1398458 - Crash in WeightStyleStretchDistance

Status: RESOLVED FIXED

(Core :: Layout: Text and Fonts, defect)

Description

[Calixte Denizet (:calixte)]

This bug was filed from the Socorro interface and is 
report bp-1174aabd-7e05-48f1-a655-13f780170909.
=============================================================

There are 214 crashes in nightly 57 with buildid 20170908220146. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1397238.

[1] https://hg.mozilla.org/mozilla-central/rev/1c70e1ffbbbd

Comment 1

[Bob Clary [:bc] (inactive)]

[Tracking Requested - why for this release]: regression

Bughunter reproduced with https://shopee.co.id/pc_event/?smtt=201.3167&url=https://shopee.co.id/events3/code/3151862372/%3Fsmtt=201.3167 and 7 others on Windows 7 debug. I manually reproduced on Windows 7 opt.

bp-1cc2ec7f-d363-46eb-b141-3b3a70170909
bp-36287508-7a69-4db9-9d26-e4ecf0170909
bp-c86aaf3d-f4ae-480d-86cf-814110170909

Comment 2

[Jonathan Kew [:jfkthame]]

I have pushed a try build with a patch that I think should resolve this, if my understanding of the cause is correct:

https://treeherder.mozilla.org/#/jobs?repo=try&revision=3542832442e6bcd03b369e8ae48929df981625cb

If you could test this once builds are available, that would be really helpful -- thanks!

Comment 3

[Bob Clary [:bc] (inactive)]

I tested opt and debug on Windows 7 64bit with the now 11 urls where this reproduced on Bughunter and did not see a crash.

Comment 4

[Jonathan Kew [:jfkthame]]

Great, thanks for testing. That suggests I was right about the cause of the failure here.

Comment 5

[Jonathan Kew [:jfkthame]]

Attachment: Ensure we don't leave null gfxFontEntry records in a formerly 'simple' gfxFontFamily when adding extra faces

Turns out the previous fix was incomplete, as it could leave unexpected null entries, leading to the crash here.

Comment 6

[Cameron McCormack (:heycam)]

Comment on attachment 8906314 [details] [diff] [review]
Ensure we don't leave null gfxFontEntry records in a formerly 'simple' gfxFontFamily when adding extra faces

Review of attachment 8906314 [details] [diff] [review]:
-----------------------------------------------------------------

::: gfx/thebes/gfxFontEntry.h
@@ +650,5 @@
> +        // If we're adding a face to a family that has been marked as "simple",
> +        // we need to ensure any null entries are removed, as well as clearing
> +        // the flag (which may be set again later).
> +        if (mIsSimpleFamily) {
> +            for (unsigned i = mAvailableFonts.Length() - 1; i-- > 0; ) {

size_t rather than unsigned

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/146cf615f80d
Ensure we don't leave null gfxFontEntry records in a formerly 'simple' gfxFontFamily when adding extra faces. r=heycam

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/146cf615f80d

Comment 9

[Nicholas Nethercote [inactive]]

This is the #2 Windows topcrash in Nightly 20170908220146.

Comment 10

[Nicholas Nethercote [inactive]]

(In reply to Nicholas Nethercote [:njn] from comment #9)
> This is the #2 Windows topcrash in Nightly 20170908220146.

And #1 on Mac.

Comment 12

[Jonathan Kew [:jfkthame]]

Crash-stats doesn't show any reports with build IDs later than 20170910100150 (i.e. the last Nightly before this landed). Some reports are still coming in from older builds, of course, but they should drop off rapidly as people update.