GPU Use-After-Free Crash on Quest 3 with OpenXR and Vulkan

My reports

Submit feedback

Investigation titles and descriptions are summarized by AI from Meta based on reports submitted by developers

Investigating

Issue

1 report

Created 20 days ago

Add your report

Suggest an edit

Copy link

Category

Android apps

Investigation summary

A use-after-free crash occurs on Quest 3 (Horizon OS 14, build v207) when a native OpenXR+Vulkan client attaches a runtime fragment density map via VK_EXT_fragment_density_map. The crash happens when VrShell destroys its swapchain and imported foveation resources shortly after client start, causing the GPU to fault reading the freed allocation within VrShell's context (ShellMain) approximately 20 seconds later. This results in repeated faults every 5 seconds, causing VrShell to stop presenting, and the client to block 16-32 seconds in vkQueueSubmit. The headset appears frozen, and kernel logs show a "premature free" with a read translation fault in UCHE. The issue is timing-sensitive and triggered by heavy GPU submission during shell swapchain create/destroy churn. It reproduces with XR_FB_foveation at XR_FOVEATION_LEVEL_HIGH_FB, regardless of subsampled layout or VK_EXT_fragment_density_map2 settings, but does not occur when the client omits the fragment density map attachment.