Open Bug 1561868 Opened 2 years ago Updated 4 days ago

Crash in [@ gfxFontGroup::FindFontForChar]

Categories

(Core :: Layout: Text and Fonts, defect, P3)

69 Branch
defect

Tracking

()

Tracking Status
firefox-esr78 --- affected
firefox69 --- affected
firefox88 --- affected
firefox89 --- affected
firefox90 --- affected

People

(Reporter: whimboo, Unassigned)

References

Details

(Keywords: crash)

Crash Data

Attachments

(2 files)

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0 ID:20190623215020

This bug is for crash report bp-15b512de-721e-4c00-b5b5-789f60190627.

Top 10 frames of crashing thread:

0 XUL gfxFontGroup::FindFontForChar gfx/thebes/gfxTextRun.cpp:3013
1 XUL void gfxFontGroup::InitScriptRun<char16_t> gfx/thebes/gfxTextRun.cpp:2510
2 XUL gfxFontGroup::MakeTextRun gfx/thebes/gfxTextRun.cpp:2304
3 XUL BuildTextRunsScanner::FlushFrames layout/generic/nsTextFrame.cpp:1633
4 XUL BuildTextRunsScanner::ScanFrame layout/generic/nsTextFrame.cpp:1957
5 XUL BuildTextRunsScanner::ScanFrame layout/generic/nsTextFrame.cpp:2011
6 XUL nsTextFrame::EnsureTextRun layout/generic/nsTextFrame.cpp:2891
7 XUL nsTextFrame::AddInlineMinISizeForFlow layout/generic/nsTextFrame.cpp:8084
8 XUL nsTextFrame::AddInlineMinISize layout/generic/nsTextFrame.cpp:8267
9 XUL nsContainerFrame::DoInlineIntrinsicISize layout/generic/nsContainerFrame.cpp:759

I hit this crash only once while kinda fast scrolling through a Slack channel.

Priority: -- → P3

We've seen a few of these in Nightly over the last few weeks, and some in Release as well.

Flags: needinfo?(lsalzman)
Flags: needinfo?(lsalzman) → needinfo?(jfkthame)
Component: Graphics: Text → Layout: Text and Fonts

Some Nightly reports of this look like they may have been bug 1667977, for which a fix recently landed; not all reports look like that, though, so there may be multiple underlying issues. It'll be interesting to see how the crash rate looks in post-1667977 builds...

(Nightly and Release are not at all comparable here, because the gfx.e10s.font-list.shared pref is currently enabled in Nightly but disabled in Release, and so there may be quite different code backing this method. But the pref is set to ride to Release in Fx89, so that factor will be going away.)

Flags: needinfo?(jfkthame)

Steps to reproduce:

  1. Open this page.
  2. Installing/removing the Flags Color World font several times.

See https://youtu.be/LX_AUVt9dGQ

Crash report: bp-3c15fc5d-ae47-422b-9ecb-7c87f0210421

Reason: SIGSEGV /SEGV_MAPERR

Top 10 frames of crashing thread:

0 libxul.so gfxFontGroup::FindFontForChar gfx/thebes/gfxTextRun.cpp:3119
1 libxul.so gfxFontGroup::MakeTextRun gfx/thebes/gfxTextRun.cpp:2470
2 libxul.so BuildTextRunsScanner::BuildTextRunForFrames layout/generic/nsTextFrame.cpp:2562
3 libxul.so BuildTextRunsScanner::FlushFrames layout/generic/nsTextFrame.cpp:1660
4 libxul.so BuildTextRunsScanner::ScanFrame layout/generic/nsTextFrame.cpp:2023
5 libxul.so nsTextFrame::EnsureTextRun layout/generic/nsTextFrame.cpp:2999
6 libxul.so nsTextFrame::ReflowText layout/generic/nsTextFrame.cpp:9264
7 libxul.so nsLineLayout::ReflowFrame layout/generic/nsLineLayout.cpp:878
8 libxul.so nsBlockFrame::DoReflowInlineFrames layout/generic/nsBlockFrame.cpp:4336
9 libxul.so nsBlockFrame::Reflow layout/generic/nsBlockFrame.cpp:1375
Flags: needinfo?(jfkthame)

(In reply to blinky from comment #3)

Steps to reproduce:

  1. Open this page.
  2. Installing/removing the Flags Color World font several times.

Did you also choose the Flags font as the default in Firefox preferences, or something like that? (With default settings, I don't see why it would get used at all.)

Flags: needinfo?(jfkthame)

No, I did not choose the Flags font as the default in Firefox preferences.

I can reproduce the crash with other fonts, but with this font, reproduce it more easily.

Oh, sorry - I misunderstood what I was seeing, it's not a plaintext document but has CSS that specifies the font. OK, that makes sense. I'll try to reproduce and pin down why it's breaking. Thanks!

This crash signature's volume has jumped in Nightly recently: from 2 crashes in Nightly 85.0a1 (and 0 in 86.0a1) to 157 in 89.0a1 and 62 in 90.0a1. So perhaps related to the fix for SearchAllFontsForChar crash bug 1667977 landing in 89.0a1?

But not many users are affected: the 157 crashes from 89.0a1 are only from 18 users and the 62 crashes from 90.0a1 are from only 5 users, so far.

OS: Unspecified → All
Hardware: Unspecified → All
See Also: → 1667977
Attached file lbzlymqrak.html

Attaching blinky's test files to this bug for posterity.

You need to log in before you can comment on or make changes to this bug.