fix(replay): Prevent concurrent PixelCopy frame access#5808
Open
romtsn wants to merge 12 commits into
Open
Conversation
Keep PixelCopy, masking, compositing, and cleanup from accessing the shared bitmap concurrently. Fixes GH-5340 Co-Authored-By: Codex <noreply@openai.com>
📲 Install BuildsAndroid
|
Contributor
Performance metrics 🚀
|
| Revision | Plain | With Sentry | Diff |
|---|---|---|---|
| 22f4345 | 325.23 ms | 454.66 ms | 129.43 ms |
| 22f4345 | 312.78 ms | 347.40 ms | 34.62 ms |
| 8558cac | 306.16 ms | 355.24 ms | 49.09 ms |
| bb0ff41 | 317.76 ms | 384.66 ms | 66.90 ms |
| 7c1a728 | 289.46 ms | 368.15 ms | 78.69 ms |
| d501a7e | 314.55 ms | 343.34 ms | 28.79 ms |
| 4fc476b | 280.63 ms | 363.04 ms | 82.42 ms |
| 6727e14 | 337.22 ms | 373.94 ms | 36.71 ms |
| ae7fed0 | 293.84 ms | 380.22 ms | 86.38 ms |
| ee747ae | 400.46 ms | 423.61 ms | 23.15 ms |
App size
| Revision | Plain | With Sentry | Diff |
|---|---|---|---|
| 22f4345 | 1.58 MiB | 2.29 MiB | 719.83 KiB |
| 22f4345 | 1.58 MiB | 2.29 MiB | 719.83 KiB |
| 8558cac | 0 B | 0 B | 0 B |
| bb0ff41 | 0 B | 0 B | 0 B |
| 7c1a728 | 0 B | 0 B | 0 B |
| d501a7e | 0 B | 0 B | 0 B |
| 4fc476b | 0 B | 0 B | 0 B |
| 6727e14 | 1.58 MiB | 2.28 MiB | 718.64 KiB |
| ae7fed0 | 1.58 MiB | 2.12 MiB | 551.77 KiB |
| ee747ae | 1.58 MiB | 2.10 MiB | 530.95 KiB |
Previous results on branch: rz/fix/pixelcopy-frame-race
Startup times
| Revision | Plain | With Sentry | Diff |
|---|---|---|---|
| d2a3d5d | 388.86 ms | 456.52 ms | 67.66 ms |
| 381c693 | 319.27 ms | 379.62 ms | 60.36 ms |
| 1969846 | 317.74 ms | 376.00 ms | 58.26 ms |
| fab3793 | 330.67 ms | 352.10 ms | 21.43 ms |
| fcda53a | 318.75 ms | 365.57 ms | 46.82 ms |
| 8dd71e1 | 473.33 ms | 530.16 ms | 56.83 ms |
| 1976346 | 313.33 ms | 371.69 ms | 58.35 ms |
App size
| Revision | Plain | With Sentry | Diff |
|---|---|---|---|
| d2a3d5d | 0 B | 0 B | 0 B |
| 381c693 | 0 B | 0 B | 0 B |
| 1969846 | 0 B | 0 B | 0 B |
| fab3793 | 0 B | 0 B | 0 B |
| fcda53a | 0 B | 0 B | 0 B |
| 8dd71e1 | 0 B | 0 B | 0 B |
| 1976346 | 0 B | 0 B | 0 B |
Re-arm the recorder's content-change gate when a capture is skipped because another frame is still in flight. This ensures the latest UI state is retried on the next capture interval. Refs GH-5340 Co-Authored-By: OpenAI Codex <noreply@openai.com>
romtsn
marked this pull request as ready for review
July 22, 2026 15:17
romtsn
requested review from
0xadam-brown,
adinauer,
markushi and
runningcode
as code owners
July 22, 2026 15:17
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
Two bugbot findings on #5808: - Frame gate stuck on callback errors: viewhierarchy traversal or captureSurfaceViews throwing between the PixelCopy success check and the executor submit left frameInFlight = true forever, silently wedging all future captures. Wrap the post-success block in a try/finally that releases the gate unless work was successfully handed off. - Cleanup lost after executor shutdown: close() typically runs after ReplayIntegration has shut down the replay executor, so submit() returns null and the bitmap + maskRenderer were never released. Fall back to running cleanup inline in that case.
8 tasks
The mask branch already knows via 'submitted == null' whether the executor took ownership; the surface-view branch always hands off. Flatten to explicit finishFrame() calls on the two failure paths (mask null-submit, outer catch) instead of tracking handoff state across a try/finally.
runningcode
reviewed
Jul 22, 2026
ReplayExecutorService.submit previously returned null both when the caller was on the worker thread (task ran inline) and when the executor rejected the submission (task did NOT run). Callers had no way to tell them apart. Return a CompletedFuture sentinel for inline execution; null now means only rejection. Also narrow PixelCopyStrategy's frame-processing catch from Throwable to RuntimeException so OOM/LinkageError still propagate.
Cleanup body is already idempotent (screenshot.isRecycled check, MaskRenderer.close guards on isInitialized + isRecycled). A stray extra scheduleCleanup would just submit a no-op — not worth the AtomicBoolean.
…ose race The mock executor closed the strategy on every submit(); since close() itself submits the cleanup task, this recursed close() -> scheduleCleanup() -> submit() until the stack overflowed. Close only when the mask task is submitted. The prior "does not crash" assertion was also vacuous under the frameInFlight gate (passed even with the isClosed guard removed). Assert instead that no screenshot is emitted once close() races masking, which fails if the guard in applyMaskingAndNotify is removed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…bitmap a new capture is using finishFrame cleared frameInFlight before checking isClosed, so a new capture could take the gate and start PixelCopy into the shared screenshot while the old finishFrame went on to scheduleCleanup after close() flipped isClosed — recycling the bitmap mid-write. Re-take the gate with compareAndSet before cleaning up so the losing frame backs off. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
close() checked !frameInFlight.get() non-atomically before scheduleCleanup, so a capture racing in after the check could take the gate, see isClosed, and have its finishFrame schedule a second cleanup. Extract the shared "claim the gate, then the winner cleans up once" invariant into cleanUpIfIdle() so close() and finishFrame() use the same CAS. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…layExecutorService inlineExecutor() returned null from submit, which under the executor's contract means "rejected" — making capture()'s null-fallback finishFrame run on top of the mask task's own finally, a double-release production never hits on the inline path. Return CompletedFuture so the fixture matches the real inline semantics. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit cd3a7c0. Configure here.
| strategy?.close() | ||
| if ((task as? ReplayRunnable)?.taskName == "screenshot_recorder.mask") { | ||
| strategy?.close() | ||
| } |
There was a problem hiding this comment.
Close-race test breaks submit contract
Low Severity
The close-vs-mask race test still returns null after running the task inline, but null now means rejection only. That makes capture call finishFrame again on top of the task’s finally, releasing the cleanup gate the CAS handoff is meant to hold. inlineExecutor was already updated to return CompletedFuture for this reason.
Reviewed by Cursor Bugbot for commit cd3a7c0. Configure here.
Comment on lines
124
to
132
|
|
||
| var strategy: PixelCopyStrategy? = null | ||
|
|
||
| val failure = AtomicReference<Throwable>() | ||
| // Custom executor that closes the strategy before executing tasks | ||
| // Custom executor that closes the strategy right before running the mask task, to simulate | ||
| // close() racing an in-flight mask task. We key off the mask task specifically (not "the first | ||
| // submit") because close() itself submits the cleanup task — closing again when that runs would | ||
| // recurse via close() -> scheduleCleanup() -> submit(), a loop no real code path can produce. | ||
| val executorThatClosesFirst = mock<ScheduledExecutorService>() |
There was a problem hiding this comment.
Bug: A test mock for the executor service incorrectly returns null after running a task, which deviates from the production contract and causes tests to exercise non-production code paths.
Severity: LOW
Suggested Fix
Modify the mock executorThatClosesFirst to align with the ReplayExecutorService contract. Instead of returning null for a task that runs, it should return a Future object, such as a completed future, to correctly simulate the production environment's behavior for inline execution.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location:
sentry-android-replay/src/test/java/io/sentry/android/replay/screenshot/PixelCopyStrategyTest.kt#L124-L132
Potential issue: The test mock `executorThatClosesFirst` is implemented to return `null`
after successfully running a task. This violates the contract of
`ReplayExecutorService`, where a `null` return value signifies that the task was
rejected and did not run. This discrepancy causes the test to execute a code path (`if
(submitted == null)`) that would not be triggered in production under the same
circumstances, leading to a double call of `finishFrame()`. While this does not cause a
failure in this specific test, it weakens the test's validity by not accurately
simulating production behavior.
Also affects:
sentry-android-replay/src/main/java/io/sentry/android/replay/screenshot/PixelCopyStrategy.kt:147~149
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📜 Description
Prevent concurrent access to the bitmap shared by PixelCopy and replay processing.
The strategy now drops a capture while another frame is in flight, keeps the gate held through
masking and SurfaceView compositing, suppresses last-frame emission during that work, and defers
bitmap cleanup until the outstanding PixelCopy callback completes.
💡 Motivation and Context
PixelCopy.request()returns before RenderThread finishes writing its destination. The replayexecutor could therefore draw masks or SurfaceView content into the same bitmap, while
close()could recycle it before the asynchronous request completed. This could produce torn or improperly
masked frames and may contribute to native
libhwuicrashes.Dropping an overlapping frame avoids blocking the main thread or allocating a second recording
bitmap. Replay time remains continuous; the previous frame is displayed longer when a capture is
dropped. This should be rare at the default 1 FPS, while sustained overload at higher frame rates
may reduce visual smoothness rather than emit a corrupt or improperly masked frame.
Fixes #5340
Refs #5340
💚 How did you test it?
./gradlew ':sentry-android-replay:testDebugUnitTest' --tests='*PixelCopyStrategyTest*' --info./gradlew spotlessApply apiDumpAdded regression coverage for requests overlapping PixelCopy, queued masking, last-frame emission,
and cleanup during an outstanding request.
📝 Checklist
sendDefaultPIIis enabled.🔮 Next steps
RGB_565when SurfaceView capture is disabled in a separate change.