245930 - GTK2 branch (1.7 and aviary) builds crash on startup on Linux x86_64

Status: RESOLVED FIXED

(Core :: XPCOM, defect)

Description

[Johnny Stenback (:jst)]

We crash at:

#0  0x00000031dae6fd40 in memcpy () from /lib64/tls/libc.so.6
#1  0x0000002a958703b3 in nsCharTraits<char>::copy (
    s1=0x80bfffb577 <Address 0x80bfffb577 out of bounds>, 
    s2=0x2a9aaea63b "-*-*-*-*-*-*-*-*-*-*", n=20) at nsCharTraits.h:318
#2  0x0000002a9586fc06 in nsCSubstring::Replace (this=0x7fbfffb550, 
    cutStart=4294967295, cutLength=0, 
    data=0x2a9aaea63b "-*-*-*-*-*-*-*-*-*-*", length=20)
    at nsTSubstring.cpp:408
#3  0x0000002a95868d31 in nsCSubstring::Insert (this=0x7fbfffb550, 
    data=0x2a9aaea63b "-*-*-*-*-*-*-*-*-*-*", pos=4294967295, 
    length=4294967295) at nsTSubstring.h:261
#4  0x0000002a95868365 in nsACString::Insert (this=0x7fbfffb550, 
    data=0x2a9aaea63b "-*-*-*-*-*-*-*-*-*-*", pos=4294967295)
    at nsTAString.cpp:307
#5  0x0000002a9aacbafe in FFREToXLFDPattern (aFFREName=@0x7fbfffb6c0, 
    oPattern=@0x7fbfffb550)
    at ../../../../mozilla/gfx/src/gtk/nsFontMetricsGTK.cpp:5680

and the crash is due to nsTSubstring::Replace() not checking if the cutStart
argument is greater than the length of the string we're replacing data in. Patch
coming up.

Comment 1

[Johnny Stenback (:jst)]

Attachment: Fix startup crash.

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 150304 [details] [diff] [review]
Fix startup crash.

r=dbaron if you update your tree and fix the recently added ReplaceASCII as
well.

Comment 3

[Johnny Stenback (:jst)]

Yeah... that patch was against an aviary branch tree, where there is no
ReplaceASCII(). I've got that fixed in my trunk tree now. Thanks!

Comment 4

[Johnny Stenback (:jst)]

Attachment: Same thing for the trunk.

Comment 5

[Darin Fisher]

Comment on attachment 150305 [details] [diff] [review]
Same thing for the trunk.

r+sr=darin

Comment 6

[Johnny Stenback (:jst)]

Fix landed on the trunk.

Comment 7

[Asa Dotzler [:asa]]

Comment on attachment 150304 [details] [diff] [review]
Fix startup crash.

a=asa (on behalf of drivers) for checkin to 1.7

Comment 8

[Oliver Klee]

The note that this is broken should be removed from the release notes then, I guess.