1490828 - UBSan: load of value 228, which is not a valid value for type 'bool' in /builds/worker/workspace/build/src/docshell/shistory/nsSHEntry.cpp:1011:15

Status: RESOLVED FIXED

(Firefox :: Session Restore, defect)

Description

[Tyson Smith [:tsmith]]

task 2018-09-11T07:55:15.998Z] 07:55:15     INFO - TEST-START | browser/components/sessionstore/test/browser_frame_history.js
[task 2018-09-11T07:55:16.583Z] 07:55:16     INFO - GECKO(1075) | /builds/worker/workspace/build/src/docshell/shistory/nsSHEntry.cpp:1011:15: runtime error: load of value 228, which is not a valid value for type 'bool'

This is triggered by a test (browser/components/sessionstore/test/browser_frame_history.js) when the browser is built with undefined behavior sanitizer, specifically the "bool" check (-fasanitize=bool). This is likely due to the use of uninitialized memory.

Comment 1

[u473386]

A temporary "fix" might be to add it to suppressions, which appears to be separate for testing.

https://dxr.mozilla.org/mozilla-central/source/testing/mozbase/mozrunner/mozrunner/utils.py#224

Comment 2

[Tyson Smith [:tsmith]]

Nick do you know who might be able to help with this?

Comment 3

[Nicholas Nethercote [inactive]]

I can look at this.

Comment 4

[Nicholas Nethercote [inactive]]

Very likely to be caused by patch 5 in bug 1488321: https://hg.mozilla.org/mozilla-central/rev/afb85694d4ff. I will post a fix shortly.

Comment 5

[Nicholas Nethercote [inactive]]

Attachment: Handle mPersist in the nsSHEntry copy constructor

Tyson, there's a good chance this will fix the problem.

Comment 6

[Tyson Smith [:tsmith]]

I pushed a commit with this patch and the UBSan patches to try:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=48b05f6870797fc310ec51555b0878f1d3161401

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/314994bc7f3f
Handle mPersist in the nsSHEntry copy constructor. r=nika

Comment 8

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/314994bc7f3f