595423 - "Assertion failed: (_cairo_status_is_error (status))"

Status: RESOLVED WORKSFORME

(Core :: Graphics, defect)

Description

[Jesse Ruderman]

Attachment: testcase (triggers fatal assertion when loaded)

In a debug build:

Assertion failed: (_cairo_status_is_error (status)), function _cairo_error, file gfx/cairo/cairo/src/cairo.c, line 93.

In an opt build:

Usually nothing happens, but sometimes it crashes in a scary way.

Comment 1

[Jesse Ruderman]

Attachment: assertion stack

Comment 2

[Joe Drew (not getting mail)]

Jeff, can you take a look at this?

Comment 3

[Jesse Ruderman]

I still see this on trunk (using Mac OS X 10.5).

Comment 4

[Jeff Muizelaar [:jrmuizel]]

So it looks like the status that goes into _cairo_status_is_error (status) is invalid. Valgrind with track-origins should be able to help here.

Comment 5

[Jesse Ruderman]

Attachment: valgrind output

I don't get anything from Valgrind on this testcase (other than the stuff I always get while starting Firefox, such as bug 602733).

Comment 6

[Jeff Muizelaar [:jrmuizel]]

It looks like the following happens when this fails:

] <Error>: GCGetGlyphIdealMetrics failed: error 1.

We are calling with glyph index of 588

Comment 7

[Jeff Muizelaar [:jrmuizel]]

#include <ApplicationServices/ApplicationServices.h>
#include <dlfcn.h>
#include <stdio.h>

int main() {
    CGFontRef font = CGFontCreateWithFontName(CFSTR("Comic Sans MS"));
    printf("%x\n", font);
    CGGlyph glyph = 588;
    int advance;
    bool ret = CGFontGetGlyphAdvances(font, &glyph, 1, &advance);
    printf("ret:%d\n", ret);
}

This program shows the same problem. So it looks like we shouldn't be asking for glyph 588. I'll assign this over to John to figure out why we're asking for glyph 588.

Comment 8

[Johnny Stenback (:jst)]

jdagget, any updates here?

Comment 9

[Johnny Stenback (:jst)]

jdaggett, ping?

Comment 10

[John Daggett (:jtd)]

Can't reproduce this on either Win7 or 10.6 but can on 10.5:

++DOMWINDOW == 16 (0x2671b5f4) [serial = 18] [outer = 0x22de4690]
Wed Dec  1 17:20:11 itspmpro1.orrice.mozilla.or.jp firefox-bin[18516] <Error>: GCGetGlyphIdealMetrics failed: error 1.
###!!! ASSERTION: XPConnect is being called on a scope without a 'Components' property!: 'Error', file /builds/mozcentral/js/src/xpconnect/src/xpcwrappednativescope.cpp, line 779
###!!! ASSERTION: XPConnect is being called on a scope without a 'Components' property!: 'Error', file /builds/mozcentral/js/src/xpconnect/src/xpcwrappednativescope.cpp, line 779
###!!! ASSERTION: XPConnect is being called on a scope without a 'Components' property!: 'Error', file /builds/mozcentral/js/src/xpconnect/src/xpcwrappednativescope.cpp, line 779
###!!! ASSERTION: XPConnect is being called on a scope without a 'Components' property!: 'Error', file /builds/mozcentral/js/src/xpconnect/src/xpcwrappednativescope.cpp, line 779
Wed Dec  1 17:20:11 itspmpro1.orrice.mozilla.or.jp firefox-bin[18516] <Error>: GCGetGlyphIdealMetrics failed: error 1.
Assertion failed: (_cairo_status_is_error (status)), function _cairo_error, file /builds/mozcentral/gfx/cairo/cairo/src/cairo.c, line 93.

This calls through to abort.

Jesse, what are the "crashes in a scary way" in the description?

Comment 11

[John Daggett (:jtd)]

Note: tests run with latest security update (2010-007, 22-nov-2010).

ProductName:	Mac OS X
ProductVersion:	10.5.8
BuildVersion:	9L30

Comment 12

[Jesse Ruderman]

I can't reproduce the opt crash easily, sorry.

Comment 13

[Daniel Veditz [:dveditz]]

Does this still look like a sg:critical bug?

Comment 14

[Jesse Ruderman]

I get the scary opt crash reliably now (rev c83c130ce23f, loading the testcase from the command line). The stack is totally corrupt, according to both the Mac crash reporter and gdb.

Comment 15

[Mats Palmgren (inactive)]

It's CAIRO_INT_STATUS_UNSUPPORTED that triggers the assert.
It comes from 'CGFontGetGlyphAdvancesPtr' returning false here:
http://hg.mozilla.org/mozilla-central/annotate/4a3866321a14/gfx/cairo/cairo/src/cairo-quartz-font.c#l622

In an Opt build I suspect this propagates up to 'cairo_gstate_show_text_glyphs'
and hits the crash in bug 624198.

Regarding the 588 glyph index, it comes from the CMAP for code point #x0301.
But "CGFontGetNumberOfGlyphs(font)" returns 587 so 588 seems like an invalid
index?  maybe the data in the CMAP is wrong or we misinterpret it somehow?

Anyway, I think the crash fix in bug 624198 will fix the scary part of
this bug.  Jesse, could you try that fix in your Opt build and see if it
fixes the crash you're seeing?

Comment 16

[Jesse Ruderman]

Now I can't reproduce the opt crash (unpatched mozilla-central).

Comment 17

[Jesse Ruderman]

The opt crash is gone, so downgrading to [sg:nse].  But leaving security-sensitive because I guess this testcase reveals bug 624198.

I still get the fatal assertion (in this bug's summary) in debug builds.

Comment 18

[Mats Palmgren (inactive)]

Jesse, can you still reproduce this?  (it WFM in a debug build on OSX)

Comment 19

[Jesse Ruderman]

WFM with Firefox trunk on Mac OS X 10.7.