1616193 - Crash in [@ mozilla::ipc::MessageChannel::CxxStackFrame::CxxStackFrame | mozilla::ipc::MessageChannel::Send | mozilla::ipc::IProtocol::ChannelSend]

Status: VERIFIED FIXED

(Core :: Layout: Text and Fonts, defect, P3)

Description

[blinky]

Steps to reproduce:

1. Set gfx.e10s.font-list.shared to true.
2. Restart Firefox.
3. Download Font Loader.
4. Download Franklin Gothic Book Regular.ttf.
5. Open https://www.w3.org/TR/css-text-3/.
6. Open the Font Loader, Click on the Add Fonts button, Select the font file Franklin Gothic Book Regular.ttf then click Open.
7. Click on the Load button.

Actual results:

The tab crashed.
This also happens on startup.

Crash report: bp-a836c75e-d20f-4d68-bd78-ce16e0200218

Top 10 frames of crashing thread:

0 xul.dll mozilla::ipc::MessageChannel::CxxStackFrame::CxxStackFrame ipc/glue/MessageChannel.cpp:231
1 xul.dll mozilla::ipc::MessageChannel::Send ipc/glue/MessageChannel.cpp:1003
2 xul.dll mozilla::ipc::IProtocol::ChannelSend ipc/glue/ProtocolUtils.cpp:477
3 xul.dll mozilla::dom::PContentChild::SendSetCharacterMap ipc/ipdl/PContentChild.cpp:5847
4 xul.dll mozilla::fontlist::Face::SetCharacterMap gfx/thebes/SharedFontList.cpp:95
5 xul.dll gfxDWriteFontEntry::ReadCMAP gfx/thebes/gfxDWriteFontList.cpp:525
6 xul.dll gfxFontEntry::TestCharacterMap gfx/thebes/gfxFontEntry.cpp:164
7 xul.dll gfxFontGroup::GetFirstValidFont gfx/thebes/gfxTextRun.cpp:2100
8 xul.dll nsFontMetrics::XHeight gfx/src/nsFontMetrics.cpp:163
9 xul.dll Gecko_GetFontMetrics layout/style/GeckoBindings.cpp:1487

Comment 1

[blinky]

Regression range:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=22d3cd05bacfefefb8f53a89ab63166f7e775c9d&tochange=780285749c804b0b84c3607d362cd9905c286512

Regressed by: bug 1611617

Comment 2

[Jonathan Kew [:jfkthame]]

Yeah, I just hit this locally too (during normal browsing, no special testcase/STR). The change in bug 1611617 made us potentially load character maps at times we didn't previously, and in particular it can happen during stylo traversal, where we're not allowed to do IPC.

I suspect this may have been possible previously, but the recent change made it much more likely. We need to make SetCharacterMap check whether it's on the main thread, and if not, post a runnable instead of trying to do the IPC directly.

Comment 3

[Jonathan Kew [:jfkthame]]

Attachment: Bug 1616193 - If Face::SetCharacterMap is called from a stylo thread, make it post a runnable instead of attempting to do IPC itself. r=jwatt

Comment 4

[Jonathan Kew [:jfkthame]]

Try build should appear at https://treeherder.mozilla.org/#/jobs?repo=try&revision=08c57d43c4a6f4428e8ce286ad4bdc942724b5b4.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/eeef960d6919
If Face::SetCharacterMap is called from a stylo thread, make it post a runnable instead of attempting to do IPC itself. r=jwatt

Comment 6

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/mozilla-central/rev/eeef960d6919

Comment 7

[Bogdan Maris, Desktop QA]

Could not reproduce the crash in the first place using older versions of Firefox 73.0.1, 74.0b9 so I can't say this is verified. Blinky can you please check if 75.0b5 still crashes for you?
https://archive.mozilla.org/pub/firefox/candidates/75.0b5-candidates/build1/
Based on the crash stats there are no crashes recorded with this particular signature in Fx75 so this is a good indicator that this got fixed.

Comment 8

[blinky]

I can not reproduce the crash with 75.0b5.

Comment 9

[Bogdan Maris, Desktop QA]

(In reply to blinky from comment #8)

I can not reproduce the crash with 75.0b5.

Thanks very much. I'll mark this bug as verified based on the above comment.