CNA-BUG-253: SdlGpu_ConstructorExceptionSafety aborts with a double free, a defect CNA's own record calls real and leaves unfixed

CNA snapshot 009d40f5  ·  Known Issues › Current bugs  ·  source links pinned to 009d40f5

CNA's own record says the classic SDL_GPU constructor-failure test aborts with 'free(): double free detected in tcache 2', identically on the unmodified sources, and calls it a real bug to fix later; CNA-BUG-099 quotes the same record inside its cluster of 24 failing classic tests, and this entry isolates the double free as its own defect.

Identifier

CNA-BUG-253

Category

Bug

Subsystem

Graphics & renderers

Status

Open

Verified against

CNA 009d40f5 (009d40f5dd085c4e674d3479675fac84b12b3e0a)

Severity

Medium (a triage suggestion, not a project priority)

Evidence basis

Recorded by CNA: CNA's own recorded run, not repeated here

Tests touching this area

Yes: see Current tests

Affected contract

CNA::Internal::Renderers::SdlGpu::SdlGpuRenderer construction, under the transactional-construction contract REMED-GFX-028 states for it

Expected behaviour

The regression test's own header states the contract: “Every failed constructor must balance acquisition/release callbacks, leave no window-registry entry, preserve the caller-owned SDL_Window, and permit an immediately succeeding renderer”, with resource callbacks that make leaks and double-destruction observable. A double free on a failed construction violates it.

Actual behaviour at TARGET

The registered CTest SdlGpu_ConstructorExceptionSafety (target cna_test_sdlgpu_constructor_exception_safety, sdlgpu_constructor_exception_safety_test.cpp) aborts with free(): double free detected in tcache 2. CNA's plan record says the same binary 'built from the unmodified renderer sources (changes stashed, rebuilt from ccache) aborts identically - not introduced here, not investigated further', and its backlog calls it 'A real bug, not test debt', with an owner decision dated 2026-09-23 to fix it later as a small targeted bugfix. The last record before TARGET (STREETS-0008) still counts it among the failing classic tests. The record does not name the freeing site, so neither does this entry. Two qualifications: the abort was measured in the private Weston plus Xwayland lane on one AMD RADV machine, while CNA's earlier SDLGPU-56 result (2026-09-09) records the same test passing in 14.93 s on offscreen/Vulkan with validation fatal, so whether the double free needs a particular video driver or arose after that date is not established; and SDL_GPU is declared Supported (not Experimental) in GraphicsBackendMaturity.hpp.

Source locations

• modules/renderers/sdl-gpu/examples/CMakeLists.txt — registers SdlGpu_ConstructorExceptionSafety and its target
• modules/renderers/sdl-gpu/examples/sdlgpu_constructor_exception_safety_test.cpp — the test and the transactional-construction contract in its header
• plans/plan_sdlgpu_modern_graphics.md — the measured failure and the backlog entry that calls it a real bug

Evidence

Read at 009d40f5: the test registration, the test's header and CNA's plan record. Not executed: the abort is recorded by CNA, not reproduced for this entry, and the cause was not isolated (CNA's record says it was not investigated further). Found by the independent adversarial review of the graphics entries (a reviewer noticed it appears only as a test name inside CNA-BUG-099 and CNA-BUG-203) and re-verified against the plan text by the orchestrator.

Independent re-verification: Read at 009d40f5: the test registration, the test source, the SdlGpuRenderer constructor transaction and CNA's plan records (SMG-0041/SMG-0042 backlog, PSG-0009, STREETS-0008, SDLGPU-56). Not executed: the abort is recorded by CNA, not reproduced for this entry, and the freeing site was not located by reading. CNA-BUG-099 carries the same record for this test among its 24 and points here, so that the double free is counted once.

Focused reproduction

No focused reproduction is known. Nothing has been invented here; the evidence above is what exists.

Current tests

The test itself is the regression test and is registered; per CNA's record it is one of the recorded classic SDL_GPU failures (see CNA-BUG-099, which quotes the same record inside its cluster of 24), so no lane passes it today. CNA's earlier SDLGPU-56 result (2026-09-09) records the same test passing on the offscreen Vulkan driver.

Regression test

The existing SdlGpu_ConstructorExceptionSafety, once fixed, kept in a lane that runs it under a double-free or leak-checking allocator.

Blast radius

The classic SDL_GPU renderer (declared Supported in GraphicsBackendMaturity.hpp) on a construction that fails part-way: the record shows the abort in CNA's own failure-injection test; how often a real construction failure reaches the same path is not known.

Workaround

No workaround is known.