Crash in InvalidArrayIndex_CRASH | mozilla::gfx::VRSystemManagerOpenVR::HandleAxisMove

RESOLVED FIXED in Firefox 59

Status

()

defect
--
critical
RESOLVED FIXED
2 years ago
a year ago

People

(Reporter: calixte, Assigned: daoshengmu)

Tracking

(Blocks 1 bug, {crash, regression})

59 Branch
mozilla59
Unspecified
Windows 10
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox-esr52 unaffected, firefox57 unaffected, firefox58 unaffected, firefox59 fixed)

Details

(Whiteboard: [clouseau], crash signature)

Attachments

(1 attachment)

(Reporter)

Description

2 years ago
This bug was filed from the Socorro interface and is
report bp-a34591ed-09cc-4617-8ce3-c3dff0171208.
=============================================================

Top 10 frames of crashing thread:

0 mozglue.dll MOZ_CrashPrintf mfbt/Assertions.cpp:63
1 xul.dll InvalidArrayIndex_CRASH xpcom/ds/nsTArray.cpp:26
2 xul.dll mozilla::gfx::VRSystemManagerOpenVR::HandleAxisMove gfx/vr/gfxVROpenVR.cpp:979
3 xul.dll mozilla::gfx::VRSystemManagerOpenVR::HandleInput gfx/vr/gfxVROpenVR.cpp:778
4 xul.dll mozilla::gfx::VRSystemManager::NotifyVSync gfx/vr/gfxVR.cpp:57
5 xul.dll mozilla::gfx::VRSystemManagerOpenVR::NotifyVSync gfx/vr/gfxVROpenVR.cpp:630
6 xul.dll mozilla::gfx::VRManager::NotifyVsync gfx/vr/VRManager.cpp:208
7 xul.dll mozilla::detail::RunnableMethodImpl<mozilla::layers::CompositorVsyncScheduler*, void  xpcom/threads/nsThreadUtils.h:1192
8 xul.dll MessageLoop::DoWork ipc/chromium/src/base/message_loop.cc:535
9 xul.dll base::MessagePumpDefault::Run ipc/chromium/src/base/message_pump_default.cc:36

=============================================================

There is 1 crash in nightly 59 with buildid 20171206100053. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1407423.

[1] https://hg.mozilla.org/mozilla-central/rev/4cee79cb6c23
Flags: needinfo?(kgilbert)
(Assignee)

Comment 1

2 years ago
It probably happens after some works for Windows MR input mapping at Bug 1419344.
(Assignee)

Comment 2

2 years ago
(In reply to Daosheng Mu[:daoshengmu] from comment #1)
> It probably happens after some works for Windows MR input mapping at Bug
> 1419344.

No idea for now, because we would at least have two axes for our current support controllers. We can add some condition for that, but I am curious if we have a wrong order for calling ScanForControllers() and HandleInput().
(Assignee)

Comment 3

2 years ago
It looks like we meet a strange Windows MR device that has different amount of axes because HTC Vive only has two axes as I mentioned at Bug 1346149 Comment 2. I don't have this kind of device currently, we can add some conditions to avoid this crash, but it could be more likely a bug from "Windows Mixed Reality for SteamVR" if there is no controller on the market only with two axes.
Assignee: nobody → dmu
(Assignee)

Comment 4

2 years ago
Following to Comment 3, "MOZ_CRASH Reason ElementAt(aIndex = 2, aLength = 2)" means this controller wants to access the 3rd item of mAxisMove[] but only has 2 axes.
Comment hidden (mozreview-request)
Comment hidden (mozreview-request)

Comment 8

a year ago
mozreview-review
Comment on attachment 8936420 [details]
Bug 1424378 - Switch off Windows MR mode when the amount of button or axes is less than our expectation;

https://reviewboard.mozilla.org/r/207130/#review215564

LGTM, Thanks!
Attachment #8936420 - Flags: review?(kgilbert) → review+
Flags: needinfo?(kgilbert)

Comment 9

a year ago
Pushed by dmu@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/31f01aea938a
Switch off Windows MR mode when the amount of button or axes is less than our expectation; r=kip

Comment 10

a year ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/31f01aea938a
Status: NEW → RESOLVED
Last Resolved: a year ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla59
You need to log in before you can comment on or make changes to this bug.