2006220 - Crash in [@ mozilla::detail::InvalidArrayIndex_CRASH | ElementAt | mozilla::widget::WaylandBuffer::IsAttached ]

Status: RESOLVED DUPLICATE of bug 1999029

(Core :: Graphics, defect, P2)

Description

[Patrick Toal]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:146.0) Gecko/20100101 Firefox/146.0

Steps to reproduce:

Hardware: Intel Core Ultra 5 225U (Arrow Lake)
Fedora 43
Kernel 6.17.x
Mesa 25.2.x
Wayland session
Repro: YouTube playback with HW accel (AV1 Codec)
Mitigation: MOZ_ENABLE_WAYLAND=0 or disable HW accel

https://crash-stats.mozilla.org/report/index/c41c6970-c3bd-4ed9-b674-181a80251215

Actual results:

After a few minutes of playing the video, Firefox Crashed

Expected results:

Firefox should not have crashed.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Graphics' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Brad Werth [:bradwerth]]

This is a strange crash stack. An invalid array index in a for-each loop is very strange to me. Does it mean that the array is being mutated during iteration, by another thread? If that's accurate, then possible fixes are:

1. Protecting the array with a mutex.
2. Cloning the array to a local array, and iterating that.
3. Use a map_reduce or something in the hope that the array is not vulnerable under this usage.

Option 2 seems mostly harmless, not a huge hit to performance. I'll build a patch that does this. Meanwhile I'll bring this to triage in case someone can reproduce, or knows better about the possibility of multiple threads accessing this array.

Comment 3

[Brad Werth [:bradwerth]]

(In reply to Brad Werth [:bradwerth] from comment #2)

possible fixes are:

1. Protecting the array with a mutex.
2. Cloning the array to a local array, and iterating that.

But of course if the array is being manipulated by another thread, cloning it is also not safe. This is weird. We'll discuss in triage.

Comment 4

[Ashley Hale [:ahale]]

NI - in triage we think you may know more about this code, thoughts?

Comment 5

[Martin Stránský [:stransky] (ni? me)]

On my radar already.