubuntu.
https://bugs.launchpad.net/bugs/1379848

Title:
  Crash in mir::compositor::BufferQueue::give_buffer_to_client

Status in “mir” package in Ubuntu:
  New

Bug description:
  Ken was testing a silo and saw a crash in unity-system-compositor (and
  a crash in the welcome wizard, which I'm assuming is due to the crash
  in USC).

  Here's what I've gotten out of the USC crash file, attached:

  (gdb) bt
  #0  __libc_do_syscall ()
      at ../ports/sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:44
  #1  0xb67d2e5e in __GI_raise (sig=sig@entry=6)
      at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
  #2  0xb67d3b4e in __GI_abort () at abort.c:89
  #3  0xb67fc3f8 in __libc_message (do_abort=<optimized out>,
      fmt=0xb687a518 "*** Error in `%s': %s: 0x%s ***\n")
      at ../sysdeps/posix/libc_fatal.c:175
  #4  0xb6800296 in malloc_printerr (action=1,
      str=0xb687a71c "free(): invalid pointer", ptr=<optimized out>)
      at malloc.c:4996
  #5  0xb6800d76 in _int_free (av=<optimized out>, p=<optimized out>,
      have_lock=0) at malloc.c:3840
  #6  0xb6953528 in std::string::_M_mutate(unsigned int, unsigned int, unsigned int) () from /usr/lib/arm-linux-gnueabihf/libstdc++.so.6
  #7  0xb6953894 in std::string::_M_replace_safe(unsigned int, unsigned int, char const*, unsigned int) () from /usr/lib/arm-linux-gnueabihf/libstdc++.so.6
  #8  0xb69538ec in std::string::assign(char const*, unsigned int) ()
     from /usr/lib/arm-linux-gnueabihf/libstdc++.so.6
  #9  0xb6ad97b8 in set_response (size=4, value=0xae242138, this=0xac600588)
      at /build/buildd/mir-0.7.3+14.10.20140918.1/obj-arm-linux-gnueabihf/src/shared/protobuf/mir_protobuf_wire.pb.h:532
  #10 mir::frontend::detail::ProtobufResponder::send_response (this=0xac600574,
      id=<optimized out>, response=0xac602a1c, fd_sets=...)
      at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/frontend/protobuf_responder.cpp:47
  #11 0xb6ad6204 in mir::frontend::detail::ProtobufMessageProcessor::send_response (this=<optimized out>, id=1006, response=0xac602a1c)
      at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/frontend/protobuf_message_processor.cpp:225
  #12 0xb6ad7f70 in google::protobuf::internal::MethodClosure2<mir::frontend::detail::ProtobufMessageProcessor, unsigned int, std::shared_ptr<mir::protobuf::Buffer> >::Run (this=0xac601400) at /usr/include/google/protobuf/stubs/common.h:987
  #13 0xb6ac7e22 in operator() (__args#0=<optimized out>, this=0xae242a0c)
      at /usr/include/c++/4.9/functional:2439
  #14 mir::compositor::BufferQueue::give_buffer_to_client (
      this=this@entry=0xac600d20, buffer=<optimized out>, lock=...)
      at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/compositor/buffer_queue.cpp:442
  #15 0xb6ac80ae in mir::compositor::BufferQueue::release (
      this=this@entry=0xac600d20, buffer=buffer@entry=0xac60171c, lock=...)
      at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/compositor/buffer_queue.cpp:465
  #16 0xb6ac87ee in mir::compositor::BufferQueue::compositor_release (
      this=0xac600d20, buffer=...)
      at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/compositor/buffer_queue.cpp:324
  #17 0xb6abdfb4 in mir::compositor::TemporaryCompositorBuffer::~TemporaryCompositorBuffer (this=0xac99f93c, __in_chrg=<optimized out>)
      at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/compositor/temporary_buffers.cpp:40
  #18 0xb47ee8b8 in ?? ()
     from /usr/lib/arm-linux-gnueabihf/mir/platformgraphics/android/libmirplatformgraphics.so
  #19 0xb6abd456 in mir::compositor::DefaultDisplayBufferCompositor::composite (
      this=0xac9a3b98)
      at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/compositor/default_display_buffer_compositor.cpp:76
  #20 0xb6ac12d0 in operator() (this=0x10c2b38)
      at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/compositor/multi_threaded_compositor.cpp:145
  #21 std::_Function_handler<void (), std::reference_wrapper<mir::compositor::CompositingFunctor> >::_M_invoke(std::_Any_data const&) (__functor=...)
      at /usr/include/c++/4.9/functional:2069
  #22 0xb6b03638 in operator() (this=0xac900468)
      at /usr/include/c++/4.9/future:1264
  #23 std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<void>, std::__future_base::_Result_base::_Deleter>, void> >::_M_invoke(std::_Any_data const&) (__functor=...)
      at /usr/include/c++/4.9/functional:2025
  #24 0xb6b021c2 in operator() (this=<optimized out>)
      at /usr/include/c++/4.9/functional:2439
  #25 std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>&, bool&) (this=0x10c2fb0, __f=..., __set=@0xae242d30: false)
      at /usr/include/c++/4.9/future:485
  #26 0xb6a3b092 in pthread_once () from /lib/arm-linux-gnueabihf/libpthread.so.0
  #27 0xb6b0077e in __gthread_once (__func=<optimized out>, __once=0x10c3004)
      at /usr/include/arm-linux-gnueabihf/c++/4.9/bits/gthr-default.h:699
  #28 call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>()>&, bool&), std::__future_base::_State_baseV2*, std::reference_wrapper<std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>()> >, std::reference_wrapper<bool> > (
      __f=<optimized out>, __once=...) at /usr/include/c++/4.9/mutex:751
  #29 _M_set_result (__ignore_failure=false, __res=..., this=0x10c2fb0)
      at /usr/include/c++/4.9/future:372
  #30 _M_run (this=0x10c2fb0) at /usr/include/c++/4.9/future:1319
  #31 operator() (this=<optimized out>) at /usr/include/c++/4.9/future:1453
  #32 operator() (this=0x10c2ba8)
      at /build/buildd/mir-0.7.3+14.10.20140918.1/src/server/thread/basic_thread_pool.cpp:55
  #33 __invoke<(anonymous namespace)::Worker> (__f=...)
      at /usr/include/c++/4.9/functional:202
  #34 operator()<> (this=<optimized out>) at /usr/include/c++/4.9/functional:435
  #35 _M_invoke<> (this=<optimized out>) at /usr/include/c++/4.9/functional:1700
  #36 operator() (this=<optimized out>) at /usr/include/c++/4.9/functional:1688
  #37 std::thread::_Impl<std::_Bind_simple<std::reference_wrapper<(anonymous namespace)::Worker>()> >::_M_run(void) (this=<optimized out>)
      at /usr/include/c++/4.9/thread:115
  #38 0xb694d5a4 in ?? () from /usr/lib/arm-linux-gnueabihf/libstdc++.so.6
  #39 0xb6a36f98 in start_thread () from /lib/arm-linux-gnueabihf/libpthread.so.0
  #40 0xb684022c in ?? ()
      at ../ports/sysdeps/unix/sysv/linux/arm/nptl/../clone.S:92
     from /lib/arm-linux-gnueabihf/libc.so.6
  Backtrace stopped: previous frame identical to this frame (corrupt stack?)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/mir/+bug/1379848/+subscriptions
Follow ups

[Bug 1379848] Re: Crash in mir::compositor::BufferQueue::give_buffer_to_client
From: Alberto Aguirre, 2014-10-10
[Bug 1379848] [NEW] Crash in mir::compositor::BufferQueue::give_buffer_to_client
From: Michael Terry, 2014-10-10
References

[Bug 1379848] [NEW] Crash in mir::compositor::BufferQueue::give_buffer_to_client
From: Michael Terry, 2014-10-10