1488573 - Crash in InvalidArrayIndex_CRASH | mozilla::dom::Gamepad::SetButton

Status: RESOLVED FIXED

(Core :: WebVR, defect)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is
report bp-7eccc212-e975-4e45-8344-9e1690180904.
=============================================================

Seen while looking at nightly crash stats: https://bit.ly/2ClfYBi. Crashes occur on 63 Nightly and 61. Fairly low volume, but all of the crashes are unique users crashing.

Top 10 frames of crashing thread:

0 mozglue.dll MOZ_CrashPrintf mfbt/Assertions.cpp:67
1 xul.dll InvalidArrayIndex_CRASH xpcom/ds/nsTArray.cpp:26
2 xul.dll void mozilla::dom::Gamepad::SetButton dom/gamepad/Gamepad.cpp:89
3 xul.dll bool mozilla::dom::GamepadManager::SetGamepadByEvent dom/gamepad/GamepadManager.cpp:613
4 xul.dll mozilla::dom::GamepadManager::Update dom/gamepad/GamepadManager.cpp:539
5 xul.dll mozilla::gfx::VRManagerChild::RecvGamepadUpdate gfx/vr/ipc/VRManagerChild.cpp:380
6 xul.dll mozilla::gfx::PVRManagerChild::OnMessageReceived ipc/ipdl/PVRManagerChild.cpp:737
7 xul.dll void mozilla::ipc::MessageChannel::DispatchMessageW ipc/glue/MessageChannel.cpp:2175
8 xul.dll mozilla::ipc::MessageChannel::MessageTask::Run ipc/glue/MessageChannel.cpp:2045
9 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1161

=============================================================

Comment 1

[Daosheng Mu[:daoshengmu]]

I will investigate it.

Comment 2

[Daosheng Mu[:daoshengmu]]

It looks like OpenVR supported button bit is not very reliable during runtime. I am thinking to remove the current controller and add it again if the button/axis amount is not the same.

Comment 3

[Daosheng Mu[:daoshengmu]]

Attachment: Bug 1488573 - Part 1: Add crash log for VR controllers have unmatched button/axis count.

MozReview-Commit-ID: FeZumVvAKGE

Comment 4

[Daosheng Mu[:daoshengmu]]

Attachment: Bug 1488573 - Part 2: Checking OpenVR btn/axis count at runtime to avoid array overflow.

MozReview-Commit-ID: DbTsVyrgGfO

Comment 5

[Daosheng Mu[:daoshengmu]]

Attachment: Bug 1488573 - Part 1: Add crash log for VR controllers have unmatched button/axis count.

MozReview-Commit-ID: 8F3cDiZJ7ef

Comment 6

[Daosheng Mu[:daoshengmu]]

Attachment: Bug 1488573 - Part 2: Checking OpenVR btn/axis count at runtime to avoid array overflow.

MozReview-Commit-ID: 5KgcuAcKCmO

Comment 7

[Daosheng Mu[:daoshengmu]]

Unfortunately, I can't reproduce it in local. I am wondering if it is from SteamVR Knuckles that we haven't fully support. Lets' add logs for the following debug.

Comment 8

[Daosheng Mu[:daoshengmu]]

Attachment: Bug 1488573 - Part 1: Add crash log for VR controllers have unmatched button/axis count.

MozReview-Commit-ID: 8F3cDiZJ7ef

Comment 9

[:kip (Kearwood Gilbert)]

Comment on attachment 9011881 [details]
Bug 1488573 - Part 1: Add crash log for VR controllers have unmatched button/axis count.

:kip (Kearwood Gilbert) has approved the revision.

Comment 10

[:kip (Kearwood Gilbert)]

Comment on attachment 9011658 [details]
Bug 1488573 - Part 2: Checking OpenVR btn/axis count at runtime to avoid array overflow.

:kip (Kearwood Gilbert) has approved the revision.

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/79c6c2a605df
Part 1: Add crash log for VR controllers have unmatched button/axis count. r=kip

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/3c9a3c9a4810
Part 2: Checking OpenVR btn/axis count at runtime to avoid array overflow. r=kip

Comment 13

[Arthur Iakab [arthur_iakab]]

https://hg.mozilla.org/mozilla-central/rev/79c6c2a605df
https://hg.mozilla.org/mozilla-central/rev/3c9a3c9a4810

Comment 14

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/mozilla-central/rev/48cc597db296
Fix merge conflict with inbound. r=me a=ebalazs

Comment 15

[Pascal Chevrel:pascalc (PTO until April 26)]

Daosheng, is this worth backporting to Beta?

Comment 16

[Daosheng Mu[:daoshengmu]]

It could be, but I would like to wait to see if there is any other new reports after it landed.

Comment 17

[Pascal Chevrel:pascalc (PTO until April 26)]

Last nightly build crashing was 20180922100157

Comment 18

[Daosheng Mu[:daoshengmu]]

Comment on attachment 9011881 [details]
Bug 1488573 - Part 1: Add crash log for VR controllers have unmatched button/axis count.

[Beta/Release Uplift Approval Request]

Feature/Bug causing the regression: Bug 1488573

User impact if declined: Crashes on Bug 1488573 will still happen.

Is this code covered by automated tests?: No

Has the fix been verified in Nightly?: Yes

Needs manual test from QE?: No

If yes, steps to reproduce: 

List of other uplifts needed: None

Risk to taking this patch: Low

Why is the change risky/not risky? (and alternatives if risky): It has been no crashes in Nightly.

String changes made/needed:

Comment 19

[Daosheng Mu[:daoshengmu]]

Comment on attachment 9011658 [details]
Bug 1488573 - Part 2: Checking OpenVR btn/axis count at runtime to avoid array overflow.

[Beta/Release Uplift Approval Request]

Feature/Bug causing the regression: Bug 1488573

User impact if declined: Crashes on Bug 1488573 will still happen.

Is this code covered by automated tests?: No

Has the fix been verified in Nightly?: Yes

Needs manual test from QE?: No

If yes, steps to reproduce: 

List of other uplifts needed: None

Risk to taking this patch: Low

Why is the change risky/not risky? (and alternatives if risky): No more crashes and regression for a while in Nightly.

String changes made/needed:

Comment 20

[Pascal Chevrel:pascalc (PTO until April 26)]

Comment on attachment 9011658 [details]
Bug 1488573 - Part 2: Checking OpenVR btn/axis count at runtime to avoid array overflow.

Crash fix, uplift approved for 63 beta 13, thanks.

Comment 21

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/releases/mozilla-beta/rev/90aae1fda366
https://hg.mozilla.org/releases/mozilla-beta/rev/3c7440cdf2d5