1288872 - SEGV on unknown address 0x10 in [@SkScalerContext_CairoFT::computeShapeMatrix]

Status: RESOLVED FIXED

(Core :: Graphics: Canvas2D, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: log.txt

This is a fuzz blocker. It is triggered every 5 or so iterations. Please fix ASAP.

Repros on non ASan and non debug builds.

Log from an ASan build:
==4488==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x7f0089579116 bp 0x7ffd7524a610 sp 0x7ffd7524a4a0 T0)
    #0 0x7f0089579115 in SkScalerContext_CairoFT::computeShapeMatrix(SkMatrix const&) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/ports/SkFontHost_cairo.cpp:529:10
    #1 0x7f0089578a01 in SkScalerContext_CairoFT::SkScalerContext_CairoFT(SkTypeface*, SkDescriptor const*, _cairo_font_face*, _FcPattern*) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/ports/SkFontHost_cairo.cpp:315:5
    #2 0x7f008957c3aa in SkCairoFTTypeface::onCreateScalerContext(SkDescriptor const*) const /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/ports/SkFontHost_cairo.cpp:191:20
    #3 0x7f0089aa4572 in SkTypeface::createScalerContext(SkDescriptor const*, bool) const /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/core/SkScalerContext.cpp:883:26
    #4 0x7f008999c36c in SkGlyphCache::VisitCache(SkTypeface*, SkDescriptor const*, bool (*)(SkGlyphCache const*, void*), void*) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/core/SkGlyphCache.cpp:545:32
    #5 0x7f0089a23616 in DetachCache /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/core/SkGlyphCache.h:150:16
    #6 0x7f0089a23616 in DetachDescProc(SkTypeface*, SkDescriptor const*, void*) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/core/SkPaint.cpp:435
    #7 0x7f0089a1c750 in SkPaint::descriptorProc(SkSurfaceProps const*, SkPaint::FakeGamma, SkMatrix const*, void (*)(SkTypeface*, SkDescriptor const*, void*), void*) const /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/core/SkPaint.cpp:1707:5
    #8 0x7f0089a23599 in SkPaint::detachCache(SkSurfaceProps const*, SkPaint::FakeGamma, SkMatrix const*) const /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/core/SkPaint.cpp:1714:5
    #9 0x7f00898b19c8 in SkAutoGlyphCache /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/core/SkGlyphCache.h:294:21
    #10 0x7f00898b19c8 in SkDraw::drawPosText(char const*, unsigned long, float const*, int, SkPoint const&, SkPaint const&) const /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/core/SkDraw.cpp:1668
    #11 0x7f00895a052a in SkBitmapDevice::drawPosText(SkDraw const&, void const*, unsigned long, float const*, int, SkPoint const&, SkPaint const&) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/core/SkBitmapDevice.cpp:345:5
...
see log.txt for full log.

Comment 1

[Tyson Smith [:tsmith]]

Attachment: test_case.html

Comment 2

[Lee Salzman [:lsalzman]]

Attachment: verify cairo_scaled_font creation succeeds in SkFontHost_cairo

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/0a819a2a98f6
verify cairo_scaled_font creation succeeds in SkFontHost_cairo. r=mchang

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/0a819a2a98f6