Open Bug 1353657 Opened 3 years ago Updated 2 years ago

Crash in nsFont::Equals

Categories

(Core :: Graphics: Text, defect, P3, critical)

Unspecified
Windows 8
defect

Tracking

()

Tracking Status
firefox55 --- affected

People

(Reporter: ting, Unassigned)

Details

(Keywords: crash, Whiteboard: gfx-noted)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-26362ce3-9b09-4263-a348-8c9442170404.
=============================================================
Top #30 of Nightly 20170402030202 on Windows; 84 reports from 50 installations in the past week.
According to the minidump, we may dereference a nullptr at [1] to cause the crash, which means the "other##struct_" is nullptr. Based on [2], it looks like we may return nullptr in the DoGetStyle##name_(). i will investigate further.

[1] https://hg.mozilla.org/releases/mozilla-beta/annotate/8b7e2a303954/layout/style/nsStyleContext.cpp#l1098
[2] https://hg.mozilla.org/releases/mozilla-beta/annotate/8b7e2a303954/layout/style/nsStyleContext.h#l621
Style##name_() method is not supposed to ever return nullptr. It would be a big problem if that invariant doesn't hold.
(In reply to Xidorn Quan [:xidorn] UTC+10 from comment #2)
> Style##name_() method is not supposed to ever return nullptr. It would be a
> big problem if that invariant doesn't hold.

Right, I also discussed with heycam. It looks like Style##name_() will always return a non-nullptr. So I have no idea right now.
Whiteboard: gfx-noted
You need to log in before you can comment on or make changes to this bug.