UBSan: -93.2743 is outside the range of representable values of type 'unsigned int' [@ FireForgetSkippable]

RESOLVED FIXED in Firefox 62

Status

()

RESOLVED FIXED
6 months ago
6 months ago

People

(Reporter: tsmith, Assigned: smaug)

Tracking

(Blocks: 2 bugs, {csectype-undefined})

unspecified
mozilla62
csectype-undefined
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox62 fixed)

Details

Attachments

(1 attachment)

(Reporter)

Description

6 months ago
dom/base/nsJSEnvironment.cpp:1291:16: runtime error: -93.2743 is outside the range of representable values of type 'unsigned int'
    #0 0x7f265cd93246 in FireForgetSkippable(unsigned int, bool, mozilla::TimeStamp) dom/base/nsJSEnvironment.cpp:1291:16
    #1 0x7f265cd94c9e in CCRunnerFired(mozilla::TimeStamp) dom/base/nsJSEnvironment.cpp:1957:7
    #2 0x7f265b3d73e8 in std::function<bool (mozilla::TimeStamp)>::operator()(mozilla::TimeStamp) const /usr/bin/../lib/gcc/x86_64-linux-gnu/7.2.0/../../../../include/c++/7.2.0/bits/std_function.h:706:14
    #3 0x7f265b3d6b2c in mozilla::IdleTaskRunner::Run() xpcom/threads/IdleTaskRunner.cpp:62:14
    #4 0x7f265b3fdafd in nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp:1088:14
    #5 0x7f265b41ccde in NS_ProcessNextEvent(nsIThread*, bool) xpcom/threads/nsThreadUtils.cpp:519:10
    #6 0x7f265bc061ff in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:97:21
    #7 0x7f265bb6f589 in MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:298:3
    #8 0x7f265e77997f in nsBaseAppShell::Run() widget/nsBaseAppShell.cpp:157:27
    #9 0x7f266044807b in nsAppStartup::Run() toolkit/components/startup/nsAppStartup.cpp:290:30
    #10 0x7f2660534879 in XREMain::XRE_mainRun() toolkit/xre/nsAppRunner.cpp:4746:22
    #11 0x7f2660535585 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) toolkit/xre/nsAppRunner.cpp:4891:8
    #12 0x7f2660535c28 in XRE_main(int, char**, mozilla::BootstrapConfig const&) toolkit/xre/nsAppRunner.cpp:4983:21
    #13 0x430fb4 in do_main(int, char**, char**) browser/app/nsBrowserApp.cpp:233:22
    #14 0x430bba in main browser/app/nsBrowserApp.cpp:311:16
    #15 0x7f267e19c1c0 in __libc_start_main /build/glibc-itYbWN/glibc-2.26/csu/../csu/libc-start.c:308
    #16 0x4092e9 in _start (firefox+0x4092e9)
oh, negative number. Hmm
(Reporter)

Comment 2

6 months ago
Perhaps it uninitialized memory? idleDuration not getting initialized?
Not uninitialized.

But in theory this can happen if the thread goes to sleep somewhere between creating aDeadline and calculating startTimeStamp, I think.
This affects telemetry probe only, but should be fixed. Just not sure how...
Perhaps idleDuration could be explicitly 0 if startTimeStamp > aDeadline
Created attachment 8984751 [details] [diff] [review]
idle_reporting_zero.diff

perhaps like this. TimeDuration is initialized to 0 by default
https://searchfox.org/mozilla-central/rev/04b9cbbc2be2137a37e158a5ebaf9c7bef2364f9/mozglue/misc/TimeStamp.h#66
Assignee: nobody → bugs
Attachment #8984751 - Flags: review?(continuation)
Attachment #8984751 - Flags: review?(continuation) → review+

Comment 5

6 months ago
Pushed by opettay@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/9948ffb9dc03
ensure only non-negative values are reported to telemetry, r=mccr8

Comment 6

6 months ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/9948ffb9dc03
Status: NEW → RESOLVED
Last Resolved: 6 months ago
status-firefox62: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla62
(Reporter)

Updated

6 months ago
Blocks: 1367146
You need to log in before you can comment on or make changes to this bug.