557107 - crashes in JPEG decoder [@ ycc_rgb_convert]

Status: RESOLVED WORKSFORME

(Core :: Graphics: ImageLib, defect)

Description

[Joe Drew (not getting mail)]

My parents-in-law's computer has shown a couple of Firefox crashes recently which turned out to be crashes in the JPEG decoder. A little investigation shows that this is actually a very common crash, albeit not quite common enough to show up in the topcrashes.

This doesn't seem to be a new crash, as I see reports from 3.5 in crash-stats.

Some examples:
bp-52a305a9-ac47-4ee8-8203-0f6af2100331
bp-3840e9a0-6abb-476e-9b39-e87642100331
bp-ad1d63a0-5c82-4593-b744-d0dc52100404

Comment 1

[timeless]

Signature	ycc_rgb_convert
UUID	52a305a9-ac47-4ee8-8203-0f6af2100331
Time 	2010-03-31 07:32:34.563610
Uptime	130
Last Crash	10161 seconds before submission
Product	Firefox
Version	3.6.2
Build ID	20100316074819
Branch	1.9.2
OS	Windows NT
OS Version	6.0.6002 Service Pack 2
CPU	x86
CPU Info	GenuineIntel family 6 model 15 stepping 13
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x500e180
User Comments	
Processor Notes 	
Related Bugs

Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	ycc_rgb_convert 	jpeg/jdcolor.c:341
1 	xul.dll 	sep_upsample 	jpeg/jdsample.c:131
2 	xul.dll 	process_data_simple_main 	jpeg/jdmainct.c:369
3 	xul.dll 	jpeg_read_scanlines 	jpeg/jdapistd.c:173
4 	xul.dll 	nsJPEGDecoder::OutputScanlines 	modules/libpr0n/decoders/jpeg/nsJPEGDecoder.cpp:697
5 	xul.dll 	nsJPEGDecoder::ProcessData 	modules/libpr0n/decoders/jpeg/nsJPEGDecoder.cpp:536
6 	xul.dll 	ReadDataOut 	modules/libpr0n/decoders/jpeg/nsJPEGDecoder.cpp:248
7 	xul.dll 	nsStringInputStream::ReadSegments 	xpcom/io/nsStringStream.cpp:276
8 	xul.dll 	nsJPEGDecoder::WriteFrom 	modules/libpr0n/decoders/jpeg/nsJPEGDecoder.cpp:266
9 	xul.dll 	imgRequest::OnDataAvailable 	modules/libpr0n/src/imgRequest.cpp:985
10 	xul.dll 	nsCOMPtr_base::assign_from_qi_with_error 	obj-firefox/xpcom/build/nsCOMPtr.cpp:107
11 	xul.dll 	nsMultiMixedConv::OnDataAvailable 	netwerk/streamconv/converters/nsMultiMixedConv.cpp:596
12 	user32.dll 	_W32ExceptionHandler 	
13 	xul.dll 	ProxyListener::OnDataAvailable 	modules/libpr0n/src/imgLoader.cpp:1806
14 	xul.dll 	nsStreamListenerTee::OnDataAvailable 	netwerk/base/src/nsStreamListenerTee.cpp:108
15 	xul.dll 	nsHttpChannel::OnDataAvailable 	netwerk/protocol/http/src/nsHttpChannel.cpp:5388
16 	xul.dll 	nsInputStreamPump::OnStateTransfer 	netwerk/base/src/nsInputStreamPump.cpp:508
17 	xul.dll 	nsInputStreamPump::OnInputStreamReady 	netwerk/base/src/nsInputStreamPump.cpp:398
18 	xul.dll 	nsInputStreamReadyEvent::Run 	xpcom/io/nsStreamUtils.cpp:191

Comment 2

[Bob Clary [:bc] (inactive)]

I've seen this on Windows and Linux 64bit 1.9.2 for
http://www.sdj-airport.com/live/

I haven't been able to reproduce it however that may be due to the changing nature of the video feeds.

Comment 3

[Matthew Middleton (:zzxc)]

A user on SUMO has reported that this crash (with bp-69007885-65c5-432e-8f66-67d9c2101220) affects Firefox 3.6.x on Windows when visiting the stream page from a Panasonic BL-C121A camera.  Since I don't have one of these cameras, I can't test this claim.

Comment 5

[Matthias Versen [:Matti]]

Joe: The reporter from bug 627116 got this crash 100% reproduceable but i couldn't reproduce. He provided a login info via private mail. You could ask him if you want to investigate the crash

Comment 6

[u279076]

This signature still shows up with 6 crashes reported in the last week however most appear to be crashing in Flash and the stacks are different from the original bug. 

https://crash-stats.mozilla.com/report/list?product=Firefox&signature=ycc_rgb_convert

I'm not sure this bug is still valid, Seth?

Comment 7

[Seth Fowler [:seth] [:s2h]]

I don't think it is; at least the reports I just looked at seem to be in Flash and the symbols are just wrong. The reports that *did* have the same stack were from truly ancient Firefox versions. (3.x) So I'm going to go ahead and resolve this.