1424378 - Crash in InvalidArrayIndex_CRASH | mozilla::gfx::VRSystemManagerOpenVR::HandleAxisMove

Status: RESOLVED FIXED

(Core :: WebVR, defect)

Description

[Calixte Denizet (:calixte)]

This bug was filed from the Socorro interface and is
report bp-a34591ed-09cc-4617-8ce3-c3dff0171208.
=============================================================

Top 10 frames of crashing thread:

0 mozglue.dll MOZ_CrashPrintf mfbt/Assertions.cpp:63
1 xul.dll InvalidArrayIndex_CRASH xpcom/ds/nsTArray.cpp:26
2 xul.dll mozilla::gfx::VRSystemManagerOpenVR::HandleAxisMove gfx/vr/gfxVROpenVR.cpp:979
3 xul.dll mozilla::gfx::VRSystemManagerOpenVR::HandleInput gfx/vr/gfxVROpenVR.cpp:778
4 xul.dll mozilla::gfx::VRSystemManager::NotifyVSync gfx/vr/gfxVR.cpp:57
5 xul.dll mozilla::gfx::VRSystemManagerOpenVR::NotifyVSync gfx/vr/gfxVROpenVR.cpp:630
6 xul.dll mozilla::gfx::VRManager::NotifyVsync gfx/vr/VRManager.cpp:208
7 xul.dll mozilla::detail::RunnableMethodImpl<mozilla::layers::CompositorVsyncScheduler*, void  xpcom/threads/nsThreadUtils.h:1192
8 xul.dll MessageLoop::DoWork ipc/chromium/src/base/message_loop.cc:535
9 xul.dll base::MessagePumpDefault::Run ipc/chromium/src/base/message_pump_default.cc:36

=============================================================

There is 1 crash in nightly 59 with buildid 20171206100053. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1407423.

[1] https://hg.mozilla.org/mozilla-central/rev/4cee79cb6c23

Comment 1

[Daosheng Mu[:daoshengmu]]

It probably happens after some works for Windows MR input mapping at Bug 1419344.

Comment 2

[Daosheng Mu[:daoshengmu]]

(In reply to Daosheng Mu[:daoshengmu] from comment #1)
> It probably happens after some works for Windows MR input mapping at Bug
> 1419344.

No idea for now, because we would at least have two axes for our current support controllers. We can add some condition for that, but I am curious if we have a wrong order for calling ScanForControllers() and HandleInput().

Comment 3

[Daosheng Mu[:daoshengmu]]

It looks like we meet a strange Windows MR device that has different amount of axes because HTC Vive only has two axes as I mentioned at Bug 1346149 Comment 2. I don't have this kind of device currently, we can add some conditions to avoid this crash, but it could be more likely a bug from "Windows Mixed Reality for SteamVR" if there is no controller on the market only with two axes.

Comment 4

[Daosheng Mu[:daoshengmu]]

Following to Comment 3, "MOZ_CRASH Reason ElementAt(aIndex = 2, aLength = 2)" means this controller wants to access the 3rd item of mAxisMove[] but only has 2 axes.

Comment 5

[Daosheng Mu[:daoshengmu]]

Attachment: Bug 1424378 - Switch off Windows MR mode when the amount of button or axes is less than our expectation;

Review commit: https://reviewboard.mozilla.org/r/207130/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/207130/

Comment 6

[Daosheng Mu[:daoshengmu]]

Comment on attachment 8936420 [details]
Bug 1424378 - Switch off Windows MR mode when the amount of button or axes is less than our expectation;

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/207130/diff/1-2/

Comment 7

[Daosheng Mu[:daoshengmu]]

Comment on attachment 8936420 [details]
Bug 1424378 - Switch off Windows MR mode when the amount of button or axes is less than our expectation;

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/207130/diff/2-3/

Comment 8

[:kip (Kearwood Gilbert)]

Comment on attachment 8936420 [details]
Bug 1424378 - Switch off Windows MR mode when the amount of button or axes is less than our expectation;

https://reviewboard.mozilla.org/r/207130/#review215564

LGTM, Thanks!

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/31f01aea938a
Switch off Windows MR mode when the amount of button or axes is less than our expectation; r=kip

Comment 10

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/31f01aea938a