489594 - unaligned read in fbCompositeSrcAdd_8000x8000arm (kayak.com crash)

Status: VERIFIED FIXED

(Firefox for Android Graveyard :: General, defect)

Description

[Joel Maher ( :jmaher ) (UTC -8) (PTO back normal Nov 17)]

while testing blassey's apr 21st private build of wince fennec, I turn off plugins and jit (initially started with both of these on) and try to load up www.kayak.com.  This continues to crash.  I verified in maemo bits from yesterday that it loads up just fine.

Comment 1

[Doug Turner (:dougt)]

Data Abort: Thread=88ecba40 Proc=80457fd0 'fennec.exe'
AKY=00002001 PC=7b070444(xul.dll+0x01060444) RA=6791cd60(???+0x6791cd60) BVA=678ccc12 FSR=00000001
Unhandled exception at 0x7b070444 in fennec.exe: 0x80000002: Datatype misalignment.

at

>	fbCompositeSrcAdd_8000x8000arm	
 	0x6791cd60	


7B070408  bne         7B0703E4 
7B07040C  add         r12, r12, r7 
7B070410  add         r5, r5, r8 
7B070414  sub         r3, r4, #1 
7B070418  ldr         r2, [pc, #0x74] 
7B07041C  uxth        r4, r3 
7B070420  cmp         r4, r2 
7B070424  bne         7B0703C4 
7B070428  ldmia       sp!, {r4 - r8, r11, pc} 
7B07042C  mov         r1, r6 
7B070430  mov         lr, r12 
7B070434  mov         r0, r5 
7B070438  cmp         r1, #3 
7B07043C  bls         7B070468 
7B070440  sub         r3, r1, #4 
-> 7B070444  ldr         r2, [r0], #4 


R0 = 0x678ccc12 R1 = 0x00000004 R2 = 0x0000ffff R3 = 0x00000000 R4 = 0x00000005 
R5 = 0x678ccc12 R6 = 0x00000004 R7 = 0x00000004 R8 = 0x00000008 R9 = 0x00000000 
R10 = 0x00000006 R11 = 0x1dbbdd28 R12 = 0x6791cd60 Sp = 0x1dbbdd10 Lr = 0x6791cd60 
Pc = 0x7b070444 Psr = 0x20000010 

0x678CCBFE  98 00 ff ff 98 00 ff ff 98 00 ff ff 98 00 00 00 00 00 82 aa  ˜.ÿÿ˜.ÿÿ˜.ÿÿ˜......ª
0x678CCC12  aa aa aa 32 00 00 c3 ff ff ff ff 4b 00 00 c3 ff ff ff ff 4b  ªªª2..ÃÿÿÿÿK..ÃÿÿÿÿK
0x678CCC26  00 00 c3 ff ff ff ff 4b 00 00 c3 ff ff ff ff 4b 00 00 4e 66  ..ÃÿÿÿÿK..ÃÿÿÿÿK..Nf

Comment 2

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Sounds like some fun for Jeff!

Comment 3

[Jeff Muizelaar [:jrmuizel]]

I belive this is fixed upstream and just hasn't been merged yet

Comment 5

[Brad Lassey [:blassey] (use needinfo?)]

can we pull in the upstream fix?

Comment 6

[Jeff Muizelaar [:jrmuizel]]

Turns out I was wrong about this being fixed upstream. I'll have to investigate further.

Comment 7

[Jeff Muizelaar [:jrmuizel]]

It looks like it's just the wince asm.

Comment 8

[Jeff Muizelaar [:jrmuizel]]

Attachment: Updates the wince assembly to match the .c version

This also changes the instruction mnemonics we use for stack accesses. I haven't tested this patch but it should be pretty safe.

Comment 9

[Brad Lassey [:blassey] (use needinfo?)]

Comment on attachment 374796 [details] [diff] [review]
Updates the wince assembly to match the .c version

Unfortunately my build with this patch has a black screen for content until I pan when it gets a squiggly version of the checkerboard.

Comment 10

[Jeff Muizelaar [:jrmuizel]]

Attachment: v2 a smaller patch that doesn't change the stack stuff

Comment 11

[Brad Lassey [:blassey] (use needinfo?)]

so....apparently the problem I'm seeing is not the result of jeff's patch.  Something is broken on trunk.

Comment 12

[Brad Lassey [:blassey] (use needinfo?)]

Comment on attachment 374796 [details] [diff] [review]
Updates the wince assembly to match the .c version

The squiggly checkerboard was due to jemalloc being broken.  Now that its fixed, this patch works

Comment 13

[Brad Lassey [:blassey] (use needinfo?)]

Comment on attachment 374811 [details] [diff] [review]
v2 a smaller patch that doesn't change the stack stuff

Jeff likes the first patch better

Comment 14

[Brad Lassey [:blassey] (use needinfo?)]

pushed http://hg.mozilla.org/mozilla-central/rev/d79d37ca2328

Comment 15

[Joel Maher ( :jmaher ) (UTC -8) (PTO back normal Nov 17)]

verified with 20090827 trunk nightly on winmo