Crash in InvalidArrayIndex_CRASH | mozilla::dom::Gamepad::SetButton

RESOLVED FIXED in Firefox 63

Status

()

defect
--
critical
RESOLVED FIXED
9 months ago
8 months ago

People

(Reporter: marcia, Assigned: daoshengmu)

Tracking

({crash, regression})

Trunk
mozilla64
Unspecified
Windows 10
Points:
---

Firefox Tracking Flags

(firefox-esr60 wontfix, firefox61 wontfix, firefox62 wontfix, firefox63 fixed, firefox64 fixed)

Details

(crash signature)

Attachments

(2 attachments, 3 obsolete attachments)

This bug was filed from the Socorro interface and is
report bp-7eccc212-e975-4e45-8344-9e1690180904.
=============================================================

Seen while looking at nightly crash stats: https://bit.ly/2ClfYBi. Crashes occur on 63 Nightly and 61. Fairly low volume, but all of the crashes are unique users crashing.

Top 10 frames of crashing thread:

0 mozglue.dll MOZ_CrashPrintf mfbt/Assertions.cpp:67
1 xul.dll InvalidArrayIndex_CRASH xpcom/ds/nsTArray.cpp:26
2 xul.dll void mozilla::dom::Gamepad::SetButton dom/gamepad/Gamepad.cpp:89
3 xul.dll bool mozilla::dom::GamepadManager::SetGamepadByEvent dom/gamepad/GamepadManager.cpp:613
4 xul.dll mozilla::dom::GamepadManager::Update dom/gamepad/GamepadManager.cpp:539
5 xul.dll mozilla::gfx::VRManagerChild::RecvGamepadUpdate gfx/vr/ipc/VRManagerChild.cpp:380
6 xul.dll mozilla::gfx::PVRManagerChild::OnMessageReceived ipc/ipdl/PVRManagerChild.cpp:737
7 xul.dll void mozilla::ipc::MessageChannel::DispatchMessageW ipc/glue/MessageChannel.cpp:2175
8 xul.dll mozilla::ipc::MessageChannel::MessageTask::Run ipc/glue/MessageChannel.cpp:2045
9 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1161

=============================================================
Component: Graphics → WebVR
Assignee

Comment 1

9 months ago
I will investigate it.
Assignee: nobody → dmu
Assignee

Comment 2

8 months ago
It looks like OpenVR supported button bit is not very reliable during runtime. I am thinking to remove the current controller and add it again if the button/axis amount is not the same.
Assignee

Comment 3

8 months ago
MozReview-Commit-ID: FeZumVvAKGE
Assignee

Comment 4

8 months ago
MozReview-Commit-ID: DbTsVyrgGfO
Assignee

Comment 5

8 months ago
MozReview-Commit-ID: 8F3cDiZJ7ef
Attachment #9011654 - Attachment is obsolete: true
Attachment #9011655 - Attachment is obsolete: true
Assignee

Comment 7

8 months ago
Unfortunately, I can't reproduce it in local. I am wondering if it is from SteamVR Knuckles that we haven't fully support. Lets' add logs for the following debug.
Attachment #9011657 - Attachment is obsolete: true
Comment on attachment 9011881 [details]
Bug 1488573 - Part 1: Add crash log for VR controllers have unmatched button/axis count.

:kip (Kearwood Gilbert) has approved the revision.
Attachment #9011881 - Flags: review+
Comment on attachment 9011658 [details]
Bug 1488573 - Part 2: Checking OpenVR btn/axis count at runtime to avoid array overflow.

:kip (Kearwood Gilbert) has approved the revision.
Attachment #9011658 - Flags: review+

Comment 11

8 months ago
Pushed by dmu@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/79c6c2a605df
Part 1: Add crash log for VR controllers have unmatched button/axis count. r=kip

Comment 12

8 months ago
Pushed by dmu@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/3c9a3c9a4810
Part 2: Checking OpenVR btn/axis count at runtime to avoid array overflow. r=kip

Comment 13

8 months ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/79c6c2a605df
https://hg.mozilla.org/mozilla-central/rev/3c9a3c9a4810
Status: NEW → RESOLVED
Last Resolved: 8 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla64

Comment 14

8 months ago
Pushed by emilio@crisal.io:
https://hg.mozilla.org/mozilla-central/rev/48cc597db296
Fix merge conflict with inbound. r=me a=ebalazs
Daosheng, is this worth backporting to Beta?
Flags: needinfo?(dmu)
Assignee

Comment 16

8 months ago
It could be, but I would like to wait to see if there is any other new reports after it landed.
Flags: needinfo?(dmu)
Last nightly build crashing was 20180922100157
Flags: needinfo?(dmu)
QA Contact: kgilbert
QA Contact: kgilbert
Assignee

Comment 18

8 months ago
Comment on attachment 9011881 [details]
Bug 1488573 - Part 1: Add crash log for VR controllers have unmatched button/axis count.

[Beta/Release Uplift Approval Request]

Feature/Bug causing the regression: Bug 1488573

User impact if declined: Crashes on Bug 1488573 will still happen.

Is this code covered by automated tests?: No

Has the fix been verified in Nightly?: Yes

Needs manual test from QE?: No

If yes, steps to reproduce: 

List of other uplifts needed: None

Risk to taking this patch: Low

Why is the change risky/not risky? (and alternatives if risky): It has been no crashes in Nightly.

String changes made/needed:
Flags: needinfo?(dmu)
Attachment #9011881 - Flags: approval-mozilla-beta?
Assignee

Comment 19

8 months ago
Comment on attachment 9011658 [details]
Bug 1488573 - Part 2: Checking OpenVR btn/axis count at runtime to avoid array overflow.

[Beta/Release Uplift Approval Request]

Feature/Bug causing the regression: Bug 1488573

User impact if declined: Crashes on Bug 1488573 will still happen.

Is this code covered by automated tests?: No

Has the fix been verified in Nightly?: Yes

Needs manual test from QE?: No

If yes, steps to reproduce: 

List of other uplifts needed: None

Risk to taking this patch: Low

Why is the change risky/not risky? (and alternatives if risky): No more crashes and regression for a while in Nightly.

String changes made/needed:
Attachment #9011658 - Flags: approval-mozilla-beta?
Comment on attachment 9011658 [details]
Bug 1488573 - Part 2: Checking OpenVR btn/axis count at runtime to avoid array overflow.

Crash fix, uplift approved for 63 beta 13, thanks.
Attachment #9011658 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
Attachment #9011881 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
You need to log in before you can comment on or make changes to this bug.