1114677 - crash in SkScalerContext_CairoFT::generateGlyphCount()

Status: RESOLVED INCOMPLETE

(Core :: Graphics: Text, defect)

Description

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

This bug was filed from the Socorro interface and is 
report bp-4f295558-d0ff-4c7d-a890-d08022141220.
=============================================================
Crashing Thread
Frame 	Module 	Signature 	Source
0 	libxul.so 	SkScalerContext_CairoFT::generateGlyphCount() 	gfx/skia/trunk/src/ports/SkFontHost_cairo.cpp
1 	libxul.so 	RunnableMethodTraits<FdWatcher>::ReleaseCallee(FdWatcher*) 	ipc/chromium/src/base/task.h
2 	libxul.so 	SkScalerContext::getGlyphContext(SkGlyph const&) 	gfx/skia/trunk/src/core/SkScalerContext.cpp
3 	libxul.so 	SkScalerContext::getMetrics(SkGlyph*) 	gfx/skia/trunk/src/core/SkScalerContext.cpp
4 	libxul.so 	SkGlyphCache::lookupMetrics(unsigned int, SkGlyphCache::MetricsType) 	gfx/skia/trunk/src/core/SkGlyphCache.cpp
5 	libxul.so 	SkGlyphCache::getGlyphIDMetrics(unsigned short) 	gfx/skia/trunk/src/core/SkGlyphCache.cpp
6 	libxul.so 	GrBitmapTextContext::drawPosText(GrPaint const&, SkPaint const&, char const*, unsigned int, float const*, float, int) 	gfx/skia/trunk/src/gpu/GrBitmapTextContext.cpp
7 	libxul.so 	SkGpuDevice::drawPosText(SkDraw const&, void const*, unsigned int, float const*, float, int, SkPaint const&) 	gfx/skia/trunk/src/gpu/SkGpuDevice.cpp
8 	libxul.so 	SkCanvas::onDrawPosText(void const*, unsigned int, SkPoint const*, SkPaint const&) 	gfx/skia/trunk/src/core/SkCanvas.cpp
9 	libxul.so 	SkCanvas::drawPosText(void const*, unsigned int, SkPoint const*, SkPaint const&) 	gfx/skia/trunk/src/core/SkCanvas.cpp
10 	libxul.so 	mozilla::gfx::DrawTargetSkia::FillGlyphs(mozilla::gfx::ScaledFont*, mozilla::gfx::GlyphBuffer const&, mozilla::gfx::Pattern const&, mozilla::gfx::DrawOptions const&, mozilla::gfx::GlyphRenderingOptions const*) 	gfx/2d/DrawTargetSkia.cpp
11 	libxul.so 	mozilla::dom::CanvasBidiProcessor::DrawText(int, int) 	dom/canvas/CanvasRenderingContext2D.cpp
12 	libxul.so 	nsBidiPresUtils::ProcessText(char16_t const*, int, unsigned char, nsPresContext*, nsBidiPresUtils::BidiProcessor&, nsBidiPresUtils::Mode, nsBidiPositionResolve*, int, int*, nsBidi*) 	layout/base/nsBidiPresUtils.cpp
13 	libxul.so 	mozilla::dom::CanvasRenderingContext2D::DrawOrMeasureText(nsAString_internal const&, float, float, mozilla::dom::Optional<double> const&, mozilla::dom::CanvasRenderingContext2D::TextDrawOperation, float*) 	dom/canvas/CanvasRenderingContext2D.cpp
14 	libxul.so 	mozilla::dom::CanvasRenderingContext2D::FillText(nsAString_internal const&, double, double, mozilla::dom::Optional<double> const&, mozilla::ErrorResult&) 	dom/canvas/CanvasRenderingContext2D.cpp
15 	libxul.so 	mozilla::dom::CanvasRenderingContext2DBinding::fillText 	/builds/slave/b2g_m-cen_flm-kk_ntly-00000000/build/objdir-gecko/dom/bindings/CanvasRenderingContext2DBinding.cpp:3816
16 	libxul.so 	mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) 	dom/bindings/BindingUtils.cpp
17 		@0xb344fafe 	

Seems to be happening on fennec as well as b2g flame, gp keon

See: https://crash-stats.mozilla.com/report/list?signature=SkScalerContext_CairoFT%3A%3AgenerateGlyphCount%28%29#tab-reports

Sample app : http://mazeclimber.short2games.com/manifest.webapp

Comment 1

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

I can't seem to crash with that app; I'm not 100 % sure how to cause the crash as of yet with the web page mentioned.  Still experimenting.

Comment 2

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

tried zooming/change in orientation with arabic so far.  There seems to also be a way to get to other pages from this game, so I'm not sure if it's within the game or outside...

Comment 3

[u279076]

There was a pretty big spike in these crashes back in August but all reports stop after Fennec 45. Closing as incomplete.