963053 - crash in mozilla::dom::Gamepad::SetAxis(unsigned int, double)

Status: VERIFIED FIXED

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Ada [:adalucinet]]

This bug was filed from the Socorro interface and is 
report bp-99401ec6-0d29-4604-a9f7-590642140123.
=============================================================
More reports: https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Adom%3A%3AGamepad%3A%3ASetAxis%28unsigned+int%2C+double%29&product=Firefox&query_type=contains&range_unit=weeks&process_type=any&hang_type=any&date=2014-01-23+12%3A00%3A00&range_value=4#reports


STR:
1. Load http://luser.github.io/gamepadtest/ in latest Aurora/Nightly.
2. Press a button in the controller.
3. Change from DirectInput to Xinput and repeat step 2.

Notes:
1. With Nightly from 2013-12-08 (when bug 878828 was pushed), I get this crash: https://crash-stats.mozilla.com/report/index/c2e55f06-c071-43a0-b251-1e7412140123. I'll investigate further. 
2. No crashes with Chrome.
3. Used a Logitech F310 Gamepad which supports both DirectInput and XInput standards.
4. Reproduced on Windows 7 64bit, Windows XP 32bit and 64bit.

Comment 1

[(not currently active) Ted Mielczarek]

Hm, the switch must change how the buttons/axes are reported. I just ordered one of these controllers, I'll take a look in a few days when I get it.

Comment 2

[Ada [:adalucinet]]

On http://luser.github.io/gamepadtest/ with navigator.getGamepads()[0].buttons.length and navigator.getGamepads()[0].axes.length commands in the Web Console, I get: 
- 12 buttons and 6 axes for Direct input
- 10 buttons and 7 axes for Xinput

Comment 3

[u279076]

Nominating for tracking given this is a "critical" bug in a feature we're trying to ship in Firefox 28.

Comment 4

[Lukas Blakk [:lsblakk] use ?needinfo]

How many controllers are we looking at in terms of most-used?  Is this controller commonly used?

Comment 5

[(not currently active) Ted Mielczarek]

I don't have any way of knowing that, but the crash only happens when flipping a switch on the back of the controller while the controller is in use, which seems pretty edge-case.

I'm investigating, I have high confidence that I'll be able to deliver a crash fix in the next few days.

Comment 6

[Lukas Blakk [:lsblakk] use ?needinfo]

Ok, since this isn't a top crash and sounds edge-casey, we don't need to track but we can take a low risk uplift if available in early Beta.

Comment 7

[(not currently active) Ted Mielczarek]

I suspect the patch in bug 980876 will fix this.

Comment 8

[Bogdan Maris, Desktop Test Engineering]

I tested this crash on Firefox 29 beta 7, latest Aurora and latest Nightly. I was only able to crash Aurora two times out of many tries with the same signature but only if I stress Aurora with the STR over and over. Since this is a edge-case I think we should call this verified, what's your opinion on this Ted?
bp-96523497-5225-442a-befe-034462140411
bp-2972fd58-6ce9-4d30-b1eb-350802140411

Comment 9

[(not currently active) Ted Mielczarek]

That sounds reasonable to me. I'm replacing all this code in bug 996078 anyway.