Crash in InvalidArrayIndex_CRASH | nsTArray_Impl<T>::operator[] | mozilla::wr::ShmSegmentsWriter::Write

RESOLVED FIXED in Firefox 58

Status

()

P1
critical
RESOLVED FIXED
a year ago
9 months ago

People

(Reporter: calixte, Assigned: vliu)

Tracking

(Blocks: 4 bugs, {crash, regression})

58 Branch
mozilla58
Unspecified
Windows 10
crash, regression
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox-esr52 unaffected, firefox56 unaffected, firefox57 unaffected, firefox58 fixed)

Details

(Whiteboard: [wr-reserve] [clouseau], crash signature)

Attachments

(1 attachment)

(Reporter)

Description

a year ago
This bug was filed from the Socorro interface and is 
report bp-af78ec08-2cb7-44ea-96a6-94ef70171014.
=============================================================

There are 13 crashes in nightly 58 starting with buildid 20171013100112. In analyzing the backtrace, the regression may have been introdcued by patch [1] to fix bug 1403539.

[1] https://hg.mozilla.org/mozilla-central/rev?node=b3dddc032e3d4f11e80ca03d6fc15e611ef95c26
Flags: needinfo?(vliu)
Whiteboard: [clouseau] → [wr-mvp] [triage] [clouseau]
(Assignee)

Comment 1

a year ago
From looked into the problem, it seems that I am not well to deal with the chunk range for dealloc Shmem when AllocChunk() fails. I will try to attach a patch to fix it.


[1]: http://searchfox.org/mozilla-central/rev/423b2522c48e1d654e30ffc337164d677f934ec3/gfx/layers/wr/IpcResourceUpdateQueue.cpp#51
Assignee: nobody → vliu
(Assignee)

Updated

a year ago
Blocks: 1386665
Flags: needinfo?(vliu)
Status: NEW → ASSIGNED
Priority: -- → P1
Whiteboard: [wr-mvp] [triage] [clouseau] → [wr-reserve] [clouseau]
Crash Signature: [@ InvalidArrayIndex_CRASH | nsTArray_Impl<T>::operator[] | mozilla::wr::ShmSegmentsWriter::Write] [@ InvalidArrayIndex_CRASH | nsTArray_Impl<T>::ElementAt | mozilla::wr::ShmSegmentsWriter::Write ] → [@ InvalidArrayIndex_CRASH | nsTArray_Impl<T>::operator[] | mozilla::wr::ShmSegmentsWriter::Write] [@ InvalidArrayIndex_CRASH | nsTArray_Impl<T>::ElementAt | mozilla::wr::ShmSegmentsWriter::Write ] [@ InvalidArrayIndex_CRASH | mozilla::wr::ShmSegmentsWr…
Blocks: 1357819
(Assignee)

Comment 2

a year ago
Created attachment 8924797 [details] [diff] [review]
0001-Bug-1413651-Correct-the-chunk-range-to-dealloc-shmem.patch

Hi nical,
It seems that I am not well to define the number of chunks to dealloc shmem once it had a fail return from AllocChunk() in a Write() call. I think it is the reason to cause this crash. Could you please have review for the patch? Thanks
Attachment #8924797 - Flags: review?(nical.bugzilla)
(Assignee)

Updated

a year ago
Blocks: 1388995
Attachment #8924797 - Flags: review?(nical.bugzilla) → review+

Comment 4

a year ago
Pushed by vliu@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/a84fff04d938
Correct the chunk range to dealloc shmem when AllocChunk() fails to return. r=nical
https://hg.mozilla.org/mozilla-central/rev/a84fff04d938
Status: ASSIGNED → RESOLVED
Last Resolved: a year ago
status-firefox58: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla58
Not sure if it's the same root cause, but I got that crash yesterday, on current nightly: https://crash-stats.mozilla.com/report/index/3473914e-9b08-4dcd-a1ed-065ae0180220
Flags: needinfo?(vincent.liu1013)
Flags: needinfo?(nical.bugzilla)
Flags: needinfo?(cdenizet)
(Reporter)

Comment 7

9 months ago
:gerard-majax, you should open a new bug.
Flags: needinfo?(cdenizet)
Right, filed it: https://bugzilla.mozilla.org/show_bug.cgi?id=1439525
Flags: needinfo?(vincent.liu1013)
Flags: needinfo?(nical.bugzilla)
You need to log in before you can comment on or make changes to this bug.