1400166 - Crash in InvalidArrayIndex_CRASH | mozilla::FileBlockCache::PerformBlockIOs

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect, P2)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-f0ad6c49-515c-4c34-bb58-b9db50170915.
=============================================================
Crashing Thread (41), Name: FileBlockCache
Frame 	Module 	Signature 	Source
0 	mozglue.dll 	MOZ_CrashPrintf 	mfbt/Assertions.cpp:50
1 	xul.dll 	InvalidArrayIndex_CRASH(unsigned int, unsigned int) 	xpcom/ds/nsTArray.cpp:26
2 	xul.dll 	mozilla::FileBlockCache::PerformBlockIOs() 	dom/media/FileBlockCache.cpp:408
3 	xul.dll 	mozilla::detail::RunnableMethodImpl<RefPtr<nsUrlClassifierDBServiceWorker>, void ( nsUrlClassifierDBServiceWorker::*)(void), 1, 0>::Run() 	obj-firefox/dist/include/nsThreadUtils.h:1172
4 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp:1446
5 	xul.dll 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/threads/nsThreadUtils.cpp:480
6 	xul.dll 	mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:369
7 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc:319
8 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc:299
9 	xul.dll 	nsThread::ThreadFunc(void*) 	xpcom/threads/nsThread.cpp:506
10 	nss3.dll 	_PR_NativeRunThread 	nsprpub/pr/src/threads/combined/pruthr.c:397
11 	nss3.dll 	pr_root 	nsprpub/pr/src/md/windows/w95thred.c:95
12 	ucrtbase.dll 	_o__CIpow 	
13 	kernel32.dll 	BaseThreadInitThunk 	
14 	mozglue.dll 	patched_BaseThreadInitThunk 	mozglue/build/WindowsDllBlocklist.cpp:824
15 	ntdll.dll 	__RtlUserThreadStart 	
16 	ntdll.dll 	_RtlUserThreadStart

this cross-platform crash signature is newly showing up in firefox 56.

Comment 1

[Blake Wu [:bwu][:blakewu]]

JW,
This is FileBlockCache related, Can you help check it?

Comment 2

[JW Wang [:jwwang] [:jw_wang]]

Checking.

Comment 3

[JW Wang [:jwwang] [:jw_wang]]

Attachment: Bug 1400166. P1 - move re-initialization code to Flush() for it is confusing to call Init() twice.

Review commit: https://reviewboard.mozilla.org/r/180784/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/180784/

Comment 4

[JW Wang [:jwwang] [:jw_wang]]

Attachment: Bug 1400166. P2 - Flush() should dispatch a task to clear arrays.

If mBlockChanges is cleared when PerformBlockIOs() is dropping the data lock,
blockIndex will become an invalid index after it acquire the data lock again.

Review commit: https://reviewboard.mozilla.org/r/180786/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/180786/

Comment 5

[Gerald Squelart (he/him) (not at Mozilla since 2022-09-15)]

Comment on attachment 8909194 [details]
Bug 1400166. P1 - move re-initialization code to Flush() for it is confusing to call Init() twice.

https://reviewboard.mozilla.org/r/180784/#review185944

Cleaner, thank you.

Comment 6

[Gerald Squelart (he/him) (not at Mozilla since 2022-09-15)]

Comment on attachment 8909195 [details]
Bug 1400166. P2 - Flush() should dispatch a task to clear arrays.

https://reviewboard.mozilla.org/r/180786/#review185946

Comment 7

[JW Wang [:jwwang] [:jw_wang]]

Thanks!

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/18b7334918f0
P1 - move re-initialization code to Flush() for it is confusing to call Init() twice. r=gerald
https://hg.mozilla.org/integration/autoland/rev/45461d47b376
P2 - Flush() should dispatch a task to clear arrays. r=gerald

Comment 9

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/18b7334918f0
https://hg.mozilla.org/mozilla-central/rev/45461d47b376

Comment 10

[Ryan VanderMeulen [:RyanVM]]

This seems low-volume enough that we can let it ride the trains rather than landing it last-second for for the Fx56RC2 build. Feel free to set the status back to affected and request mozilla-release approval if you feel strongly otherwise, though.