1824674 - Crash in [@ mozilla::dom::cache::db::(anonymous namespace)::DeleteAllCacheEntries::$::operator()<T>]

Status: RESOLVED FIXED

(Core :: Storage: Cache API, defect)

Description

[Gabriele Svelto [:gsvelto]]

Crash report: https://crash-stats.mozilla.org/report/index/84b529f3-32cb-4568-b656-fd5c30230325

MOZ_CRASH Reason: MOZ_DIAGNOSTIC_ASSERT(paddingSize + deletedPaddingSize <= 2147483647)

Top 10 frames of crashing thread:

0  XUL  mozilla::dom::cache::db:: const  dom/cache/DBSchema.cpp:1380
0  XUL  mozilla::dom::quota::CollectWhileHasResult<mozilla::dom::cache::db:: const  dom/quota/QuotaCommon.h:1481
0  XUL  mozilla::CollectWhile<mozilla::dom::quota::CollectWhileHasResult<mozilla::dom::cache::db:: const  dom/quota/QuotaCommon.h:1199
0  XUL  mozilla::CollectEach<mozilla::dom::quota::CollectWhileHasResult<mozilla::dom::cache::db::  dom/quota/QuotaCommon.h:1129
0  XUL  mozilla::CollectWhile<mozilla::dom::quota::CollectWhileHasResult<mozilla::dom::cache::db::  dom/quota/QuotaCommon.h:1199
0  XUL  mozilla::dom::quota::CollectWhileHasResult<mozilla::dom::cache::db::  dom/quota/QuotaCommon.h:1477
0  XUL  mozilla::dom::cache::db::  dom/cache/DBSchema.cpp:1380
0  XUL  mozilla::dom::cache::db::DeleteCacheId  dom/cache/DBSchema.cpp:636
1  XUL  mozilla::dom::cache:: const  dom/cache/Manager.cpp:108
1  XUL  mozilla::ReduceEach<mozilla::Reduce<AutoTArray<long long,  const  dom/quota/QuotaCommon.h:1146

We're triggering a diagnostic assertion but I don't know enough about this code to be able to tell why. The signatures on Windows and macOS are slightly different.

Comment 1

[Jens Stutte [:jstutte]]

That assertion has been introduced (together with the surrounding code) by bug 1784700.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1784700

Comment 3

[Harveer Singh]

The regression was introduced with patch: https://phabricator.services.mozilla.com/D156184, specifically, in the assertion line MOZ_DIAGNOSTIC_ASSERT(paddingSize + deletedPaddingSize <= INT_MAX).

R.H.S of the above comparison should be INT64_MAX instead of INT_MAX. Assertion would only trigger if the total cache padding size becomes greater than INT_MAX.

Looking at the crash stat, it seems like this happened in nightly, are diagnostic assertion enabled by-default on nightly builds? How about release? This is an issue with assertion statement itself, so probably there would not be any problems with release builds.

Comment 4

[Gabriele Svelto [:gsvelto]]

Diagnostic assertions are enabled on nightly and early beta (see here)

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1784700

Comment 6

[Harveer Singh]

Attachment: Bug 1824674: Fixing the wrong assertion in DeleteAllCacheEntries.r=#dom-storage-reviewers

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a5d752115f2a
Fixing the wrong assertion in DeleteAllCacheEntries.r=dom-storage-reviewers,asuth

Comment 8

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/a5d752115f2a