1460282 - Crash in InvalidArrayIndex_CRASH | nsTArray_Impl<T>::ElementAt | mozilla::EventStateManager::IsEventOutsideDragThreshold

Status: VERIFIED FIXED

(Core :: DOM: Events, defect, P2)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is
report bp-2938d174-ead0-438a-8efb-07b7e0180509.
=============================================================

Seen while looking at nightly mobile crashes - crashes started using 20180508231749: https://bit.ly/2wpQ1xn. 31 crashes/25 installs so far.

Possible regression range based on build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=fb435df9797a471419670fe2d053432556959a9d&tochange=0cd106a2eb78aa04fd481785257e6f4f9b94707b

Bug 1456322 is in the range. ni on :cpearce

Top 10 frames of crashing thread:

0 libmozglue.so MOZ_CrashPrintf mfbt/Assertions.cpp:63
1 libxul.so InvalidArrayIndex_CRASH xpcom/ds/nsTArray.cpp:26
2 libxul.so nsTArray_Impl<BloatEntry*, nsTArrayInfallibleAllocator>::ElementAt 
3 libxul.so mozilla::EventStateManager::IsEventOutsideDragThreshold xpcom/ds/nsTArray.h:1067
4 libxul.so mozilla::EventStateManager::NotifyTargetUserActivation dom/events/EventStateManager.cpp:969
5 libxul.so mozilla::EventStateManager::PreHandleEvent dom/events/EventStateManager.cpp
6 libxul.so mozilla::PresShell::HandleEventInternal layout/base/PresShell.cpp:7642
7 libxul.so mozilla::PresShell::HandleEvent layout/base/PresShell.cpp:7287
8 libxul.so mozilla::PresShell::HandleEvent layout/base/PresShell.cpp:6903
9 libxul.so nsViewManager::DispatchEvent view/nsViewManager.cpp:812

=============================================================

Comment 1

[Chris Pearce [:cpearce (Not reading bugmail)]]

Attachment: Bug 1460282 - Handle touch events with no touches in ESM::IsEventOutsideDragThreshold().

This fixes a bounds check assertion on the array access into the touch event's
touch list.

I don't know why we have a touch event with no touches. Maybe it's an internal
touch event?

Review commit: https://reviewboard.mozilla.org/r/242916/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/242916/

Comment 2

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Comment on attachment 8974575 [details]
Bug 1460282 - Handle touch events with no touches in ESM::IsEventOutsideDragThreshold().

https://reviewboard.mozilla.org/r/242916/#review248816

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4a5d5e1d4240
Handle touch events with no touches in ESM::IsEventOutsideDragThreshold(). r=masayuki

Comment 4

[Dorel Luca [:dluca]]

https://hg.mozilla.org/mozilla-central/rev/4a5d5e1d4240

Comment 5

[Calixte Denizet (:calixte)]

No more crashes since the patch landed.