1594850 - Crash in [@ InvalidArrayIndex_CRASH | nsSHistory::EnsureCorrectEntryAtCurrIndex]

Status: RESOLVED FIXED

(Core :: DOM: Navigation, defect, P2)

Description

[Marcia Knous [:marcia]]

This bug is for crash report bp-86cdd459-79f4-4931-a9c3-c27d30191107.

Seen while looking at nightly crash stats: https://bit.ly/2NuqnON. macOS crash which started in 20191106215426.

Possible regression range based on build id: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=4d585c7edc7683e4b35eca6b18c9a646a1b8a78d&tochange=96b58f95ed7333672e6dba134d091015328d299b

Bug 1546761 touched code in this area. ni on :annyg

Top 10 frames of crashing thread:

0 xul.dll InvalidArrayIndex_CRASH xpcom/ds/nsTArray.cpp:27
1 xul.dll void nsSHistory::EnsureCorrectEntryAtCurrIndex docshell/shistory/nsSHistory.cpp:1388
2 xul.dll bool nsDocShell::OnNewURI docshell/base/nsDocShell.cpp:10812
3 xul.dll bool nsDocShell::OnLoadingSite docshell/base/nsDocShell.cpp:10866
4 xul.dll nsresult nsDocShell::CreateContentViewer docshell/base/nsDocShell.cpp:7916
5 xul.dll nsresult nsDSURIContentListener::DoContent docshell/base/nsDSURIContentListener.cpp:183
6 xul.dll bool nsDocumentOpenInfo::TryContentListener uriloader/base/nsURILoader.cpp:740
7 xul.dll nsresult nsDocumentOpenInfo::DispatchContent uriloader/base/nsURILoader.cpp:413
8 xul.dll nsresult nsDocumentOpenInfo::OnStartRequest uriloader/base/nsURILoader.cpp:292
9 xul.dll void mozilla::net::HttpChannelChild::DoOnStartRequest netwerk/protocol/http/HttpChannelChild.cpp:682

Comment 1

[Andrew McCreight (out until 2026) [:mccr8]]

The crash reason for these crashes is
ElementAt(aIndex = 18446744073709551615, aLength = 0)

Looks like 18446744073709551615 is -1, so in a debug build we'd fail the assertion on the previous line, MOZ_ASSERT(mIndex > -1);

Comment 2

[Tyson Smith [:tsmith]]

Attachment: testcase.html

This test seems to fairly reliably reproduce the crash when served from a webserver.

Please let me know if a Pernosco session would be helpful and I will create one.

Comment 3

[Tyson Smith [:tsmith]]

Attachment: prefs.js

Required to repro with attached test case.

Comment 4

[Peter Van der Beken [:peterv]]

Before bug 1546761 we would bail out in ReplaceEntry because index is < 0. We could put back that check in nsSHistory::EnsureCorrectEntryAtCurrIndex, but I'd like to understand why we have a -1 here. (The original code is from bug 1322896)

Comment 5

[Peter Van der Beken [:peterv]]

(In reply to Tyson Smith [:tsmith] from comment #2)

Please let me know if a Pernosco session would be helpful and I will create one.

I think that'd be useful, because this seems to require some fuzzing setup.

Comment 6

[Anny Gakhokidze [:annyG]]

Attachment: Bug 1594850 - Part 1 - Fix crash in nsSHistory::EnsureCorrectEntryAtCurrIndex when mIndex=-1, r=peterv

Comment 7

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/nCFSls7ZcIz6eQOvqGEzLA/index.html

It will expire in 7 days.

Comment 8

[Peter Van der Beken [:peterv]]

Thanks for the recording. The reason this happens is because the pref browser.sessionhistory.max_entries is set to 0. That causes nsSHistory::PurgeHistory to be called when we add an entry, and that sets mRequestedIndex and mIndex to -1. We should add a test that sets browser.sessionhistory.max_entries to 0 and then navigates a bit.

Comment 9

[Andrew Overholt [:overholt]]

Given Anny's working on this, I'll go with P2.

Comment 10

[Anny Gakhokidze [:annyG]]

Attachment: Bug 1594850 - Part 2 - Write a test for gHistoryMaxSize in nsSHistory being set to 0 and mIndex and mRequestedIndex=-1, r=peterv

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/3af47ccb969a
Part 1 - Fix crash in nsSHistory::EnsureCorrectEntryAtCurrIndex when mIndex=-1, r=peterv
https://hg.mozilla.org/integration/autoland/rev/11ce58dd1902
Part 2 - Write a test for gHistoryMaxSize in nsSHistory being set to 0 and mIndex and mRequestedIndex=-1, r=peterv

Comment 12

[Arthur Iakab [arthur_iakab]]

https://hg.mozilla.org/mozilla-central/rev/3af47ccb969a
https://hg.mozilla.org/mozilla-central/rev/11ce58dd1902