895722 - TaskThrottler::TaskComplete tries to delete from an empty array and destroys the world

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect)

Description

[Jed Davis [:jld] ⟨⏰|UTC-8⟩ ⟦he/him⟧]

So, this, from around line 48 of TaskThrottler.cpp:

       if (mDurations.Length() >= mMaxDurations) {
           mDurations.RemoveElementAt(0);
       }

If both mDurations.Length() and mMaxDurations are zero, then the condition is true, the RemoveElementAt happens, and — because of bug 845886 — we don't notice and instead dramatically bad things happen, like doing a 4GiB overlapping memcpy that clobbers everything in the data section (and causes me to spend an entire day chasing various methods of trying to use watchpoints that don't actually work).

Comment 1

[Jed Davis [:jld] ⟨⏰|UTC-8⟩ ⟦he/him⟧]

Attachment: Don't remove elements from mDurations if it's empty.

Comment 2

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/804286c561d0

Comment 3

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 778226 [details] [diff] [review]
Don't remove elements from mDurations if it's empty.

Please just use the checkin-needed keyword in the future.

Comment 4

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/804286c561d0