1467920 - UBSan: -93.2743 is outside the range of representable values of type 'unsigned int' [@ FireForgetSkippable]

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Tyson Smith [:tsmith]]

dom/base/nsJSEnvironment.cpp:1291:16: runtime error: -93.2743 is outside the range of representable values of type 'unsigned int'
    #0 0x7f265cd93246 in FireForgetSkippable(unsigned int, bool, mozilla::TimeStamp) dom/base/nsJSEnvironment.cpp:1291:16
    #1 0x7f265cd94c9e in CCRunnerFired(mozilla::TimeStamp) dom/base/nsJSEnvironment.cpp:1957:7
    #2 0x7f265b3d73e8 in std::function<bool (mozilla::TimeStamp)>::operator()(mozilla::TimeStamp) const /usr/bin/../lib/gcc/x86_64-linux-gnu/7.2.0/../../../../include/c++/7.2.0/bits/std_function.h:706:14
    #3 0x7f265b3d6b2c in mozilla::IdleTaskRunner::Run() xpcom/threads/IdleTaskRunner.cpp:62:14
    #4 0x7f265b3fdafd in nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp:1088:14
    #5 0x7f265b41ccde in NS_ProcessNextEvent(nsIThread*, bool) xpcom/threads/nsThreadUtils.cpp:519:10
    #6 0x7f265bc061ff in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:97:21
    #7 0x7f265bb6f589 in MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:298:3
    #8 0x7f265e77997f in nsBaseAppShell::Run() widget/nsBaseAppShell.cpp:157:27
    #9 0x7f266044807b in nsAppStartup::Run() toolkit/components/startup/nsAppStartup.cpp:290:30
    #10 0x7f2660534879 in XREMain::XRE_mainRun() toolkit/xre/nsAppRunner.cpp:4746:22
    #11 0x7f2660535585 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) toolkit/xre/nsAppRunner.cpp:4891:8
    #12 0x7f2660535c28 in XRE_main(int, char**, mozilla::BootstrapConfig const&) toolkit/xre/nsAppRunner.cpp:4983:21
    #13 0x430fb4 in do_main(int, char**, char**) browser/app/nsBrowserApp.cpp:233:22
    #14 0x430bba in main browser/app/nsBrowserApp.cpp:311:16
    #15 0x7f267e19c1c0 in __libc_start_main /build/glibc-itYbWN/glibc-2.26/csu/../csu/libc-start.c:308
    #16 0x4092e9 in _start (firefox+0x4092e9)

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

oh, negative number. Hmm

Comment 2

[Tyson Smith [:tsmith]]

Perhaps it uninitialized memory? idleDuration not getting initialized?

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Not uninitialized.

But in theory this can happen if the thread goes to sleep somewhere between creating aDeadline and calculating startTimeStamp, I think.
This affects telemetry probe only, but should be fixed. Just not sure how...
Perhaps idleDuration could be explicitly 0 if startTimeStamp > aDeadline

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

Attachment: idle_reporting_zero.diff

perhaps like this. TimeDuration is initialized to 0 by default
https://searchfox.org/mozilla-central/rev/04b9cbbc2be2137a37e158a5ebaf9c7bef2364f9/mozglue/misc/TimeStamp.h#66

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/9948ffb9dc03
ensure only non-negative values are reported to telemetry, r=mccr8

Comment 6

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/mozilla-central/rev/9948ffb9dc03