585033 - [sparc] Bus error in [@ read_tag_XYZType] function

Status: RESOLVED DUPLICATE of bug 504766

(Core :: Graphics: Color Management, defect)

Description

[JKB]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; fr; rv:1.9.1.11) Gecko/20100721 Iceape/2.0.6
Build Identifier: Mozilla/5.0 (X11; U; Linux sparc64; en-US; rv:1.9.1.11) Gecko/20100804 SeaMonkey/2.0.6

When I try to open http://www.persee.fr and try to clic on "scientific journals" button, seamonkey always crashes on a bus error in read_tag_XYZType function. I don't see any mistake about alignment.

Same bug in firefox.

For information, backtrace of faulty process :

Core was generated by 
`/export/home/bertrand/seamonkey/install/lib/seamonkey-2.0.6/seamonkey-bin'.
Program terminated with signal 10, Bus error.
#0  read_tag_XYZType (src=0xff8687b8, index=..., tag_id=1918392666)
    at ../../../../comm-1.9.1/mozilla/gfx/qcms/iccread.c:322
322                     if (type != XYZ_TYPE)
(gdb) bt
#0  read_tag_XYZType (src=0xff8687b8, index=..., tag_id=1918392666)
    at ../../../../comm-1.9.1/mozilla/gfx/qcms/iccread.c:322
#1  0xf581455c in qcms_profile_from_memory (mem=<value optimized out>,
    size=7261) at ../../../../comm-1.9.1/mozilla/gfx/qcms/iccread.c:707
#2  0xf5803a28 in nsJPEGDecoder::ProcessData (this=0xeaa77800,
    data=0xeae68004 
"\2*5*h*\233*\317+\2+6+i+\235+\321,\5,9,n,\242,\327-\f-A-v-\253-\341.\26.L.\202.\267.\356/$/Z/\221/\307/\376\60\65\60l0\244\60\333\61\22\61J1\202\61\272\61\362\62*2c2\233\62\324\63\r3F3\177\63\270\63\361\64+4e4\236\64\330\65\23\65M5\207\65\302\65\375\66\67\66r6\256\66\351\67$7`7\234\67\327\70\24\70P8\214\70\310\71\5\71B9\177\71\274\71\371:6:t:\262:\357;-;k;\252;\350<'<e<\244<\343=\"=a=\241=\340> 
>`>\240>\340?!?a?\242?\342@#@d@"...,
    count=<value optimized out>, writeCount=0xff8689b4)
    at 
../../../../../../comm-1.9.1/mozilla/modules/libpr0n/decoders/jpeg/nsJPEGDecoder.cpp:344

#3  0xf5803c64 in ReadDataOut (in=0xeab4b6a8, closure=0xeaa77800,
    fromRawSegment=0xeae68004 
"\2*5*h*\233*\317+\2+6+i+\235+\321,\5,9,n,\242,\327-\f-A-v-\253-\341.\26.L.\202.\267.\356/$/Z/\221/\307/\376\60\65\60l0\244\60\333\61\22\61J1\202\61\272\61\362\62*2c2\233\62\324\63\r3F3\177\63\270\63\361\64+4e4\236\64\330\65\23\65M5\207\65\302\65\375\66\67\66r6\256\66\351\67$7`7\234\67\327\70\24\70P8\214\70\310\71\5\71B9\177\71\274\71\371:6:t:\262:\357;-;k;\252;\350<'<e<\244<\343=\"=a=\241=\340> 
>`>\240>\340?!?a?\242?\342@#@d@"...,
    toOffset=4096, count=4096, writeCount=0xff8689b4)
    at 
../../../../../../comm-1.9.1/mozilla/modules/libpr0n/decoders/jpeg/nsJPEG---Type 
<return> to continue, or q <return> to quit---
Decoder.cpp:253
#4  0xf7de17dc in nsInputStreamTee::WriteSegmentFun (in=0xeab4b6a8,
    closure=0xeab4ee80,
    fromSegment=0xeae68004 
"\2*5*h*\233*\317+\2+6+i+\235+\321,\5,9,n,\242,\327-\f-A-v-\253-\341.\26.L.\202.\267.\356/$/Z/\221/\307/\376\60\65\60l0\244\60\333\61\22\61J1\202\61\272\61\362\62*2c2\233\62\324\63\r3F3\177\63\270\63\361\64+4e4\236\64\330\65\23\65M5\207\65\302\65\375\66\67\66r6\256\66\351\67$7`7\234\67\327\70\24\70P8\214\70\310\71\5\71B9\177\71\274\71\371:6:t:\262:\357;-;k;\252;\350<'<e<\244<\343=\"=a=\241=\340> 
>`>\240>\340?!?a?\242?\342@#@d@"..., offset=4096,
    count=4096, writeCount=0xff8689b4)
    at ../../../../comm-1.9.1/mozilla/xpcom/io/nsInputStreamTee.cpp:102
#5  0xf7de5354 in nsPipeInputStream::ReadSegments (this=0xeab4b6a8,
    writer=0xf7de17b4 
<nsInputStreamTee::WriteSegmentFun(nsIInputStream*, void*, char const*, 
unsigned int, unsigned int, unsigned int*)>, closure=0xeab4ee80,
    count=6562, readCount=0xff868c14)
    at ../../../../comm-1.9.1/mozilla/xpcom/io/nsPipe3.cpp:799
#6  0xf7de1620 in nsInputStreamTee::ReadSegments (this=0xeab4ee80,
    writer=0xf5803c4c <ReadDataOut>, closure=0xeaa77800, count=6562,
    bytesRead=0xff868c14)
    at ../../../../comm-1.9.1/mozilla/xpcom/io/nsInputStreamTee.cpp:156
#7  0xf5802d48 in nsJPEGDecoder::WriteFrom (this=0xeaa77800, 
inStr=0xeab4ee80,
    count=10658, writeCount=0xff868c14)
    at 
../../../../../../comm-1.9.1/mozilla/modules/libpr0n/decoders/jpeg/nsJPEG---Type 
<return> to continue, or q <return> to quit---
Decoder.cpp:271
#8  0xf57fbb94 in imgRequest::OnDataAvailable (this=0xeab4b600,
    aRequest=0xead8650c, ctxt=0x0, inStr=0xeab4ee80, sourceOffset=0,
    count=10658)
    at 
../../../../../comm-1.9.1/mozilla/modules/libpr0n/src/imgRequest.cpp:995
#9  0xf57f66ec in ProxyListener::OnDataAvailable (this=0xf5bf2ed0,
    aRequest=0xead8650c, ctxt=0x0, inStr=0xeab4ee80, sourceOffset=0,
    count=10658)
    at 
../../../../../comm-1.9.1/mozilla/modules/libpr0n/src/imgLoader.cpp:1603
#10 0xf5944f50 in nsStreamListenerTee::OnDataAvailable (this=0xeab4e7e0,
    request=0xead8650c, context=0x0, input=0xeab4b6a8, offset=0, 
count=10658)
    at 
../../../../../comm-1.9.1/mozilla/netwerk/base/src/nsStreamListenerTee.cpp:97
#11 0xf599b63c in nsHttpChannel::OnDataAvailable (this=0xead864e0,
    request=0xead7c750, ctxt=0x0, input=0xeab4b6a8, offset=0, count=10658)
    at 
../../../../../../comm-1.9.1/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp:5047
#12 0xf592b6a4 in nsInputStreamPump::OnStateTransfer (this=0xead7c750)
    at 
../../../../../comm-1.9.1/mozilla/netwerk/base/src/nsInputStreamPump.cpp:508
#13 0xf592b86c in nsInputStreamPump::OnInputStreamReady (this=0xead7c750,
    stream=0xeab4b6a8)
    at 
../../../../../comm-1.9.1/mozilla/netwerk/base/src/nsInputStreamPump.cpp:---Type 
<return> to continue, or q <return> to quit---
398
#14 0xf7de62a0 in nsInputStreamReadyEvent::Run (this=0xead9e600)
    at ../../../../comm-1.9.1/mozilla/xpcom/io/nsStreamUtils.cpp:111
#15 0xf7dfc6f4 in nsThread::ProcessNextEvent (this=0xf667ef20, mayWait=1,
    result=0xff868ffc)
    at ../../../../comm-1.9.1/mozilla/xpcom/threads/nsThread.cpp:521
#16 0xf7dc5da4 in NS_ProcessNextEvent_P (thread=0xf667ef20, mayWait=1)
    at nsThreadUtils.cpp:247
#17 0xf4ef41e0 in nsBaseAppShell::Run (this=0xf2288570)
    at 
../../../../../comm-1.9.1/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:170
#18 0xf419cc2c in nsAppStartup::Run (this=0xf21485f0)
    at 
../../../../../../comm-1.9.1/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:193
#19 0xf7e6ede8 in XRE_main (argc=<value optimized out>,
    argv=<value optimized out>, aAppData=<value optimized out>)
    at ../../../../comm-1.9.1/mozilla/toolkit/xre/nsAppRunner.cpp:3321
#20 0x000116cc in main (argc=1, argv=0xff8696a4)
    at ../../../comm-1.9.1/suite/app/nsSuiteApp.cpp:103
Current language:  auto; currently c
(gdb)


Reproducible: Always

Steps to Reproduce:
1. open seamonkey 2.0.6 on sparc
2. open http://www.persee.fr
3. clic on "scientific journals" button
4. wait for SIGBUS
Actual Results:  
Seamonkey crashes with SIGBUS.

Comment 1

[Jeff Muizelaar [:jrmuizel]]

This seems like it could be a dup of bug 504766. Can you try with a browser that has the fix to 504766.

Comment 2

[JKB]

Right, I haven't seen this bug. It seems to fix sigbus on sparc.

Thanks.