1585845 - member access within address <addr> with insufficient space for an object of type 'tt_segment_map_t' in gfx/cairo/cairo/src/cairo-truetype-subset.c:1194

Status: RESOLVED FIXED

(Core :: Graphics, defect, P3)

Description

[Tyson Smith [:tsmith]]

This is triggered with an UBSan build. To enable this check add the following to your mozconfig:

ac_add_options --enable-address-sanitizer
ac_add_options --enable-undefined-sanitizer="object-size"
ac_add_options --disable-jemalloc

browser/components/extensions/test/browser/browser_ext_tabs_saveAsPDF.js
gfx/cairo/cairo/src/cairo-truetype-subset.c:1194:27: runtime error: member access within address 0x7ffcea1856e0 with insufficient space for an object of type 'tt_segment_map_t' (aka 'struct _segment_map')
0x7ffcea1856e0: note: pointer points here
 00 00 00 00  00 04 05 a8 00 00 00 00  41 33 cb 53 e2 7f 00 00  04 00 00 00 00 00 00 00  50 58 18 ea
              ^
    #0 0x7fe24df5d076 in _cairo_truetype_reverse_cmap gfx/cairo/cairo/src/cairo-truetype-subset.c:1194:27
    #1 0x7fe24df5d076 in _cairo_truetype_index_to_ucs4 gfx/cairo/cairo/src/cairo-truetype-subset.c:1310
    #2 0x7fe24dff6966 in _cairo_sub_font_glyph_lookup_unicode gfx/cairo/cairo/src/cairo-scaled-font-subsets.c:345:14
    #3 0x7fe24dff6966 in _cairo_sub_font_map_glyph gfx/cairo/cairo/src/cairo-scaled-font-subsets.c:501
    #4 0x7fe24dff5de0 in _cairo_sub_font_create gfx/cairo/cairo/src/cairo-scaled-font-subsets.c:299:11
    #5 0x7fe24dff3517 in _cairo_scaled_font_subsets_map_glyph gfx/cairo/cairo/src/cairo-scaled-font-subsets.c:778:22
    #6 0x7fe24df2bc45 in _cairo_pdf_operators_emit_cluster gfx/cairo/cairo/src/cairo-pdf-operators.c:1305:11
    #7 0x7fe24df2aeab in _cairo_pdf_operators_show_text_glyphs gfx/cairo/cairo/src/cairo-pdf-operators.c:1455:15
    #8 0x7fe24df33b32 in _cairo_pdf_surface_show_text_glyphs gfx/cairo/cairo/src/cairo-pdf-surface.c:6175:11
    #9 0x7fe24e018e92 in _cairo_surface_show_text_glyphs gfx/cairo/cairo/src/cairo-surface.c:2801:15
    #10 0x7fe24df596c1 in _cairo_surface_wrapper_show_text_glyphs gfx/cairo/cairo/src/cairo-surface-wrapper.c:617:14
    #11 0x7fe24dfee58c in _cairo_recording_surface_replay_internal gfx/cairo/cairo/src/cairo-recording-surface.c:952:15
    #12 0x7fe24dfc854f in _paint_page gfx/cairo/cairo/src/cairo-paginated-surface.c:363:11
    #13 0x7fe24dfc7917 in _cairo_paginated_surface_show_page gfx/cairo/cairo/src/cairo-paginated-surface.c:466:14
    #14 0x7fe24e01daa8 in INT__moz_cairo_surface_show_page gfx/cairo/cairo/src/cairo-surface.c:2541:21
    #15 0x7fe247dc01df in mozilla::gfx::PrintTargetPDF::EndPage() gfx/thebes/PrintTargetPDF.cpp:60:3
    #16 0x7fe2477bd40d in nsDeviceContext::EndPage() gfx/src/nsDeviceContext.cpp:579:31
    #17 0x7fe24d148c8f in mozilla::layout::RemotePrintJobParent::PrintPage(mozilla::layout::PRFileDescStream&) layout/printing/ipc/RemotePrintJobParent.cpp:135:29
    #18 0x7fe24d148ba4 in mozilla::layout::RemotePrintJobParent::RecvProcessPage() layout/printing/ipc/RemotePrintJobParent.cpp:114:17
    #19 0x7fe246af0c96 in mozilla::layout::PRemotePrintJobParent::OnMessageReceived(IPC::Message const&) obj-firefox/ipc/ipdl/PRemotePrintJobParent.cpp:282:28
    #20 0x7fe246786479 in mozilla::dom::PContentParent::OnMessageReceived(IPC::Message const&) obj-firefox/ipc/ipdl/PContentParent.cpp:5873:32
    #21 0x7fe246594bfc in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) ipc/glue/MessageChannel.cpp:2185:25
    #22 0x7fe24659197e in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) ipc/glue/MessageChannel.cpp:2109:9
    #23 0x7fe246592bd3 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) ipc/glue/MessageChannel.cpp:1954:3
    #24 0x7fe2465933ee in mozilla::ipc::MessageChannel::MessageTask::Run() ipc/glue/MessageChannel.cpp:1985:13
    #25 0x7fe2455c9b26 in nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp:1225:14
    #26 0x7fe2455d1e8d in NS_ProcessNextEvent(nsIThread*, bool) xpcom/threads/nsThreadUtils.cpp:486:10
    #27 0x7fe24659c3dd in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:110:5
    #28 0x7fe2464d0377 in RunInternal ipc/chromium/src/base/message_loop.cc:315:10
    #29 0x7fe2464d0377 in RunHandler ipc/chromium/src/base/message_loop.cc:308
    #30 0x7fe2464d0377 in MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:290
    #31 0x7fe24c32ddd9 in nsBaseAppShell::Run() widget/nsBaseAppShell.cpp:137:27
    #32 0x7fe24f80ef50 in nsAppStartup::Run() toolkit/components/startup/nsAppStartup.cpp:276:30
    #33 0x7fe24fa301db in XREMain::XRE_mainRun() toolkit/xre/nsAppRunner.cpp:4600:22
    #34 0x7fe24fa32255 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) toolkit/xre/nsAppRunner.cpp:4735:8
    #35 0x7fe24fa33823 in XRE_main(int, char**, mozilla::BootstrapConfig const&) toolkit/xre/nsAppRunner.cpp:4816:21
    #36 0x55c9479317c8 in do_main browser/app/nsBrowserApp.cpp:218:22
    #37 0x55c9479317c8 in main browser/app/nsBrowserApp.cpp:300
    #38 0x7fe26489782f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/../csu/libc-start.c:291
    #39 0x55c947852e18 in _start (/builds/worker/workspace/build/application/firefox/firefox+0x8be18)

Comment 1

[Jessie [:jbonisteel] pls NI]

Lee - any thoughts about this?

Comment 2

[Lee Salzman [:lsalzman]]

Attachment: Bug 1585845 - silence UBSan warning about tt_segment_t in Cairo. r?aosmond

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/97820975d93d
silence UBSan warning about tt_segment_t in Cairo. r=aosmond

Comment 4

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/97820975d93d