Closed
Bug 1746690
Opened 2 years ago
Closed 2 years ago
src/js/src/gc/Statistics.cpp:1028:54: runtime error: inf is outside the range of representable values of type 'unsigned int'
Categories
(Core :: JavaScript: GC, defect, P3)
Core
JavaScript: GC
Tracking
()
RESOLVED
FIXED
97 Branch
Tracking | Status | |
---|---|---|
firefox97 | --- | fixed |
People
(Reporter: tsmith, Assigned: jonco)
References
(Blocks 3 open bugs)
Details
(Keywords: csectype-undefined)
Attachments
(1 file)
Found while fuzzing m-c 20211217-ba22a155be2e (--enable-undefined-sanitizer --enable-fuzzing)
This was found while testing with float-cast-overflow
check enabled. I will attached a test case if I can get one to reduce.
src/js/src/gc/Statistics.cpp:1028:54: runtime error: inf is outside the range of representable values of type 'unsigned int'
#0 0x7fcc42c0e115 in js::gcstats::Statistics::sendGCTelemetry() src/js/src/gc/Statistics.cpp:1028:54
#1 0x7fcc42c0d148 in js::gcstats::Statistics::endGC() src/js/src/gc/Statistics.cpp:1010:3
#2 0x7fcc42c0f33f in js::gcstats::Statistics::endSlice() src/js/src/gc/Statistics.cpp:1206:7
#3 0x7fcc42b7f218 in js::gcstats::AutoGCSlice::~AutoGCSlice() src/js/src/gc/Statistics.h:484:26
#4 0x7fcc42b7f218 in js::gc::GCRuntime::gcCycle(bool, js::SliceBudget const&, mozilla::Maybe<JS::GCOptions> const&, JS::GCReason) src/js/src/gc/GC.cpp:3656:1
#5 0x7fcc42b80b79 in js::gc::GCRuntime::collect(bool, js::SliceBudget const&, mozilla::Maybe<JS::GCOptions> const&, JS::GCReason) src/js/src/gc/GC.cpp:3839:9
#6 0x7fcc42b57f0d in js::gc::GCRuntime::gc(JS::GCOptions, JS::GCReason) src/js/src/gc/GC.cpp:3912:3
#7 0x7fcc42bb3920 in JS::NonIncrementalGC(JSContext*, JS::GCOptions, JS::GCReason) src/js/src/gc/GCAPI.cpp:276:21
#8 0x7fcc3833f5e9 in nsJSContext::GarbageCollectNow(JS::GCReason, nsJSContext::IsIncremental, nsJSContext::IsShrinking, long) src/dom/base/nsJSEnvironment.cpp:1073:5
#9 0x7fcc38007d31 in mozilla::dom::FuzzingFunctions::GarbageCollect(mozilla::dom::GlobalObject const&) src/dom/base/FuzzingFunctions.cpp:26:3
#10 0x7fcc39b9a52d in mozilla::dom::FuzzingFunctions_Binding::garbageCollect(JSContext*, unsigned int, JS::Value*) src/objdir-ff-ubsan/dom/bindings/FuzzingFunctionsBinding.cpp:52:3
#11 0x7fcc41d78d51 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:388:13
#12 0x7fcc41d78d51 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:475:12
#13 0x7fcc41d7a467 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:535:10
#14 0x7fcc41d6319b in js::CallFromStack(JSContext*, JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:539:10
#15 0x7fcc41d6319b in Interpret(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:3243:16
#16 0x7fcc41d460c3 in js::RunScript(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:357:13
#17 0x7fcc41d78e56 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:507:13
#18 0x7fcc41d7a467 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:535:10
#19 0x7fcc41d7a66d in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) src/js/src/vm/Interpreter.cpp:552:8
#20 0x7fcc4202b705 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) src/js/src/vm/CallAndConstruct.cpp:117:10
#21 0x7fcc3962e0d9 in mozilla::dom::IdleRequestCallback::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::IdleDeadline&, mozilla::ErrorResult&) src/objdir-ff-ubsan/dom/bindings/WindowBinding.cpp:851:8
#22 0x7fcc37e4ec60 in mozilla::dom::IdleRequestCallback::Call(mozilla::dom::IdleDeadline&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) src/objdir-ff-ubsan/dist/include/mozilla/dom/WindowBinding.h:695:12
#23 0x7fcc38090d95 in mozilla::dom::IdleRequestCallback::Call(mozilla::dom::IdleDeadline&, char const*) src/objdir-ff-ubsan/dist/include/mozilla/dom/WindowBinding.h:708:12
#24 0x7fcc38090d95 in mozilla::dom::IdleRequest::IdleRun(nsPIDOMWindowInner*, double, bool) src/dom/base/IdleRequest.cpp:61:13
#25 0x7fcc37ca942b in nsGlobalWindowInner::RunIdleRequest(mozilla::dom::IdleRequest*, double, bool) src/dom/base/nsGlobalWindowInner.cpp:740:12
#26 0x7fcc37ca7e63 in nsGlobalWindowInner::ExecuteIdleRequest(mozilla::TimeStamp) src/dom/base/nsGlobalWindowInner.cpp:768:3
#27 0x7fcc37ca7b54 in IdleRequestExecutor::Run() src/dom/base/nsGlobalWindowInner.cpp:609:13
#28 0x7fcc3448a596 in mozilla::RunnableTask::Run() src/xpcom/threads/TaskController.cpp:468:16
#29 0x7fcc3444b669 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:771:26
#30 0x7fcc34448e65 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:649:15
#31 0x7fcc344492e4 in mozilla::TaskController::ProcessPendingMTTask(bool) src/xpcom/threads/TaskController.cpp:391:36
#32 0x7fcc3447c5c9 in mozilla::TaskController::InitializeInternal()::$_0::operator()() const src/xpcom/threads/TaskController.cpp:124:37
#33 0x7fcc3447c5c9 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() src/xpcom/threads/nsThreadUtils.h:531:5
#34 0x7fcc34467d38 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1183:16
#35 0x7fcc344711d6 in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:467:10
#36 0x7fcc35a10ad2 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:85:21
#37 0x7fcc35a12252 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:268:30
#38 0x7fcc35870235 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:331:10
#39 0x7fcc35870235 in MessageLoop::RunHandler() src/ipc/chromium/src/base/message_loop.cc:324:3
#40 0x7fcc35870235 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:306:3
#41 0x7fcc3cc7b59d in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#42 0x7fcc41a5fcbb in XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:864:20
#43 0x7fcc35a12231 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:235:9
#44 0x7fcc35870235 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:331:10
#45 0x7fcc35870235 in MessageLoop::RunHandler() src/ipc/chromium/src/base/message_loop.cc:324:3
#46 0x7fcc35870235 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:306:3
#47 0x7fcc41a5ee63 in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:701:34
#48 0x7fcc41a73050 in mozilla::BootstrapImpl::XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/Bootstrap.cpp:67:12
#49 0x55b3d6e0c07a in content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#50 0x55b3d6e0c451 in main src/browser/app/nsBrowserApp.cpp:327:18
#51 0x7fcc5d88cbf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310
#52 0x55b3d6d5b138 in _start (src/objdir-ff-ubsan/dist/bin/firefox+0xe5138)
Comment 1•2 years ago
|
||
The severity field is not set for this bug.
:sdetar, could you have a look please?
For more information, please visit auto_nag documentation.
Flags: needinfo?(sdetar)
Assignee | ||
Comment 2•2 years ago
|
||
This only affects telemetry.
Severity: -- → S4
Flags: needinfo?(sdetar)
Priority: -- → P3
Assignee | ||
Updated•2 years ago
|
Assignee: nobody → jcoppeard
Assignee | ||
Comment 3•2 years ago
|
||
The problem is that we're dividing by zero, but also the calculated rate is
unlikely to be accurate if the marking time is very short.
Pushed by jcoppeard@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/bbdb5154b376 Don't calculate mark rate telemetry if marking time is short r=sfink
Comment 5•2 years ago
|
||
bugherder |
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → 97 Branch
Reporter | ||
Updated•2 years ago
|
Blocks: float-cast-overflow
You need to log in
before you can comment on or make changes to this bug.
Description
•