Crash in InvalidArrayIndex_CRASH | mozilla::gfx::VRSystemManagerOpenVR::HandleAxisMove

RESOLVED FIXED in Firefox 59



a year ago
a year ago


(Reporter: calixte, Assigned: daoshengmu)


(Blocks: 1 bug, {crash, regression})

59 Branch
Windows 10
crash, regression
Dependency tree / graph

Firefox Tracking Flags

(firefox-esr52 unaffected, firefox57 unaffected, firefox58 unaffected, firefox59 fixed)


(Whiteboard: [clouseau], crash signature)


(1 attachment)



a year ago
This bug was filed from the Socorro interface and is
report bp-a34591ed-09cc-4617-8ce3-c3dff0171208.

Top 10 frames of crashing thread:

0 mozglue.dll MOZ_CrashPrintf mfbt/Assertions.cpp:63
1 xul.dll InvalidArrayIndex_CRASH xpcom/ds/nsTArray.cpp:26
2 xul.dll mozilla::gfx::VRSystemManagerOpenVR::HandleAxisMove gfx/vr/gfxVROpenVR.cpp:979
3 xul.dll mozilla::gfx::VRSystemManagerOpenVR::HandleInput gfx/vr/gfxVROpenVR.cpp:778
4 xul.dll mozilla::gfx::VRSystemManager::NotifyVSync gfx/vr/gfxVR.cpp:57
5 xul.dll mozilla::gfx::VRSystemManagerOpenVR::NotifyVSync gfx/vr/gfxVROpenVR.cpp:630
6 xul.dll mozilla::gfx::VRManager::NotifyVsync gfx/vr/VRManager.cpp:208
7 xul.dll mozilla::detail::RunnableMethodImpl<mozilla::layers::CompositorVsyncScheduler*, void  xpcom/threads/nsThreadUtils.h:1192
8 xul.dll MessageLoop::DoWork ipc/chromium/src/base/
9 xul.dll base::MessagePumpDefault::Run ipc/chromium/src/base/


There is 1 crash in nightly 59 with buildid 20171206100053. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1407423.

Flags: needinfo?(kgilbert)

Comment 1

a year ago
It probably happens after some works for Windows MR input mapping at Bug 1419344.

Comment 2

a year ago
(In reply to Daosheng Mu[:daoshengmu] from comment #1)
> It probably happens after some works for Windows MR input mapping at Bug
> 1419344.

No idea for now, because we would at least have two axes for our current support controllers. We can add some condition for that, but I am curious if we have a wrong order for calling ScanForControllers() and HandleInput().

Comment 3

a year ago
It looks like we meet a strange Windows MR device that has different amount of axes because HTC Vive only has two axes as I mentioned at Bug 1346149 Comment 2. I don't have this kind of device currently, we can add some conditions to avoid this crash, but it could be more likely a bug from "Windows Mixed Reality for SteamVR" if there is no controller on the market only with two axes.
Assignee: nobody → dmu

Comment 4

a year ago
Following to Comment 3, "MOZ_CRASH Reason ElementAt(aIndex = 2, aLength = 2)" means this controller wants to access the 3rd item of mAxisMove[] but only has 2 axes.
Comment hidden (mozreview-request)
Comment hidden (mozreview-request)
Comment hidden (mozreview-request)

Comment 8

a year ago
Comment on attachment 8936420 [details]
Bug 1424378 - Switch off Windows MR mode when the amount of button or axes is less than our expectation;

LGTM, Thanks!
Attachment #8936420 - Flags: review?(kgilbert) → review+
Flags: needinfo?(kgilbert)

Comment 9

a year ago
Pushed by
Switch off Windows MR mode when the amount of button or axes is less than our expectation; r=kip

Comment 10

a year ago
Last Resolved: a year ago
status-firefox59: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla59
You need to log in before you can comment on or make changes to this bug.