Closed Bug 527587 Opened 15 years ago Closed 14 years ago

Crash [@ qcms_transform_data]

Categories

(Core :: Graphics: Color Management, defect)

x86
Linux
defect
Not set
normal

Tracking

()

RESOLVED DUPLICATE of bug 521549

People

(Reporter: bc, Assigned: jrmuizel)

Details

(Keywords: crash, Whiteboard: [sg:critical?])

Crash Data

http://espn.go.com/ UNKNOWN 0x870420 qcms_transform_data (/work/mozilla/builds/1.9.3/mozilla/gfx/qcms/transform.c:1323) row_callback (/work/mozilla/builds/1.9.3/mozilla/modules/libpr0n/decoders/png/nsPNGDecoder.cpp:773) MOZ_PNG_push_have_row (/work/mozilla/builds/1.9.3/mozilla/modules/libimg/png/pngpread.c:1744) MOZ_PNG_push_proc_row (/work/mozilla/builds/1.9.3/mozilla/modules/libimg/png/pngpread.c:1168) MOZ_PNG_proc_IDAT_data (/work/mozilla/builds/1.9.3/mozilla/modules/libimg/png/pngpread.c:985) MOZ_PNG_push_read_IDAT (/work/mozilla/builds/1.9.3/mozilla/modules/libimg/png/pngpread.c:917) MOZ_PNG_proc_some_data (/work/mozilla/builds/1.9.3/mozilla/modules/libimg/png/pngpread.c:61) MOZ_PNG_process_data (/work/mozilla/builds/1.9.3/mozilla/modules/libimg/png/pngpread.c:33) nsPNGDecoder::Write(char const*, unsigned int) (/work/mozilla/builds/1.9.3/mozilla/modules/libpr0n/decoders/png/nsPNGDecoder.cpp:388) http://www.surfthechannel.com/ Stack: UNKNOWN 0x946420 qcms_transform_data (/work/mozilla/builds/1.9.3/mozilla/gfx/qcms/transform.c:1323) row_callback (/work/mozilla/builds/1.9.3/mozilla/modules/libpr0n/decoders/png/nsPNGDecoder.cpp:773) MOZ_PNG_push_have_row (/work/mozilla/builds/1.9.3/mozilla/modules/libimg/png/pngpread.c:1744) MOZ_PNG_push_proc_row (/work/mozilla/builds/1.9.3/mozilla/modules/libimg/png/pngpread.c:1168) MOZ_PNG_proc_IDAT_data (/work/mozilla/builds/1.9.3/mozilla/modules/libimg/png/pngpread.c:985) MOZ_PNG_push_read_IDAT (/work/mozilla/builds/1.9.3/mozilla/modules/libimg/png/pngpread.c:917) MOZ_PNG_proc_some_data (/work/mozilla/builds/1.9.3/mozilla/modules/libimg/png/pngpread.c:61) MOZ_PNG_process_data (/work/mozilla/builds/1.9.3/mozilla/modules/libimg/png/pngpread.c:33) nsPNGDecoder::Write(char const*, unsigned int) (/work/mozilla/builds/1.9.3/mozilla/modules/libpr0n/decoders/png/nsPNGDecoder.cpp:388) imgContainer::WriteToDecoder(char const*, unsigned int) (/work/mozilla/builds/1.9.3/mozilla/modules/libpr0n/src/imgContainer.cpp:2165) imgContainer::AddSourceData(char const*, unsigned int) (/work/mozilla/builds/1.9.3/mozilla/modules/libpr0n/src/imgContainer.cpp:1183) imgContainer::WriteToContainer(nsIInputStream*, void*, char const*, unsigned int, unsigned int, unsigned int*) (/work/mozilla/builds/1.9.3/mozilla/modules/libpr0n/src/imgContainer.cpp:2603) http://www.vancouversun.com/ UNKNOWN 0xd0c420 qcms_transform_data (/work/mozilla/builds/1.9.3/mozilla/gfx/qcms/transform.c:1323) nsJPEGDecoder::OutputScanlines(int*) (/work/mozilla/builds/1.9.3/mozilla/modules/libpr0n/decoders/jpeg/nsJPEGDecoder.cpp:649) .L176 (/work/mozilla/builds/1.9.3/mozilla/modules/libpr0n/decoders/jpeg/nsJPEGDecoder.cpp:465) imgContainer::WriteToDecoder(char const*, unsigned int) (/work/mozilla/builds/1.9.3/mozilla/modules/libpr0n/src/imgContainer.cpp:2165) imgContainer::AddSourceData(char const*, unsigned int) (/work/mozilla/builds/1.9.3/mozilla/modules/libpr0n/src/imgContainer.cpp:1183) imgContainer::WriteToContainer(nsIInputStream*, void*, char const*, unsigned int, unsigned int, unsigned int*) (/work/mozilla/builds/1.9.3/mozilla/modules/libpr0n/src/imgContainer.cpp:2603) lots more. this is seriously affecting crash testing linux trunk. sensitive because of the random address.
Are you getting these from crash-stats, or in your own test runs? If the latter have you tried with a debug build? Any informative asserts or other clues?
Keywords: testcase-wanted
Whiteboard: [sg:needinfo]
The original urls were from a list of flash crashes unrelated to this crash. These were with a debug builds. Nothing cluefull that I can see. I'll try to reduce a test case later today.
This is either a dupe or closely related to bug 521549. When trying to reproduce/reduce I get a start up crash on centos5 at qcms_transform_data_rgb_out_lut_sse2
Component: ImageLib → GFX: Color Management
QA Contact: imagelib → color-management
I don't know, with the crash in bug 521549 you're at least in one of the expected transform functions. qcms_transform_data consists of the single line transform->transform_fn(transform, src, dest, length); If the next thing on the stack is "unknown" then we've got corrupted, potentially exploitable, memory.
Whiteboard: [sg:needinfo] → [sg:critical?]
On 1.9.2, 1.9.3 linux x86, each url now crashes in flash 10.1.53.21 without a minidump but the browser stays alive. The original crash appears to be works for me. 1.9.1 just crashes in flash. Anyone have an idea of what *might* have fixed this?
Assignee: nobody → jmuizelaar
This still seems like bug 521549 to me. Are there any crashes that have happened on a release build?
Please reopen if this is wrong!
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → DUPLICATE
Crash Signature: [@ qcms_transform_data]
Group: core-security
You need to log in before you can comment on or make changes to this bug.