Closed Bug 1428184 Opened 2 years ago Closed 2 years ago

Crash in InvalidArrayIndex_CRASH | nsTArray_Impl<T>::ElementAt | mozilla::detail::RunnableFunction<T>::Run

Categories

(Core :: Audio/Video: Playback, defect, P2, critical)

Unspecified
Android
defect

Tracking

()

RESOLVED FIXED
mozilla59
Tracking Status
firefox-esr52 --- unaffected
firefox57 --- unaffected
firefox58 --- unaffected
firefox59 --- fixed

People

(Reporter: mccr8, Assigned: jwwang)

References

Details

(Keywords: crash, regression)

Crash Data

Attachments

(1 file)

This bug was filed from the Socorro interface and is
report bp-475f6182-0ca4-4f4a-ac00-40e830180104.
=============================================================

Top 10 frames of crashing thread:

0 libmozglue.so MOZ_CrashPrintf mfbt/Assertions.cpp:63
1 libxul.so InvalidArrayIndex_CRASH xpcom/ds/nsTArray.cpp:26
2 libxul.so nsTArray_Impl<BloatEntry*, nsTArrayInfallibleAllocator>::ElementAt 
3 libxul.so mozilla::detail::RunnableFunction<>::Run xpcom/ds/ArrayIterator.h:86
4 libxul.so nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1040
5 libxul.so NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:510
6 libxul.so mozilla::ipc::MessagePumpForNonMainThreads::Run ipc/glue/MessagePump.cpp:364
7 libxul.so MessageLoop::Run ipc/chromium/src/base/message_loop.cc:326
8 libxul.so nsThread::ThreadFunc xpcom/threads/nsThread.cpp:423
9 libnss3.so _pt_root nsprpub/pr/src/pthreads/ptthread.c:201

=============================================================

I see 16 crashes from 17 installations, all on Android Nightly, which is fairly frequent for Android Nightly. This seems to have started on the 20180103230310 build, so maybe it is just a signature change? Judging from the line numbers for the runnable in the stack, this might be related to MediaCache::CloseStreamsForPrivateBrowsing().
Any ideas, JW? Thanks.
Flags: needinfo?(jwwang)
It looks like this is on all platforms. I can see a similar signature on Windows and OSX.

At least one of these also looks like it is for MediaCache::CloseStreamsForPrivateBrowsing():
  bp-df9deb17-8d71-4723-b745-70d330180104
Crash Signature: [@ InvalidArrayIndex_CRASH | nsTArray_Impl<T>::ElementAt | mozilla::detail::RunnableFunction<T>::Run] → [@ InvalidArrayIndex_CRASH | nsTArray_Impl<T>::ElementAt | mozilla::detail::RunnableFunction<T>::Run] [@ InvalidArrayIndex_CRASH | mozilla::detail::RunnableFunction<T>::Run ]
Duplicate of this bug: 1428187
Component: Audio/Video → Audio/Video: Playback
Priority: -- → P2
A regression from bug 1427667.
Blocks: 1427667
Flags: needinfo?(jwwang)
Keywords: regression
Attachment #8940056 - Flags: review?(gsquelart)
Attachment #8940056 - Flags: review?(bechen)
Comment on attachment 8940056 [details]
Bug 1428184 - copy mStreams before iterating the array.

https://reviewboard.mozilla.org/r/210334/#review216054
Attachment #8940056 - Flags: review?(bechen) → review+
Comment on attachment 8940056 [details]
Bug 1428184 - copy mStreams before iterating the array.

https://reviewboard.mozilla.org/r/210334/#review216056
Attachment #8940056 - Flags: review?(gsquelart) → review+
Thanks for the instant review!
Pushed by jwwang@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/1f394da377b0
copy mStreams before iterating the array. r=bechen,gerald
https://hg.mozilla.org/mozilla-central/rev/1f394da377b0
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla59
Assignee: nobody → jwwang
You need to log in before you can comment on or make changes to this bug.