527587 - Crash [@ qcms_transform_data]

Status: RESOLVED DUPLICATE of bug 521549

(Core :: Graphics: Color Management, defect)

Description

[Bob Clary [:bc] (inactive)]

http://espn.go.com/

UNKNOWN 0x870420
qcms_transform_data (/work/mozilla/builds/1.9.3/mozilla/gfx/qcms/transform.c:1323)
row_callback (/work/mozilla/builds/1.9.3/mozilla/modules/libpr0n/decoders/png/nsPNGDecoder.cpp:773)
MOZ_PNG_push_have_row (/work/mozilla/builds/1.9.3/mozilla/modules/libimg/png/pngpread.c:1744)
MOZ_PNG_push_proc_row (/work/mozilla/builds/1.9.3/mozilla/modules/libimg/png/pngpread.c:1168)
MOZ_PNG_proc_IDAT_data (/work/mozilla/builds/1.9.3/mozilla/modules/libimg/png/pngpread.c:985)
MOZ_PNG_push_read_IDAT (/work/mozilla/builds/1.9.3/mozilla/modules/libimg/png/pngpread.c:917)
MOZ_PNG_proc_some_data (/work/mozilla/builds/1.9.3/mozilla/modules/libimg/png/pngpread.c:61)
MOZ_PNG_process_data (/work/mozilla/builds/1.9.3/mozilla/modules/libimg/png/pngpread.c:33)
nsPNGDecoder::Write(char const*, unsigned int) (/work/mozilla/builds/1.9.3/mozilla/modules/libpr0n/decoders/png/nsPNGDecoder.cpp:388)

http://www.surfthechannel.com/

Stack:
UNKNOWN 0x946420
qcms_transform_data (/work/mozilla/builds/1.9.3/mozilla/gfx/qcms/transform.c:1323)
row_callback (/work/mozilla/builds/1.9.3/mozilla/modules/libpr0n/decoders/png/nsPNGDecoder.cpp:773)
MOZ_PNG_push_have_row (/work/mozilla/builds/1.9.3/mozilla/modules/libimg/png/pngpread.c:1744)
MOZ_PNG_push_proc_row (/work/mozilla/builds/1.9.3/mozilla/modules/libimg/png/pngpread.c:1168)
MOZ_PNG_proc_IDAT_data (/work/mozilla/builds/1.9.3/mozilla/modules/libimg/png/pngpread.c:985)
MOZ_PNG_push_read_IDAT (/work/mozilla/builds/1.9.3/mozilla/modules/libimg/png/pngpread.c:917)
MOZ_PNG_proc_some_data (/work/mozilla/builds/1.9.3/mozilla/modules/libimg/png/pngpread.c:61)
MOZ_PNG_process_data (/work/mozilla/builds/1.9.3/mozilla/modules/libimg/png/pngpread.c:33)
nsPNGDecoder::Write(char const*, unsigned int) (/work/mozilla/builds/1.9.3/mozilla/modules/libpr0n/decoders/png/nsPNGDecoder.cpp:388)
imgContainer::WriteToDecoder(char const*, unsigned int) (/work/mozilla/builds/1.9.3/mozilla/modules/libpr0n/src/imgContainer.cpp:2165)
imgContainer::AddSourceData(char const*, unsigned int) (/work/mozilla/builds/1.9.3/mozilla/modules/libpr0n/src/imgContainer.cpp:1183)
imgContainer::WriteToContainer(nsIInputStream*, void*, char const*, unsigned int, unsigned int, unsigned int*) (/work/mozilla/builds/1.9.3/mozilla/modules/libpr0n/src/imgContainer.cpp:2603)

http://www.vancouversun.com/

UNKNOWN 0xd0c420
qcms_transform_data (/work/mozilla/builds/1.9.3/mozilla/gfx/qcms/transform.c:1323)
nsJPEGDecoder::OutputScanlines(int*) (/work/mozilla/builds/1.9.3/mozilla/modules/libpr0n/decoders/jpeg/nsJPEGDecoder.cpp:649)
.L176 (/work/mozilla/builds/1.9.3/mozilla/modules/libpr0n/decoders/jpeg/nsJPEGDecoder.cpp:465)
imgContainer::WriteToDecoder(char const*, unsigned int) (/work/mozilla/builds/1.9.3/mozilla/modules/libpr0n/src/imgContainer.cpp:2165)
imgContainer::AddSourceData(char const*, unsigned int) (/work/mozilla/builds/1.9.3/mozilla/modules/libpr0n/src/imgContainer.cpp:1183)
imgContainer::WriteToContainer(nsIInputStream*, void*, char const*, unsigned int, unsigned int, unsigned int*) (/work/mozilla/builds/1.9.3/mozilla/modules/libpr0n/src/imgContainer.cpp:2603)

lots more. this is seriously affecting crash testing linux trunk.

sensitive because of the random address.

Comment 1

[Daniel Veditz [:dveditz]]

Are you getting these from crash-stats, or in your own test runs? If the latter have you tried with a debug build? Any informative asserts or other clues?

Comment 2

[Bob Clary [:bc] (inactive)]

The original urls were from a list of flash crashes unrelated to this crash. These were with a debug builds. Nothing cluefull that I can see. I'll try to reduce a test case later today.

Comment 3

[Bob Clary [:bc] (inactive)]

This is either a dupe or closely related to bug 521549. When trying to reproduce/reduce I get a start up crash on centos5 at qcms_transform_data_rgb_out_lut_sse2

Comment 4

[Daniel Veditz [:dveditz]]

I don't know, with the crash in bug 521549 you're at least in one of the expected transform functions. qcms_transform_data consists of the single line

   transform->transform_fn(transform, src, dest, length);

If the next thing on the stack is "unknown" then we've got corrupted, potentially exploitable, memory.

Comment 5

[Bob Clary [:bc] (inactive)]

On 1.9.2, 1.9.3 linux x86, each url now crashes in flash 10.1.53.21 without a minidump but the browser stays alive. The original crash appears to be works for me. 1.9.1 just crashes in flash.

Anyone have an idea of what *might* have fixed this?

Comment 6

[Jeff Muizelaar [:jrmuizel]]

This still seems like bug 521549 to me. Are there any crashes that have happened on a release build?

Comment 7

[chris hofmann]

only 1 crash matching anything with qcms_transform_data in the singature and that doesn't appear to be related.

http://crash-stats.mozilla.com/query/query?product=Firefox&version=ALL%3AALL&range_value=1&range_unit=weeks&date=05%2F10%2F2010+13%3A29%3A07&query_search=signature&query_type=contains&query=qcms_transform_data&build_id=&process_type=plugin&plugin_field=filename&plugin_query_type=exact&plugin_query=&do_query=1

Comment 8

[Joe Drew (not getting mail)]

Please reopen if this is wrong!