1759447 - Crash in [@ mozilla::detail::InvalidArrayIndex_CRASH | mozilla::InputTaskManager::DidRunTask]

Status: RESOLVED WORKSFORME

(Core :: XPCOM, defect)

Description

[Gabriele Svelto [:gsvelto]]

Crash report: https://crash-stats.mozilla.org/report/index/d0dbccc8-c3d3-4736-8a67-a8a7f0220313

Reason: SIGSEGV / SEGV_MAPERR

Top 10 frames of crashing thread:

0 libmozglue.so mozilla::detail::InvalidArrayIndex_CRASH mfbt/Assertions.cpp:50
1 libxul.so mozilla::InputTaskManager::DidRunTask xpcom/threads/InputTaskManager.cpp:90
2 libxul.so NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:467
3 libxul.so mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:85
4 libxul.so MessageLoop::Run ipc/chromium/src/base/message_loop.cc:306
5 libxul.so nsBaseAppShell::Run widget/nsBaseAppShell.cpp:137
6 libxul.so XRE_RunAppShell toolkit/xre/nsEmbedFunctions.cpp:870
7 libxul.so MessageLoop::Run ipc/chromium/src/base/message_loop.cc:306
8 libxul.so XRE_InitChildProcess toolkit/xre/nsEmbedFunctions.cpp:729
9 libmozglue.so Java_org_mozilla_gecko_mozglue_GeckoLoader_nativeRun mozglue/android/APKOpen.cpp:400

Not sure what to make of this. It seems to be happening on a single device for now but it's also happening only on nightly which doesn't have a huge user base.

Comment 1

[Andrew McCreight [:mccr8]]

The crash is happening on this line: TimeStamp start = mStartTimes.PopLastElement();

Presumably mStartTimes is empty. There's an assert that it can't be empty, but for one user it apparently can.

Should this be an XPCOM bug?

There's also no crash annotation for the invalid index crash. I don't know if that's expected on Android.

Comment 2

[Chris Peterson [:cpeterson]]

Moving this bug to the XPCOM component.

There are 18 reports from 3 installs of Fenix 99.0a1 and 57 reports from 8 installs of Fenix 100.0a1.

Did InputTaskManager::DidRunTask() run before InputTaskManager::WillRunTask()? Is this a shutdown race?

https://searchfox.org/mozilla-central/rev/be4604e4be8c71b3c1dbff2398a5b05f15411673/xpcom/threads/InputTaskManager.cpp#81,89-90

Comment 3

[Andrew McCreight [:mccr8]]

There have been zero of these crashes since the 18th, for what it is worth.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.