Android Emulator host SIGSEGV in gfxstream GL fence wait path (EmulatedEglFenceSync / tcmalloc)

[XiaoTong6666]

Environment

• Emulator 37.1.11.0 (build 15917651)
• Debian sid, KDE Wayland, Linux 7.2-amd64
• Pixel_9a, x86_64, 6144 MB RAM
• android-CinnamonBun/google_apis_ps16k/x86_64
• GPU: auto

Launch command:

qemu-system-x86_64 @Pixel_9a -show-kernel -no-snapshot-load -writable-system

Crash

September 10, 2026, 17:47:15 UTC+8.

SIGSEGV / SEGV_MAPERR

tcmalloc::SLL_Next
tcmalloc::SLL_PopRange
tcmalloc::ThreadCache::FreeList::PopRange
tcmalloc::ThreadCache::ReleaseToCentralCache
tcmalloc::ThreadCache::ListTooLong
cfree
gfxstream::host::gl::EmulatedEglFenceSync::wait
...
gfxstream::host::SyncThread::doSyncThreadCmd

There also appears to be a fence lifetime race in the current source. FrameBuffer queues a raw fence pointer. The worker's registry lookup doesn't retain a reference, while wait() calls incRef() only afterward. A concurrent destroy could release the last reference between those two operations.

Not sure if this caused the crash. No reliable reproducer yet.

I have the original Apport report and core dump (~2 GB), available for further debugging. I haven't uploaded the raw dump publicly because it contains process memory.

[XiaoTong6666]

I took a closer look at the core dump. eglClientWaitSyncKHR() had already returned 0x30f6 (EGL_CONDITION_SATISFIED_KHR). The crash occurred afterward, during the inlined decRef() path in EmulatedEglFenceSync::wait():

decRef() → eglDestroySyncKHR() → ~EmulatedEglFenceSync() → operator delete(this) → tc_free() → tcmalloc::SLL_Next()

GDB shows a SIGSEGV while dereferencing an invalid free-list pointer in SLL_Next(). This narrows the failure to fence destruction after a successful wait, though the original heap corruption may have happened earlier.

[XiaoTong6666]

I think the fix needs to cover the lifetime from lookup through the queued wait, rather than just moving incRef() earlier.

getPtr() returns a raw pointer and drops the read lock. The worker's second lookup doesn't keep the fence alive before wait() calls incRef(). I'd add a lookup that acquires a reference under the registry lock, then hold that reference through the queued wait, including the vsync callback path.

decRef() also needs an atomic decrement that selects exactly one final releaser. I'd check the guest destroy and timeline sweep paths together so they don't release the same reference twice.