Last Comment Bug 726580 - Uninitialised value use in gfxUtils::GetYCbCrToRGBDestFormatAndSize
: Uninitialised value use in gfxUtils::GetYCbCrToRGBDestFormatAndSize
Status: RESOLVED FIXED
: valgrind
Product: Core
Classification: Components
Component: Audio/Video (show other bugs)
: Trunk
: All All
: -- normal (vote)
: mozilla13
Assigned To: Timothy B. Terriberry (:derf)
:
: Maire Reavy [:mreavy]
Mentors:
Depends on:
Blocks: 715785
  Show dependency treegraph
 
Reported: 2012-02-13 06:49 PST by Julian Seward [:jseward]
Modified: 2012-02-16 03:03 PST (History)
5 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Stop shadowing PlanarYCbCr::mOffscreenFormat (1.35 KB, patch)
2012-02-14 15:44 PST, Timothy B. Terriberry (:derf)
bas: review+
Details | Diff | Splinter Review
Test for shadow clips working correctly on non-rectangular canvases (2.10 KB, patch)
2012-02-14 19:36 PST, Bas Schouten (:bas.schouten)
no flags Details | Diff | Splinter Review

Description Julian Seward [:jseward] 2012-02-13 06:49:28 PST
TEST_PATH=content/media/test/test_buffered.html

(DISPLAY=:3.0 make -C ff-opt mochitest-plain TEST_PATH=content/media/test/test_buffered.html EXTRA_TEST_ARGS='--close-when-done --debugger=/home/sewardj/VgTRUNK/merge/Inst/bin/valgrind --debugger-args="--smc-check=all-non-file --suppressions=/home/sewardj/MOZ/SUPPS/mochitest-mc.supp --error-limit=no --stats=yes --trace-children=yes --child-silent-after-fork=yes '--trace-children-skip=/usr/bin/hg,/bin/rm,*/bin/certutil,*/bin/pk12util,*/bin/ssltunnel,*/bin/uname,*/bin/which,*/bin/ps,*/bin/grep' --tool=memcheck --track-origins=yes --stats=yes"') 2>&1 | tee spew-mc-tmp

The uninitialised value(s) propagate to a whole bunch of use points,
not just this one.  At least judging by the cascade of errors that 
is reported.


Conditional jump or move depends on uninitialised value(s)
   at 0x6DFD3FE: gfxUtils::GetYCbCrToRGBDestFormatAndSize(mozilla::layers::PlanarYCbCrImage::Data const&, gfxASurface::gfxImageFormat&, nsIntSize&) (gfxUtils.cpp:541)
   by 0x6E0EB94: mozilla::layers::BasicPlanarYCbCrImage::SetData(mozilla::layers::PlanarYCbCrImage::Data const&) (BasicImages.cpp:126)
   by 0x67D8156: VideoData::Create(nsVideoInfo&, mozilla::layers::ImageContainer*, long, long, long, VideoData::YCbCrBuffer const&, bool, long, nsIntRect) (nsBuiltinDecoderReader.cpp:188)
   by 0x67DD17E: nsOggReader::DecodeTheora(ogg_packet*, long) (nsOggReader.cpp:473)
   by 0x67DE171: nsOggReader::DecodeVideoFrame(bool&, long) (nsOggReader.cpp:518)
   by 0x67D5D73: nsBuiltinDecoderStateMachine::DecodeLoop() (nsBuiltinDecoderStateMachine.cpp:630)
   by 0x67D70EF: nsBuiltinDecoderStateMachine::DecodeThreadRun() (nsBuiltinDecoderStateMachine.cpp:526)
   by 0x60AAF2D: nsRunnableMethodImpl<void (nsPACMan::*)(), true>::Run() (nsThreadUtils.h:345)
   by 0x6D90E7D: nsThread::ProcessNextEvent(bool, bool*) (nsThread.cpp:657)
   by 0x6D58D59: NS_ProcessNextEvent_P(nsIThread*, bool) (nsThreadUtils.cpp:245)
   by 0x6D90BE4: nsThread::ThreadFunc(void*) (nsThread.cpp:289)
   by 0x41AD102: _pt_root (ptthread.c:187)

 Uninitialised value was created by a heap allocation
   at 0x4029B9A: malloc (vg_replace_malloc.c:263)
   by 0x403DF5B: moz_xmalloc (mozalloc.cpp:103)
   by 0x6E0EE8D: mozilla::layers::BasicImageFactory::CreateImage(mozilla::layers::Image::Format const*, unsigned int, nsIntSize const&, mozilla::layers::BufferRecycleBin*) (mozalloc.h:229)
   by 0x6E359CC: mozilla::layers::ImageContainer::CreateImage(mozilla::layers::Image::Format const*, unsigned int) (ImageLayers.cpp:114)
   by 0x67D808F: VideoData::Create(nsVideoInfo&, mozilla::layers::ImageContainer*, long, long, long, VideoData::YCbCrBuffer const&, bool, long, nsIntRect) (nsBuiltinDecoderReader.cpp:167)
   by 0x67DD17E: nsOggReader::DecodeTheora(ogg_packet*, long) (nsOggReader.cpp:473)
   by 0x67DE171: nsOggReader::DecodeVideoFrame(bool&, long) (nsOggReader.cpp:518)
   by 0x67D5D73: nsBuiltinDecoderStateMachine::DecodeLoop() (nsBuiltinDecoderStateMachine.cpp:630)
   by 0x67D70EF: nsBuiltinDecoderStateMachine::DecodeThreadRun() (nsBuiltinDecoderStateMachine.cpp:526)
   by 0x60AAF2D: nsRunnableMethodImpl<void (nsPACMan::*)(), true>::Run() (nsThreadUtils.h:345)
   by 0x6D90E7D: nsThread::ProcessNextEvent(bool, bool*) (nsThread.cpp:657)
   by 0x6D58D59: NS_ProcessNextEvent_P(nsIThread*, bool) (nsThreadUtils.cpp:245)
Comment 1 Timothy B. Terriberry (:derf) 2012-02-14 15:44:22 PST
Created attachment 597216 [details] [diff] [review]
Stop shadowing PlanarYCbCr::mOffscreenFormat

It looks like bug 715785 added a redundant mOffscreenFormat member in both PlanarYCbCrImage and BasicPlanarYCbCrImage. The GetOffscreenFormat() accessor reads the former, but the BasicPlanarYCbCrImage constructor only initializes the latter. This patch just removes the one in BasicPlanarYCbCrImage.
Comment 2 Bas Schouten (:bas.schouten) 2012-02-14 19:36:27 PST
Created attachment 597281 [details] [diff] [review]
Test for shadow clips working correctly on non-rectangular canvases
Comment 3 Bas Schouten (:bas.schouten) 2012-02-14 19:36:50 PST
Comment on attachment 597281 [details] [diff] [review]
Test for shadow clips working correctly on non-rectangular canvases

Attached to the wrong bug, sorry :)
Comment 4 Timothy B. Terriberry (:derf) 2012-02-15 14:39:09 PST
Greenish on try: https://tbpl.mozilla.org/?tree=Try&rev=5852e3f5d9f2
Pushed to inbound: https://hg.mozilla.org/integration/mozilla-inbound/rev/007fc5981fc3
Comment 5 Marco Bonardo [::mak] 2012-02-16 03:03:50 PST
https://hg.mozilla.org/mozilla-central/rev/007fc5981fc3

Note You need to log in before you can comment on or make changes to this bug.