1579492 - Crash in [@ (anonymous namespace)::DarwinGamepadService::ReportChangedCallback]

Status: RESOLVED FIXED

(Core :: DOM: Device Interfaces, defect)

Description

[Marcia Knous [:marcia]]

This bug is for crash report bp-5b0b7d03-9e77-4272-a82b-0f4900190906.

Seen while looking at nightly crash stats: https://bit.ly/2kyGTkR. Crashes started in 70 beta. Code was touched in Bug 1523353 in the 70 timeframe. One URL that is crashing is https://html5gamepad.com/.

ni on dmu

Top 10 frames of crashing thread:

0 XUL  dom/gamepad/cocoa/CocoaGamepad.cpp:343
1 IOKit __IOHIDDeviceInputReportApplier 
2 CoreFoundation __CFBasicHashIncSlotCount 
3 CoreFoundation -[CFPrefsSource alreadylocked_copyDictionary] 
4 CoreFoundation __CFBasicHashIncSlotCount 
5 IOKit __IOHIDDeviceInputReportWithTimeStampCallback 
6 IOHIDLib IOHIDLib@0x5135 
7 CoreFoundation __CFRunLoopDoSource1 
8 CoreFoundation __CFRunLoopDoSource1 
9 CoreFoundation __CFRunLoopDoSource1 

Comment 1

[Daosheng Mu[:daoshengmu]]

Attachment: Bug 1579492 - Check if nullptr in DarwinGamepadService::ReportChangedCallback().

Comment 2

[Daosheng Mu[:daoshengmu]]

Sending a patch r?

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/3792d6634145
Check if nullptr in DarwinGamepadService::ReportChangedCallback(). r=baku

Comment 4

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/mozilla-central/rev/3792d6634145

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Please nominate this for Beta approval when you get a chance.

Comment 6

[Daosheng Mu[:daoshengmu]]

Comment on attachment 9091273 [details]
Bug 1579492 - Check if nullptr in DarwinGamepadService::ReportChangedCallback().

Beta/Release Uplift Approval Request

• User impact if declined: The crash will continue to happen when using Gamepad on Mac OS.
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): It just adds a nullptr check to avoid access 0x0 address.
• String changes made/needed:

Comment 7

[Liz Henry (:lizzard) (relman/hg->git project)]

Comment on attachment 9091273 [details]
Bug 1579492 - Check if nullptr in DarwinGamepadService::ReportChangedCallback().

Fix for a new Mac crash in 70, let's uplift for beta 7.

Comment 8

[Andrei Ciure[:aciure]]

https://hg.mozilla.org/releases/mozilla-beta/rev/f54c0cf514bf

Comment 9

[Cristian Fogel [:cfogel]]

Clearing the QE+ flag since with our devices, we are unable to reproduce the crash.

Comment 10

[[:philipp]]

we still see crash reports from beta builds containing the uplifted patch:
https://crash-stats.mozilla.org/signature/?build_id=%3E%3D20190916074538&product=Firefox&signature=%28anonymous%20namespace%29%3A%3ADarwinGamepadService%3A%3AReportChangedCallback#reports

Comment 11

[Daosheng Mu[:daoshengmu]]

I think the original fix is unharmful and makes it more safe.

I do not have clear STR to reproduce it so far. Currently, I only can suspect it is because we didn't unregister IOHIDDeviceRegisterInputReportCallback [1] while DeviceRemoved().

[1] https://stackoverflow.com/questions/38149072/how-do-i-unregister-an-iokit-hid-callback

Comment 12

[Szmozsánszky István [:flaki]]

https://crash-stats.mozilla.org/report/index/32a9e84a-86ff-4ddd-81ba-351a00191205 points to this signature (from Firefox Dev Edition 72).

The problem surfaced live on-stage, crashing the browser, Wei referred to it as "when I try to use my Joycon controllers from separate tabs, it pretty consistently crashes Firefox". She was using the Joycon controllers (connecting over Bluetooth) to control a slide deck in one tab, and wanted to showcase further opportunities for querying the gamepads with a second tab.
https://twitter.com/reknowledgeable/status/1202583937647689728

Comment 13

[Daosheng Mu[:daoshengmu]]

Attachment: Bug 1579492 - Unregister input report callback when removing Cocoa gamepads.

Comment 14

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/aca53f34817a
Unregister input report callback when removing Cocoa gamepads. r=baku

Comment 15

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/aca53f34817a

Comment 16

[BugBot [:suhaib / :marco/ :calixte]]

Change the status for beta to have the same as nightly and release.
For more information, please visit auto_nag documentation.