Closed Bug 1746690 Opened 2 years ago Closed 2 years ago

src/js/src/gc/Statistics.cpp:1028:54: runtime error: inf is outside the range of representable values of type 'unsigned int'

Categories

(Core :: JavaScript: GC, defect, P3)

defect

Tracking

()

RESOLVED FIXED
97 Branch
Tracking Status
firefox97 --- fixed

People

(Reporter: tsmith, Assigned: jonco)

References

(Blocks 3 open bugs)

Details

(Keywords: csectype-undefined)

Attachments

(1 file)

Found while fuzzing m-c 20211217-ba22a155be2e (--enable-undefined-sanitizer --enable-fuzzing)

This was found while testing with float-cast-overflow check enabled. I will attached a test case if I can get one to reduce.

src/js/src/gc/Statistics.cpp:1028:54: runtime error: inf is outside the range of representable values of type 'unsigned int'
    #0 0x7fcc42c0e115 in js::gcstats::Statistics::sendGCTelemetry() src/js/src/gc/Statistics.cpp:1028:54
    #1 0x7fcc42c0d148 in js::gcstats::Statistics::endGC() src/js/src/gc/Statistics.cpp:1010:3
    #2 0x7fcc42c0f33f in js::gcstats::Statistics::endSlice() src/js/src/gc/Statistics.cpp:1206:7
    #3 0x7fcc42b7f218 in js::gcstats::AutoGCSlice::~AutoGCSlice() src/js/src/gc/Statistics.h:484:26
    #4 0x7fcc42b7f218 in js::gc::GCRuntime::gcCycle(bool, js::SliceBudget const&, mozilla::Maybe<JS::GCOptions> const&, JS::GCReason) src/js/src/gc/GC.cpp:3656:1
    #5 0x7fcc42b80b79 in js::gc::GCRuntime::collect(bool, js::SliceBudget const&, mozilla::Maybe<JS::GCOptions> const&, JS::GCReason) src/js/src/gc/GC.cpp:3839:9
    #6 0x7fcc42b57f0d in js::gc::GCRuntime::gc(JS::GCOptions, JS::GCReason) src/js/src/gc/GC.cpp:3912:3
    #7 0x7fcc42bb3920 in JS::NonIncrementalGC(JSContext*, JS::GCOptions, JS::GCReason) src/js/src/gc/GCAPI.cpp:276:21
    #8 0x7fcc3833f5e9 in nsJSContext::GarbageCollectNow(JS::GCReason, nsJSContext::IsIncremental, nsJSContext::IsShrinking, long) src/dom/base/nsJSEnvironment.cpp:1073:5
    #9 0x7fcc38007d31 in mozilla::dom::FuzzingFunctions::GarbageCollect(mozilla::dom::GlobalObject const&) src/dom/base/FuzzingFunctions.cpp:26:3
    #10 0x7fcc39b9a52d in mozilla::dom::FuzzingFunctions_Binding::garbageCollect(JSContext*, unsigned int, JS::Value*) src/objdir-ff-ubsan/dom/bindings/FuzzingFunctionsBinding.cpp:52:3
    #11 0x7fcc41d78d51 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:388:13
    #12 0x7fcc41d78d51 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:475:12
    #13 0x7fcc41d7a467 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:535:10
    #14 0x7fcc41d6319b in js::CallFromStack(JSContext*, JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:539:10
    #15 0x7fcc41d6319b in Interpret(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:3243:16
    #16 0x7fcc41d460c3 in js::RunScript(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:357:13
    #17 0x7fcc41d78e56 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:507:13
    #18 0x7fcc41d7a467 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:535:10
    #19 0x7fcc41d7a66d in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) src/js/src/vm/Interpreter.cpp:552:8
    #20 0x7fcc4202b705 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) src/js/src/vm/CallAndConstruct.cpp:117:10
    #21 0x7fcc3962e0d9 in mozilla::dom::IdleRequestCallback::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::IdleDeadline&, mozilla::ErrorResult&) src/objdir-ff-ubsan/dom/bindings/WindowBinding.cpp:851:8
    #22 0x7fcc37e4ec60 in mozilla::dom::IdleRequestCallback::Call(mozilla::dom::IdleDeadline&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) src/objdir-ff-ubsan/dist/include/mozilla/dom/WindowBinding.h:695:12
    #23 0x7fcc38090d95 in mozilla::dom::IdleRequestCallback::Call(mozilla::dom::IdleDeadline&, char const*) src/objdir-ff-ubsan/dist/include/mozilla/dom/WindowBinding.h:708:12
    #24 0x7fcc38090d95 in mozilla::dom::IdleRequest::IdleRun(nsPIDOMWindowInner*, double, bool) src/dom/base/IdleRequest.cpp:61:13
    #25 0x7fcc37ca942b in nsGlobalWindowInner::RunIdleRequest(mozilla::dom::IdleRequest*, double, bool) src/dom/base/nsGlobalWindowInner.cpp:740:12
    #26 0x7fcc37ca7e63 in nsGlobalWindowInner::ExecuteIdleRequest(mozilla::TimeStamp) src/dom/base/nsGlobalWindowInner.cpp:768:3
    #27 0x7fcc37ca7b54 in IdleRequestExecutor::Run() src/dom/base/nsGlobalWindowInner.cpp:609:13
    #28 0x7fcc3448a596 in mozilla::RunnableTask::Run() src/xpcom/threads/TaskController.cpp:468:16
    #29 0x7fcc3444b669 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:771:26
    #30 0x7fcc34448e65 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:649:15
    #31 0x7fcc344492e4 in mozilla::TaskController::ProcessPendingMTTask(bool) src/xpcom/threads/TaskController.cpp:391:36
    #32 0x7fcc3447c5c9 in mozilla::TaskController::InitializeInternal()::$_0::operator()() const src/xpcom/threads/TaskController.cpp:124:37
    #33 0x7fcc3447c5c9 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() src/xpcom/threads/nsThreadUtils.h:531:5
    #34 0x7fcc34467d38 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1183:16
    #35 0x7fcc344711d6 in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:467:10
    #36 0x7fcc35a10ad2 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:85:21
    #37 0x7fcc35a12252 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:268:30
    #38 0x7fcc35870235 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:331:10
    #39 0x7fcc35870235 in MessageLoop::RunHandler() src/ipc/chromium/src/base/message_loop.cc:324:3
    #40 0x7fcc35870235 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:306:3
    #41 0x7fcc3cc7b59d in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
    #42 0x7fcc41a5fcbb in XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:864:20
    #43 0x7fcc35a12231 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:235:9
    #44 0x7fcc35870235 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:331:10
    #45 0x7fcc35870235 in MessageLoop::RunHandler() src/ipc/chromium/src/base/message_loop.cc:324:3
    #46 0x7fcc35870235 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:306:3
    #47 0x7fcc41a5ee63 in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:701:34
    #48 0x7fcc41a73050 in mozilla::BootstrapImpl::XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/Bootstrap.cpp:67:12
    #49 0x55b3d6e0c07a in content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #50 0x55b3d6e0c451 in main src/browser/app/nsBrowserApp.cpp:327:18
    #51 0x7fcc5d88cbf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310
    #52 0x55b3d6d5b138 in _start (src/objdir-ff-ubsan/dist/bin/firefox+0xe5138)

The severity field is not set for this bug.
:sdetar, could you have a look please?

For more information, please visit auto_nag documentation.

Flags: needinfo?(sdetar)

This only affects telemetry.

Severity: -- → S4
Flags: needinfo?(sdetar)
Priority: -- → P3
Assignee: nobody → jcoppeard

The problem is that we're dividing by zero, but also the calculated rate is
unlikely to be accurate if the marking time is very short.

Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/bbdb5154b376
Don't calculate mark rate telemetry if marking time is short r=sfink
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → 97 Branch
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: