1428184 - Crash in InvalidArrayIndex_CRASH | nsTArray_Impl<T>::ElementAt | mozilla::detail::RunnableFunction<T>::Run

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect, P2)

Description

[Andrew McCreight [:mccr8]]

This bug was filed from the Socorro interface and is
report bp-475f6182-0ca4-4f4a-ac00-40e830180104.
=============================================================

Top 10 frames of crashing thread:

0 libmozglue.so MOZ_CrashPrintf mfbt/Assertions.cpp:63
1 libxul.so InvalidArrayIndex_CRASH xpcom/ds/nsTArray.cpp:26
2 libxul.so nsTArray_Impl<BloatEntry*, nsTArrayInfallibleAllocator>::ElementAt 
3 libxul.so mozilla::detail::RunnableFunction<>::Run xpcom/ds/ArrayIterator.h:86
4 libxul.so nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1040
5 libxul.so NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:510
6 libxul.so mozilla::ipc::MessagePumpForNonMainThreads::Run ipc/glue/MessagePump.cpp:364
7 libxul.so MessageLoop::Run ipc/chromium/src/base/message_loop.cc:326
8 libxul.so nsThread::ThreadFunc xpcom/threads/nsThread.cpp:423
9 libnss3.so _pt_root nsprpub/pr/src/pthreads/ptthread.c:201

=============================================================

I see 16 crashes from 17 installations, all on Android Nightly, which is fairly frequent for Android Nightly. This seems to have started on the 20180103230310 build, so maybe it is just a signature change? Judging from the line numbers for the runnable in the stack, this might be related to MediaCache::CloseStreamsForPrivateBrowsing().

Comment 1

[Andrew McCreight [:mccr8]]

Any ideas, JW? Thanks.

Comment 2

[Andrew McCreight [:mccr8]]

It looks like this is on all platforms. I can see a similar signature on Windows and OSX.

At least one of these also looks like it is for MediaCache::CloseStreamsForPrivateBrowsing():
  bp-df9deb17-8d71-4723-b745-70d330180104

Comment 4

[JW Wang [:jwwang] [:jw_wang]]

A regression from bug 1427667.

Comment 5

[JW Wang [:jwwang] [:jw_wang]]

Attachment: Bug 1428184 - copy mStreams before iterating the array.

It is bad to modify the array while iterating it.

Review commit: https://reviewboard.mozilla.org/r/210334/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/210334/

Comment 6

[Benjamin Chen [:bechen]]

Comment on attachment 8940056 [details]
Bug 1428184 - copy mStreams before iterating the array.

https://reviewboard.mozilla.org/r/210334/#review216054

Comment 7

[Gerald Squelart (he/him) (not at Mozilla since 2022-09-15)]

Comment on attachment 8940056 [details]
Bug 1428184 - copy mStreams before iterating the array.

https://reviewboard.mozilla.org/r/210334/#review216056

Comment 8

[JW Wang [:jwwang] [:jw_wang]]

Thanks for the instant review!

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1f394da377b0
copy mStreams before iterating the array. r=bechen,gerald

Comment 10

[Tiberius Oros[:tiberius_oros]]

https://hg.mozilla.org/mozilla-central/rev/1f394da377b0