Closed Bug 1288872 Opened 4 years ago Closed 4 years ago

SEGV on unknown address 0x10 in [@SkScalerContext_CairoFT::computeShapeMatrix]

Categories

(Core :: Canvas: 2D, defect, critical)

50 Branch
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla50
Tracking Status
firefox50 --- fixed

People

(Reporter: tsmith, Assigned: lsalzman)

References

(Blocks 2 open bugs)

Details

(Keywords: crash, testcase, Whiteboard: [fuzzblocker])

Attachments

(3 files)

Attached file log.txt
This is a fuzz blocker. It is triggered every 5 or so iterations. Please fix ASAP.

Repros on non ASan and non debug builds.

Log from an ASan build:
==4488==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x7f0089579116 bp 0x7ffd7524a610 sp 0x7ffd7524a4a0 T0)
    #0 0x7f0089579115 in SkScalerContext_CairoFT::computeShapeMatrix(SkMatrix const&) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/ports/SkFontHost_cairo.cpp:529:10
    #1 0x7f0089578a01 in SkScalerContext_CairoFT::SkScalerContext_CairoFT(SkTypeface*, SkDescriptor const*, _cairo_font_face*, _FcPattern*) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/ports/SkFontHost_cairo.cpp:315:5
    #2 0x7f008957c3aa in SkCairoFTTypeface::onCreateScalerContext(SkDescriptor const*) const /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/ports/SkFontHost_cairo.cpp:191:20
    #3 0x7f0089aa4572 in SkTypeface::createScalerContext(SkDescriptor const*, bool) const /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/core/SkScalerContext.cpp:883:26
    #4 0x7f008999c36c in SkGlyphCache::VisitCache(SkTypeface*, SkDescriptor const*, bool (*)(SkGlyphCache const*, void*), void*) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/core/SkGlyphCache.cpp:545:32
    #5 0x7f0089a23616 in DetachCache /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/core/SkGlyphCache.h:150:16
    #6 0x7f0089a23616 in DetachDescProc(SkTypeface*, SkDescriptor const*, void*) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/core/SkPaint.cpp:435
    #7 0x7f0089a1c750 in SkPaint::descriptorProc(SkSurfaceProps const*, SkPaint::FakeGamma, SkMatrix const*, void (*)(SkTypeface*, SkDescriptor const*, void*), void*) const /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/core/SkPaint.cpp:1707:5
    #8 0x7f0089a23599 in SkPaint::detachCache(SkSurfaceProps const*, SkPaint::FakeGamma, SkMatrix const*) const /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/core/SkPaint.cpp:1714:5
    #9 0x7f00898b19c8 in SkAutoGlyphCache /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/core/SkGlyphCache.h:294:21
    #10 0x7f00898b19c8 in SkDraw::drawPosText(char const*, unsigned long, float const*, int, SkPoint const&, SkPaint const&) const /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/core/SkDraw.cpp:1668
    #11 0x7f00895a052a in SkBitmapDevice::drawPosText(SkDraw const&, void const*, unsigned long, float const*, int, SkPoint const&, SkPaint const&) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/gfx/skia/skia/src/core/SkBitmapDevice.cpp:345:5
...
see log.txt for full log.
Attached file test_case.html
Assignee: nobody → lsalzman
Status: NEW → ASSIGNED
Attachment #8774001 - Flags: review?(mchang)
Attachment #8774001 - Flags: review?(mchang) → review+
Pushed by lsalzman@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/0a819a2a98f6
verify cairo_scaled_font creation succeeds in SkFontHost_cairo. r=mchang
https://hg.mozilla.org/mozilla-central/rev/0a819a2a98f6
Status: ASSIGNED → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla50
Blocks: 1289929, grizzly
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.