Closed Bug 1288872 Opened 7 years ago Closed 7 years ago

SEGV on unknown address 0x10 in [@SkScalerContext_CairoFT::computeShapeMatrix]

Categories

(Core :: Graphics: Canvas2D, defect)

Product:
Core
Component:
Graphics: Canvas2D
Version:
50 Branch
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla50
Tracking Flags:
Tracking Status
firefox50 --- fixed

People

(Reporter: tsmith, Assigned: lsalzman)

References

(Blocks 1 open bug)

Details

(Keywords: crash, testcase, Whiteboard: [fuzzblocker])

Attachments

(3 files)

log.txt
12.04 KB, text/plain
Details
test_case.html
148 bytes, text/html
Details
verify cairo_scaled_font creation succeeds in SkFontHost_cairo
4.17 KB, patch
mchang
: review+
Details | Diff | Splinter Review
Attached file log.txt — 
This is a fuzz blocker. It is triggered every 5 or so iterations. Please fix ASAP.

Repros on non ASan and non debug builds.

Log from an ASan build:
==4488==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x7f0089579116 bp 0x7ffd7524a610 sp 0x7ffd7524a4a0 T0)
    #0 0x7f0089579115 in SkScalerContext_CairoFT::computeShapeMatrix(SkMatrix const&) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/ports/SkFontHost_cairo.cpp:529:10
    #1 0x7f0089578a01 in SkScalerContext_CairoFT::SkScalerContext_CairoFT(SkTypeface*, SkDescriptor const*, _cairo_font_face*, _FcPattern*) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/ports/SkFontHost_cairo.cpp:315:5
    #2 0x7f008957c3aa in SkCairoFTTypeface::onCreateScalerContext(SkDescriptor const*) const /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/ports/SkFontHost_cairo.cpp:191:20
    #3 0x7f0089aa4572 in SkTypeface::createScalerContext(SkDescriptor const*, bool) const /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/core/SkScalerContext.cpp:883:26
    #4 0x7f008999c36c in SkGlyphCache::VisitCache(SkTypeface*, SkDescriptor const*, bool (*)(SkGlyphCache const*, void*), void*) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/core/SkGlyphCache.cpp:545:32
    #5 0x7f0089a23616 in DetachCache /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/core/SkGlyphCache.h:150:16
    #6 0x7f0089a23616 in DetachDescProc(SkTypeface*, SkDescriptor const*, void*) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/core/SkPaint.cpp:435
    #7 0x7f0089a1c750 in SkPaint::descriptorProc(SkSurfaceProps const*, SkPaint::FakeGamma, SkMatrix const*, void (*)(SkTypeface*, SkDescriptor const*, void*), void*) const /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/core/SkPaint.cpp:1707:5
    #8 0x7f0089a23599 in SkPaint::detachCache(SkSurfaceProps const*, SkPaint::FakeGamma, SkMatrix const*) const /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/core/SkPaint.cpp:1714:5
    #9 0x7f00898b19c8 in SkAutoGlyphCache /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/core/SkGlyphCache.h:294:21
    #10 0x7f00898b19c8 in SkDraw::drawPosText(char const*, unsigned long, float const*, int, SkPoint const&, SkPaint const&) const /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/core/SkDraw.cpp:1668
    #11 0x7f00895a052a in SkBitmapDevice::drawPosText(SkDraw const&, void const*, unsigned long, float const*, int, SkPoint const&, SkPaint const&) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/core/SkBitmapDevice.cpp:345:5
...
see log.txt for full log.
Attached file test_case.html — 

    
    

    
  


  
Assignee: nobody → lsalzman
Status: NEW → ASSIGNED

        Attachment #8774001 -
        Flags: review?(mchang)

        Attachment #8774001 -
        Flags: review?(mchang) → review+

    
    

    
  
Pushed by lsalzman@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/0a819a2a98f6
verify cairo_scaled_font creation succeeds in SkFontHost_cairo. r=mchang

    
    

    
  
https://hg.mozilla.org/mozilla-central/rev/0a819a2a98f6
Status: ASSIGNED → RESOLVED
Closed: 7 years ago

          status-firefox50:
          affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla50

    
  
Blocks: grizzly
Flags: in-testsuite+

          You need to log in
          before you can comment on or make changes to this bug.