Crash in std::map<T>::_Try_emplace<T> called from woff2::`anonymous namespace'::WriteHeaders()

NEW
Unassigned

Status

()

Core
Graphics: Text
P3
critical
10 months ago
6 months ago

People

(Reporter: jesup, Unassigned)

Tracking

(Depends on: 2 bugs, {crash, regression})

53 Branch
x86
Windows
crash, regression
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox52 wontfix, firefox53 fix-optional, firefox54 unaffected, firefox55 unaffected)

Details

(Whiteboard: gfx-noted, crash signature)

(Reporter)

Description

10 months ago
+++ This bug was initially created as a clone of Bug #1351993 +++

This is for crashes where Try_emplace is called from woff2::`anonymous namespace'::WriteHeaders() (processing fonts)

There are only 7 of these crashes, all in 52.  All but one are within a few seconds of startup (often 1 second), and the longest is 147 seconds.

The address is oddly identical in a bunch of them, and I strongly suspect this is one single user.  4 of them are certainly identical.

See https://crash-stats.mozilla.com/report/index/0c802ac6-1bdf-4c38-9931-3a94e2170331

Updated

10 months ago
status-firefox52: --- → unaffected
status-firefox53: --- → affected
status-firefox54: --- → unaffected
status-firefox55: --- → unaffected
Jonathan, anything that jumps out?  We start at gfxUserFontEntry::SanitizeOpenTypeData(unsigned char const*, unsigned int, unsigned int&, gfxUserFontType)
Component: Graphics → Graphics: Text
Flags: needinfo?(jfkthame)

Updated

10 months ago
status-firefox52: unaffected → wontfix
status-firefox53: affected → fix-optional
Or perhaps, the question is - is this the same as bug 1322660?
(In reply to Milan Sreckovic [:milan] from comment #2)
> Or perhaps, the question is - is this the same as bug 1322660?

That bug would only be an issue on architectures where unaligned memory access results in a crash (which I don't think is the case on Windows machines, is it?)
Flags: needinfo?(jfkthame)

Updated

10 months ago
Whiteboard: gfx-noted
Priority: -- → P3
You need to log in before you can comment on or make changes to this bug.