Crash in java.lang.ArrayIndexOutOfBoundsException: length=58; index=-4 at java.util.ArrayList.get(ArrayList.java)

RESOLVED FIXED in Firefox 56

Status

()

defect
P1
critical
Rank:
1
RESOLVED FIXED
2 years ago
2 years ago

People

(Reporter: calixte, Assigned: mcomella)

Tracking

(Blocks 1 bug, {crash, regression})

55 Branch
Firefox 56
Unspecified
Android
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox-esr52 unaffected, firefox54 unaffected, firefox55 disabled, firefox56 fixed)

Details

(Whiteboard: [clouseau][MobileAS] 1.26, crash signature)

Attachments

(1 attachment, 1 obsolete attachment)

(Reporter)

Description

2 years ago
This bug was filed from the Socorro interface and is 
report bp-eb9d937a-6cea-4208-aa22-e6f380170523.
=============================================================

There are 16 crashes in nightly 55, they started with buildid 20170330100130. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1312016.
By the way since the crash signature is too accurate so the one in the summary corresponds to only one crash, but with a regex [2], we can get more.
For each signature, the length is different but the faulty index is always -4.

[1] https://hg.mozilla.org/mozilla-central/rev/69f111a76667
[2] https://crash-stats.mozilla.com/search/?release_channel=nightly&signature=%40%22java.lang.ArrayIndexOutOfBoundsException%3A%20length%3D%22%5B0-9%5D%2B%22%3B%20index%3D-%22%5B0-9%5D%2B%22%20at%20java.util.ArrayList.get%28ArrayList.java%29%22&product=FennecAndroid&version=55.0a1&date=%3E%3D2016-11-23T11%3A23%3A40.000Z&date=%3C2017-05-23T11%3A23%3A40.000Z&_sort=-date&_facets=url&_facets=user_comments&_facets=install_time&_facets=version&_facets=address&_facets=moz_crash_reason&_facets=reason&_facets=build_id&_facets=platform_pretty_version&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#crash-reports
Flags: needinfo?(s.kaspari)
Component: General → Awesomescreen
Flags: needinfo?(s.kaspari)
Priority: -- → P2
Whiteboard: [clouseau] → [clouseau][MobileAS]
Sebastian, is this likely to be fixed in the 55 window?
Flags: needinfo?(s.kaspari)
This feature is behind Nightly flags and will not ride the trains with 55. But yeah, I should get this fixed regardless!
Flags: needinfo?(s.kaspari)
Ah, cool thanks. Once Nightly turns to 56, we'll mark 55 and unaffected and 56 as affected.
(Reporter)

Comment 4

2 years ago
We still have 34 crashes in nightly 56.0a1 with the same signature pattern.
Rank: 1
Whiteboard: [clouseau][MobileAS] → [clouseau][MobileAS] 1.26
Assignee: nobody → michael.l.comella
Comment hidden (mozreview-request)
Iteration: --- → 1.26
Priority: P2 → P1
I think you make some good points, but I did a little more digging (even though you said it probably wasn't worth it, sorry :P)

There were reports similar to this in bug 1317631, that claimed to be fallout from a11y stuff (bug 1312434) (though at a glance I don't see how that's related).
https://crash-stats.mozilla.com/report/index/336a7a1a-35d6-4911-a5a9-bc0112161114

Anyway, that fixed the issue by adding some view id checks, which also happen to swallow the -1/NO_POSITION case:
https://hg.mozilla.org/mozilla-central/rev/c6f5da9786e9
https://hg.mozilla.org/mozilla-central/rev/399dea6e9200

However, it doesn't really give a better explanation for why we're getting -1/NO_POSITION than what you described in the comment in this patch.

For future spelunkers, the RecyclerView OnClickListener tries to get the item clicked by calling getAdapterPosition, but it can return NO_POSITION if the view holder has any flags or isn't bound.

http://androidxref.com/6.0.1_r10/xref/frameworks/support/v7/recyclerview/src/android/support/v7/widget/RecyclerView.java#8400
http://androidxref.com/6.0.1_r10/xref/frameworks/support/v7/recyclerview/src/android/support/v7/widget/RecyclerView.java#8656

Comment 7

2 years ago
mozreview-review
Comment on attachment 8888093 [details]
Bug 1367024: Fix array index out of bounds in StreamRecyclerAdapter.

https://reviewboard.mozilla.org/r/159000/#review166020
Attachment #8888093 - Flags: review?(liuche) → review+

Comment 8

2 years ago
Pushed by cliu@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/d133484d4c24
Fix array index out of bounds in StreamRecyclerAdapter. r=liuche

Comment 9

2 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/d133484d4c24
Status: NEW → RESOLVED
Last Resolved: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → Firefox 56
Comment hidden (mozreview-request, typo)
Comment on attachment 8907829 [details]
Bug 1367024: Move NO_POSITION check for IndexOutOfBoundsException in onItemClick.

Whoops, wrong (but related) bug.
Attachment #8907829 - Attachment is obsolete: true
Attachment #8907829 - Flags: review?(michael.l.comella)
You need to log in before you can comment on or make changes to this bug.