1616798 - Crash in [@ IPC::ParamTraits<nsTArray<T> >::Write]

Status: RESOLVED FIXED

(Core :: Layout: Text and Fonts, defect, P3)

Description

[Calixte Denizet (:calixte)]

This bug is for crash report bp-3dbad4ce-2ee4-45d7-8e45-a46880200220.

Top 10 frames of crashing thread:

0 xul.dll static IPC::ParamTraits<nsTArray<unsigned short> >::Write ipc/glue/IPCMessageUtils.h:549
1 xul.dll mozilla::ipc::WriteIPDLParam<const gfxSparseBitSet&> ipc/glue/IPDLParamTraits.h:59
2 xul.dll mozilla::dom::PContentChild::SendSetCharacterMap ipc/ipdl/PContentChild.cpp:5830
3 xul.dll mozilla::fontlist::SetCharMapRunnable::Run gfx/thebes/SharedFontList.cpp:106
4 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1220
5 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:481
6 xul.dll mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:87
7 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/message_loop.cc:308
8 xul.dll MessageLoop::Run ipc/chromium/src/base/message_loop.cc:290
9 xul.dll nsBaseAppShell::Run widget/nsBaseAppShell.cpp:137

There are 3 crashes (from 1 installation) in nightly 75 with buildid 20200219215002. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1616193.

[1] https://hg.mozilla.org/mozilla-central/rev?node=eeef960d6919

Comment 1

[Jonathan Kew [:jfkthame]]

Yes, this is definitely related to bug 1616193 (although in the same circumstances, it would have already crashed with a different stack before that patch landed, so in that sense it's no worse!)

I must have been mistaken about the lifetime of the gfxSparseBitSet; let's try a different approach.

Comment 2

[Jonathan Kew [:jfkthame]]

Yeah, I just wasn't thinking straight in bug 1616193, and the comment here was a lie. :(

At call sites like this it's entirely possible for TrySetShmemCharacterMap() to succeed immediately, as someone else may have already stored an identical charmap, in which case the reference here will not be retained.

So the runnable needs to take a strong reference to the charmap. Fortunately, gfxCharacterMap is refcounted, so that's an easy tweak.

Comment 3

[Jonathan Kew [:jfkthame]]

Attachment: Bug 1616798 - Ensure SetCharMapRunnable holds a reference to the charmap. r=jwatt

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/83815c4cf97f
Ensure SetCharMapRunnable holds a reference to the charmap. r=jwatt

Comment 5

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/83815c4cf97f