1413622 - UBSan: netwerk/cache/nsCacheService.cpp:3067:63: division by zero [@ nsCacheService::LogCacheStatistics]

Status: RESOLVED FIXED

(Core :: Networking: Cache, defect, P3)

Description

[Tyson Smith [:tsmith]]

This error is triggered on shutdown when Firefox is built with: -fsanitize=float-divide-by-zero,integer-divide-by-zero

This could lead to crashes when using different build tools and/or compiler optimization combinations.

/mozilla-central/netwerk/cache/nsCacheService.cpp:3067:63: runtime error: division by zero
    #0 0x7fd6b2744ff4 in nsCacheService::LogCacheStatistics() /mozilla-central/netwerk/cache/nsCacheService.cpp:3067:63
    #1 0x7fd6b273af3c in nsCacheService::Shutdown() /mozilla-central/netwerk/cache/nsCacheService.cpp:1262:9
    #2 0x7fd6b2738299 in nsCacheProfilePrefObserver::Observe(nsISupports*, char const*, char16_t const*) /mozilla-central/netwerk/cache/nsCacheService.cpp
    #3 0x7fd6b1bbc831 in nsObserverList::NotifyObservers(nsISupports*, char const*, char16_t const*) /mozilla-central/xpcom/ds/nsObserverList.cpp:112:19
    #4 0x7fd6b1bc0cb1 in nsObserverService::NotifyObservers(nsISupports*, char const*, char16_t const*) /mozilla-central/xpcom/ds/nsObserverService.cpp:296:19
    #5 0x7fd6b1d4e5a3 in mozilla::ShutdownXPCOM(nsIServiceManager*) /mozilla-central/xpcom/build/XPCOMInit.cpp:865:26
    #6 0x7fd6bf3ba3ba in ScopedXPCOMStartup::~ScopedXPCOMStartup() /mozilla-central/toolkit/xre/nsAppRunner.cpp:1516:5
    #7 0x7fd6bf3cf8d4 in operator() /mozilla-central/objdir-ff-ubsan/dist/include/mozilla/UniquePtr.h:528:5
    #8 0x7fd6bf3cf8d4 in reset /mozilla-central/objdir-ff-ubsan/dist/include/mozilla/UniquePtr.h:343
    #9 0x7fd6bf3cf8d4 in operator= /mozilla-central/objdir-ff-ubsan/dist/include/mozilla/UniquePtr.h:313
    #10 0x7fd6bf3cf8d4 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /mozilla-central/toolkit/xre/nsAppRunner.cpp:4865
    #11 0x7fd6bf3d1585 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /mozilla-central/toolkit/xre/nsAppRunner.cpp:4932:21
    #12 0x517014 in do_main /mozilla-central/browser/app/nsBrowserApp.cpp:231:22
    #13 0x517014 in main /mozilla-central/browser/app/nsBrowserApp.cpp:304
    #14 0x7fd6d600d1c0 in __libc_start_main /build/glibc-CxtIbX/glibc-2.26/csu/../csu/libc-start.c:308
    #15 0x41f7c9 in _start (/mozilla-central/objdir-ff-ubsan/dist/bin/firefox+0x41f7c9)

Comment 1

[Dragana Damjanovic [:dragana]]

Attachment: bug_1413622.patch

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/c773790077bf
Del with zero during logging. r=mayhemer

Comment 3

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/c773790077bf

Comment 4

[Tyson Smith [:tsmith]]

I am still seeing this issue.

/mozilla-central/netwerk/cache/nsCacheService.cpp:3069:58: runtime error: division by zero
    #0 0x7f62dc382eab in nsCacheService::LogCacheStatistics() /mozilla-central/netwerk/cache/nsCacheService.cpp:3069:58
    #1 0x7f62dc37c73e in nsCacheService::Shutdown() /mozilla-central/netwerk/cache/nsCacheService.cpp:1262:9
    #2 0x7f62dc37a152 in nsCacheProfilePrefObserver::Observe(nsISupports*, char const*, char16_t const*) /mozilla-central/netwerk/cache/nsCacheService.cpp
    #3 0x7f62db977982 in nsObserverList::NotifyObservers(nsISupports*, char const*, char16_t const*) /mozilla-central/xpcom/ds/nsObserverList.cpp:112:19
    #4 0x7f62db9797e7 in nsObserverService::NotifyObservers(nsISupports*, char const*, char16_t const*) /mozilla-central/xpcom/ds/nsObserverService.cpp:296:19
    #5 0x7f62dbafe9d1 in mozilla::ShutdownXPCOM(nsIServiceManager*) /mozilla-central/xpcom/build/XPCOMInit.cpp:865:26
    #6 0x7f62e7470b17 in ScopedXPCOMStartup::~ScopedXPCOMStartup() /mozilla-central/toolkit/xre/nsAppRunner.cpp:1516:5
    #7 0x7f62e748355d in mozilla::DefaultDelete<ScopedXPCOMStartup>::operator()(ScopedXPCOMStartup*) const /mozilla-central/objdir-ff-ubsan/dist/include/mozilla/UniquePtr.h:528:5
    #8 0x7f62e7482107 in mozilla::UniquePtr<ScopedXPCOMStartup, mozilla::DefaultDelete<ScopedXPCOMStartup> >::operator=(decltype(nullptr)) /mozilla-central/objdir-ff-ubsan/dist/include/mozilla/UniquePtr.h:313:5
    #9 0x7f62e747dadf in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /mozilla-central/toolkit/xre/nsAppRunner.cpp:4865:16
    #10 0x7f62e747e711 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /mozilla-central/toolkit/xre/nsAppRunner.cpp:4932:21
    #11 0x518958 in do_main(int, char**, char**) /mozilla-central/browser/app/nsBrowserApp.cpp:231:22
    #12 0x5181da in main /mozilla-central/browser/app/nsBrowserApp.cpp:304:16
    #13 0x7f63108181c0 in __libc_start_main /build/glibc-CxtIbX/glibc-2.26/csu/../csu/libc-start.c:308
    #14 0x420ca9 in _start (/mozilla-central/objdir-ff-ubsan/dist/bin/firefox+0x420ca9)

Comment 5

[Dragana Damjanovic [:dragana]]

Attachment: bug_1413622_v2.patch

I do not know why it is happening, except the variables are access from different thread. Anyway the old cache is going to go soon so need to spend too much time investigating.

Comment 6

[Honza Bambas (:mayhemer)]

Comment on attachment 8928207 [details] [diff] [review]
bug_1413622_v2.patch

Review of attachment 8928207 [details] [diff] [review]:
-----------------------------------------------------------------

thanks.  this is more clear.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/7137557138c4
Add a check to avoid a division by zero. r=mayhemer

Comment 8

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/7137557138c4