504766 - unaligned reads in qcms (crash on http://www.onlinemovies.top-site-list.com/)

Status: RESOLVED FIXED

(Core :: Graphics: Color Management, defect, P2)

Description

[skempe]

User-Agent:       Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; Zune 2.0)
Build Identifier: http://people.mozilla.com/~vladimir/ce/firefox.cab (11th July)

firefox crashed when tried to open http://www.onlinemovies.top-site-list.com/

The log is as below. Similar kind of xul.dll crash was observed in bug 502230 but with 11th July version it started to hang the device. 

** We want fake weight
** We want fake weight
** We want fake weight
** We want fake weight
_ogl_surface_create returned OpenGL ES error code 0x500
_ogl_surface_create returned OpenGL ES error code 0x500
Exception 'Data Abort' (4): Thread-Id=086500b2(pth=83e0d708), Proc-Id=0640081e(pprc=841c4bb8) 'firefox.exe', VM-active=0640081e(pprc=841c4bb8) 'firefox.exe'
PC=42dce02c(xul.dll+0x00b9e02c) RA=58595a20(???+0x58595a20) SP=001ff4d8, BVA=00000000


Reproducible: Always

Steps to Reproduce:
1.install firefox 
2.open http://www.onlinemovies.top-site-list.com/
3.
Actual Results:  
firefox crashes

Comment 1

[timeless]

https://developer.mozilla.org/en/How_to_get_a_stacktrace_with_WinDbg

Comment 2

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

(In reply to comment #1)
> https://developer.mozilla.org/en/How_to_get_a_stacktrace_with_WinDbg

Platform: ARM - Windows CE

Comment 3

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

This is qcms related (also, color management should be disabled, will fix) -- it's casting pointers and reading 4-byte values from non-aligned addresses.  Using memcpy to get the data fixes the problem here.

Comment 4

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Attachment: fix

Use memcpy instead of reading directly.

Comment 5

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

http://hg.mozilla.org/mozilla-central/rev/944b2cd986d9 for disabling cms on Windows CE -- so this bug should be gone even before this patch lands.

Comment 6

[Jeff Muizelaar [:jrmuizel]]

Comment on attachment 389214 [details] [diff] [review]
fix

One of the jpeg's on that page has a profile that has unaligned offsets in it. This isn't very common and so that's why we didn't run into the problem before.

Comment 8

[Jeff Muizelaar [:jrmuizel]]

http://hg.mozilla.org/mozilla-central/rev/e8207773d54d

Comment 10

[Landry Breuil (:gaston)]

This bug should be reopened, as it affects mozilla-firefox 3.6.13 on sparc64 (and probably firefox 3.5.16, as the qcms codebase is the same there). Can someone backport the fix (http://hg.mozilla.org/mozilla-central/rev/e8207773d54d) to 1.9.1 and 1.9.2 branches ? It's been tested to fix the crashes.

Comment 11

[Jeff Muizelaar [:jrmuizel]]

(In reply to comment #10)
> This bug should be reopened, as it affects mozilla-firefox 3.6.13 on sparc64
> (and probably firefox 3.5.16, as the qcms codebase is the same there). Can
> someone backport the fix
> (http://hg.mozilla.org/mozilla-central/rev/e8207773d54d) to 1.9.1 and 1.9.2
> branches ? It's been tested to fix the crashes.

Can you file a new bug for those trees. I think it will make tracking the issue easier.