Closed
Bug 1020835
Opened 10 years ago
Closed 10 years ago
crash in DestroyBlobFunc
Categories
(Core :: Graphics: Text, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 1018234
People
(Reporter: m_kato, Assigned: m_kato)
Details
(Keywords: crash)
Crash Data
This bug was filed from the Socorro interface and is report bp-31a4c31e-fc17-47de-b1b0-aeaa72140603. ============================================================= When accessing IDWriteFontFace on FontTableRect, this crash seems to occur. After landing emoji support that stored hb_blob_t on gfxFontEntry, crash is spike. But before landing that, it occurs by HBFace.
Assignee | ||
Comment 1•10 years ago
|
||
I think, mFontFace into gfxDWriteFontEntry is already free by destructor, but we try to access freed mFontFace into FontTableRec?
Comment 2•10 years ago
|
||
I think this is the same crash as bug 1018234, where a patch is awaiting sec-approval.
Group: core-security
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → DUPLICATE
Updated•9 years ago
|
Group: core-security → core-security-release
Updated•8 years ago
|
Group: core-security-release
You need to log in
before you can comment on or make changes to this bug.
Description
•