750190 - crash in FastConvertYUVToRGB32Row_SSE

Status: RESOLVED DUPLICATE of bug 672870

(Core :: Graphics, defect)

Description

[Carsten Book [:Tomcat]]

This bug was filed from the Socorro interface and is 
report bp-7ddec5f9-2cd4-46cc-8756-559fb2120430 .
============================================================= 

found in the top changers list for Firefox 12. crash in FastConvertYUVToRGB32Row_SSE - see reports:
https://crash-stats.mozilla.com/report/list?range_value=3&range_unit=days&signature=FastConvertYUVToRGB32Row_SSE&version=Firefox%3A12.0

Winxp/Win7 Crash so far

Crashing Thread
Frame 	Module 	Signature 	Source
0 	xul.dll 	FastConvertYUVToRGB32Row_SSE 	gfx/ycbcr/yuv_row_win.cpp:46
1 	xul.dll 	mozilla::gfx::ConvertYCbCrToRGB32 	gfx/ycbcr/yuv_convert.cpp:96
2 	xul.dll 	gfxUtils::ConvertYCbCrToRGB 	gfx/thebes/gfxUtils.cpp:655
3 	mozjs.dll 	js::mjit::Compiler::fixPrimitiveReturn 	js/src/methodjit/Compiler.cpp:3709
4 	xul.dll 	VideoData::Create 	content/media/nsBuiltinDecoderReader.cpp:188
5 		@0x1df 	
6 	xul.dll 	nsBuiltinDecoderStateMachine::DecodeLoop 	content/media/nsBuiltinDecoderStateMachine.cpp:630
7 	xul.dll 	nsRunnableMethodImpl<void 	
8 	xul.dll 	nsRunnable::Release 	obj-firefox/xpcom/build/nsThreadUtils.cpp:55
9 	xul.dll 	nsBuiltinDecoderStateMachine::DecodeThreadRun 	content/media/nsBuiltinDecoderStateMachine.cpp:526
10 	xul.dll 	mozilla::net::FTPChannelChild::QueryInterface 	netwerk/protocol/ftp/FTPChannelChild.cpp:106
11 	xul.dll 	nsRunnableMethodImpl<void 	obj-firefox/dist/include/nsThreadUtils.h:345
12 	ntdll.dll 	RtlpAdjustHeapLookasideDepth 	
13 	mozglue.dll 	mozglue.dll@0x36ff 	
14 	xul.dll 	nsThreadStartupEvent::`scalar deleting destructor' 	
15 	xul.dll 	nsRunnable::Release 	obj-firefox/xpcom/build/nsThreadUtils.cpp:55
16 	nspr4.dll 	_MD_CURRENT_THREAD 	nsprpub/pr/src/md/windows/w95thred.c:308
17 	nspr4.dll 	_PR_NativeRunThread 	nsprpub/pr/src/threads/combined/pruthr.c:426
18 	msvcr80.dll 	_callthreadstartex 	f:\sp\vctools\crt_bld\self_x86\crt\src\threadex.c:355
19 	msvcr80.dll 	_getptd_noexit 	f:\sp\vctools\crt_bld\self_x86\crt\src\tidtable.c:633
20 	nspr4.dll 	pr_root 	nsprpub/pr/src/md/windows/w95thred.c:122
21 	msvcr80.dll 	_callthreadstartex 	f:\sp\vctools\crt_bld\self_x86\crt\src\threadex.c:348
22 	msvcr80.dll 	_threadstartex 	f:\sp\vctools\crt_bld\self_x86\crt\src\threadex.c:326
23 	kernel32.dll 	BaseThreadStart

Comment 1

[Scoobidiver (away)]

It's #203 browser crasher in 12.0.

Comment 2

[Matthew Gregan [:kinetik]]

If the line numbers are trustworthy, bp-7ddec5f9-2cd4-46cc-8756-559fb2120430 is crashing by writing to the heap outside of the allocated target RGB buffer.  That's a bug I haven't seen before.

All of the crashes showing up in the search query in comment 0 are *read* violations, which (as long as they're occurring in Firefox 12 and earlier -- see bug 789075 comment 41 and bug 715785) could be the same issue as bug 789075.

Without a way to reproduce or more data, I'm not sure what to do with this bug right now.

Comment 3

[u279076]

This crash still gets reported frequently although not at topcrash level. Currently we have 259 reports against Firefox 46.0.1. This is most commonly reported while browsing facebook.com.

Comment 4

[u279076]

I believe this is a dupe of bug 672870.