Closed Bug 1020835 Opened 10 years ago Closed 10 years ago

crash in DestroyBlobFunc

Categories

(Core :: Graphics: Text, defect)

All
Windows 8.1
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 1018234

People

(Reporter: m_kato, Assigned: m_kato)

Details

(Keywords: crash)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-31a4c31e-fc17-47de-b1b0-aeaa72140603.
=============================================================

When accessing IDWriteFontFace on FontTableRect, this crash seems to occur.
After landing emoji support that stored hb_blob_t on gfxFontEntry, crash is spike.  But before landing that, it occurs by HBFace.
I think, mFontFace into gfxDWriteFontEntry is already free by destructor, but we try to access freed mFontFace into FontTableRec?
I think this is the same crash as bug 1018234, where a patch is awaiting sec-approval.
Group: core-security
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → DUPLICATE
Group: core-security → core-security-release
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.