1072130 - Use-after-poison [@ mozilla::FontFamilyList::FontFamilyList] with unicode-bidi: bidi-override

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox)

Comment 1

[Jesse Ruderman]

Attachment: stack (lldb)

Comment 2

[Jesse Ruderman]

Attachment: stack (ASan)

Comment 3

[Mats Palmgren (inactive)]

In nsLayoutUtils::GetFontMetricsForStyleContext:
3414      nsFont font = aStyleContext->StyleFont()->mFont;

aStyleContext looks fine, the StyleFont() points to a destroyed object,
i.e. memory still allocated but poisoned in the pres shell arena.

Maybe the same underlying problem as bug 1070759?

Comment 4

[Cameron McCormack (:heycam)]

Might be different.  With this bug, if I enable the more expensive style struct destruction checking http://hg.mozilla.org/mozilla-central/file/5e704397529b/layout/style/nsStyleContext.cpp#l89 then it triggers for me:

style struct 0x625000771300 found on style context 0x62500077b7b8
  in file:///tmp/test2.html
Assertion failure: false (destroying Font style struct still present in style context tree), at ./nsStyleStructList.h:44

but not in bug 1070759.

So it's likely this bug is a regression for bug 931668.

Comment 5

[Cameron McCormack (:heycam)]

Attachment: restyle logging output

Using the restyle logging patches from bug 979133 and bug 1072724 I get this output.  Pretty sure we shouldn't be swapping structs for the same-style continuations.

Comment 6

[Cameron McCormack (:heycam)]

Looks like this is a change I was going to have in bug 931668, but when splitting up my patch queue it ended up in the bug 979133 patch (see bug 979133 comment 15's mention of copyFromContinuations).

Comment 7

[Cameron McCormack (:heycam)]

Attachment: patch

Comment 8

[Cameron McCormack (:heycam)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/64136343bb4b

Comment 9

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/64136343bb4b