Closed Bug 1645645 Opened 3 months ago Closed 3 months ago

Crash in [@ gfxDWriteFontList::CreateFontEntry]

Categories

(Core :: Layout: Text and Fonts, defect, P2)

79 Branch
x86_64
Windows 10
defect

Tracking

()

VERIFIED FIXED
mozilla79
Tracking Status
firefox79 --- verified
firefox80 --- verified

People

(Reporter: over68, Assigned: jfkthame)

References

(Blocks 1 open bug)

Details

Crash Data

Attachments

(1 file)

Steps to reproduce:

  1. Set gfx.e10s.font-list.shared to true.
  2. Restart Firefox.
  3. Download Font Loader.
  4. Download and extracts the archive.
  5. Open https://emojipedia.org/emoji/ in three tabs.
  6. Open the Font Loader, Click on the Add Fonts button, Select the extracted font files then click Open.
  7. Click on the Load button then Unload.
  8. Open https://emojipedia.org/emoji/ in new tab.
  9. Switch between tabs.

See https://youtu.be/wiatFCir-uM

Actual results:

The tab crashed when clicking on the Unload button then switch between tabs.

Crash report: bp-4e7babc2-b0a2-41b7-88d9-e9c530200614

0 xul.dll gfxDWriteFontList::CreateFontEntry gfx/thebes/gfxDWriteFontList.cpp:980
1 xul.dll gfxPlatformFontList::GetOrCreateFontEntry gfx/thebes/gfxPlatformFontList.cpp:1300
2 xul.dll mozilla::fontlist::Family::SearchAllFontsForChar gfx/thebes/SharedFontList.cpp:372
3 xul.dll gfxPlatformFontList::GlobalFontFallback gfx/thebes/gfxPlatformFontList.cpp:1005
4 xul.dll gfxPlatformFontList::SystemFindFontForChar gfx/thebes/gfxPlatformFontList.cpp:885
5 xul.dll gfxFontGroup::WhichSystemFontSupportsChar gfx/thebes/gfxTextRun.cpp:3467
6 xul.dll gfxFontGroup::FindFontForChar gfx/thebes/gfxTextRun.cpp:3101
7 xul.dll gfxFontGroup::InitScriptRun<char16_t> gfx/thebes/gfxTextRun.cpp:2562
8 xul.dll gfxFontGroup::MakeTextRun gfx/thebes/gfxTextRun.cpp:2356
9 xul.dll BuildTextRunsScanner::BuildTextRunForFrames layout/generic/nsTextFrame.cpp:2527
Blocks: 1533462

Ah, I see what's broken here... if the FindFamilyName call at https://hg.mozilla.org/mozilla-central/file/1d3eb5f9e1b6e25fa8f6cad8843ae3feef012ca2/gfx/thebes/gfxDWriteFontList.cpp#l970 fails, we leave family as null, but fail to check that properly and bail out of the method. We need to fix up the failure handling here.

Assignee: nobody → jfkthame
Severity: S1 → S3
Status: UNCONFIRMED → NEW
Ever confirmed: true
Priority: -- → P2
Pushed by jkew@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/d3d13c4bbf9b
Fix error handling in gfxDWriteFontList::CreateFontEntry to avoid risk of null-deref. r=jwatt
Status: NEW → RESOLVED
Closed: 3 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla79
Flags: qe-verify+

I reproduced the issue on Firefox Nightly (2020-06-13) under Windows 10 by using the STR from Comment 0.

The issue is fixed as I was unable to crash the tabs on Firefox 80.0a1 (2020-07-06) and Firefox 79.0b4 under Windows 10.

Status: RESOLVED → VERIFIED
Flags: qe-verify+
You need to log in before you can comment on or make changes to this bug.