Closed Bug 1297105 Opened 3 years ago Closed 3 years ago

Invalid array access in mozilla::gfx::impl::VRDisplayOculus::GetNextRenderTarget()

Categories

(Core :: Graphics, defect, critical)

Unspecified
Windows 10
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla51
Tracking Status
firefox51 --- fixed

People

(Reporter: mccr8, Assigned: kip)

References

Details

(Keywords: crash)

Crash Data

Attachments

(1 file)

This bug was filed from the Socorro interface and is 
report bp-a133d36c-1e68-440e-aab6-670a82160821.
=============================================================

Here's a second report:
  bp-8d3e723f-a8fe-4431-8137-f54732160818
Bug 1159244 added a release assert to array bounds checking. Can you take a look at this, Kip? Thanks.
Flags: needinfo?(kgilbert)
I'll investigate, thanks!
Assignee: nobody → kgilbert
Flags: needinfo?(kgilbert)
Under the metadata tab, these crashes both have: "ElementAt(aIndex = 0, aLength = 0)". So the code is attempting to access index 0 of an empty array.
This may be happening if the DX11 objects are failing to be created for blitting the Oculus headset texture, resulting in this array not being populated.  Patch is incoming...
See Also: → 1299309
Attachment #8786519 - Flags: review?(continuation)
Comment on attachment 8786519 [details]
Bug 1297105 - Prevent crash when DX11 resources fail to be allocated for Oculus VR HMD presentation

https://reviewboard.mozilla.org/r/75440/#review74424

Looks reasonable to me.

::: gfx/vr/gfxVROculus.cpp:768
(Diff revision 2)
> +     * XXX - We should resolve fail the promise returned by
> +     *       VRDisplay.requestPresent() when the DX11 resources fail allocation
> +     *       in VRDisplayOculus::StartPresentation().
> +     *       Bailing out here prevents the crash but content should be aware
> +     *       that frames are not being presented.
> +     *       See Bug 1299309

nit: This should have a period at the end.
Attachment #8786519 - Flags: review?(continuation) → review+
Crash Signature: [@ InvalidArrayIndex_CRASH] → [@ InvalidArrayIndex_CRASH] [@ InvalidArrayIndex_CRASH | mozilla::gfx::impl::VRDisplayOculus::GetNextRenderTarget ]
Pushed by kgilbert@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/a3c6df384b47
Prevent crash when DX11 resources fail to be allocated for Oculus VR HMD presentation r=mccr8
https://hg.mozilla.org/mozilla-central/rev/a3c6df384b47
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla51
You need to log in before you can comment on or make changes to this bug.