Closed
Bug 1020835
Opened 11 years ago
Closed 11 years ago
crash in DestroyBlobFunc
Categories
(Core :: Graphics: Text, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 1018234
People
(Reporter: m_kato, Assigned: m_kato)
Details
(Keywords: crash)
Crash Data
This bug was filed from the Socorro interface and is
report bp-31a4c31e-fc17-47de-b1b0-aeaa72140603.
=============================================================
When accessing IDWriteFontFace on FontTableRect, this crash seems to occur.
After landing emoji support that stored hb_blob_t on gfxFontEntry, crash is spike. But before landing that, it occurs by HBFace.
|
Assignee | |
Comment 1•11 years ago
|
||
I think, mFontFace into gfxDWriteFontEntry is already free by destructor, but we try to access freed mFontFace into FontTableRec?
|
||
Comment 2•11 years ago
|
||
I think this is the same crash as bug 1018234, where a patch is awaiting sec-approval.
Group: core-security
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → DUPLICATE
|
||
Updated•10 years ago
|
Group: core-security → core-security-release
|
||
Updated•9 years ago
|
Group: core-security-release
You need to log in
before you can comment on or make changes to this bug.
Description
•