856402 - Crash [@ nsUserFontSet::LogMessage] removing a stylesheet while a font loads

Status: RESOLVED FIXED

(Core :: Graphics: Text, defect)

Description

[Jesse Ruderman]

Attachment: testcase (see comment 0)

1. mkdir -p ~/px/y
2. cp ~/Desktop/prefs.js ~/px/y/
3. firefox -profile ~/px/y/ ~/Desktop/h.html

prefs.js:
  user_pref("security.fileuri.strict_origin_policy", false);

The testcase timing is fragile.  You might have to try with several setTimeout values, CLEARING THE PROFILE DIRECTORY each time (!?).

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[Jesse Ruderman]

Attachment: stack (context + blame)

Comment 3

[John Daggett (:jtd)]

Did you mean to leave an un-closed comment in the <style> section?  Guessing not...

Comment 4

[John Daggett (:jtd)]

Attachment: patch, null-check the result of GetParentStyleSheet

GetParentStyleSheet can null the parent sheet pointer but return NS_OK, so need to null-check this before use.

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 732668 [details] [diff] [review]
patch, null-check the result of GetParentStyleSheet

>+    // bug 856402 - GetParentStyleSheet can return a null sheet ptr

I'd drop the bug number, but add "if the style sheet is removed while the font is loading", so that the comment explains why it can be null

r=dbaron

Comment 6

[John Daggett (:jtd)]

Pushed to mozilla-inbound
https://hg.mozilla.org/integration/mozilla-inbound/rev/cec16f7093d6

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/cec16f7093d6

Comment 8

[Jesse Ruderman]

(In reply to John Daggett (:jtd) from comment #3)
> Did you mean to leave an un-closed comment in the <style> section?  Guessing
> not...

I did mean to do that.  The script removes the comment, activating the contents of the stylesheet.

There might be a better way to construct a testcase ;)