1750071 - Crash in [@ libfreetype.so.6@0x10de0 | webrender::platform::unix::font::FontContext::load_glyph]

Status: NEW

(Core :: Graphics: WebRender, defect)

Description

[Sean Feng [:sefeng]]

Maybe Fission related. (DOMFissionEnabled=1)

Crash report: https://crash-stats.mozilla.org/report/index/6a55d585-dcd3-4f97-a4a1-621c60220113

Reason: SIGSEGV / SEGV_MAPERR

Top 10 frames of crashing thread:

0 libfreetype.so.6 libfreetype.so.6@0x0000000000010de0 
1 libxul.so webrender::platform::unix::font::FontContext::load_glyph /usr/src/debug/firefox-95.0.2-2.fc34.x86_64/gfx/wr/webrender/src/platform/unix/font.rs:522
2 libxul.so webrender::glyph_rasterizer::GlyphRasterizer::flush_glyph_requests::{{closure}} /usr/src/debug/firefox-95.0.2-2.fc34.x86_64/gfx/wr/webrender/src/glyph_rasterizer/mod.rs:157
3 libxul.so rayon::iter::plumbing::bridge_producer_consumer::helper /usr/src/debug/firefox-95.0.2-2.fc34.x86_64/third_party/rust/rayon/src/iter/plumbing/mod.rs:438
4 libxul.so rayon_core::join::join_context::{{closure}} /usr/src/debug/firefox-95.0.2-2.fc34.x86_64/third_party/rust/rayon-core/src/join/mod.rs:141
5 libxul.so rayon::iter::plumbing::bridge_producer_consumer::helper /usr/src/debug/firefox-95.0.2-2.fc34.x86_64/third_party/rust/rayon/src/iter/plumbing/mod.rs:416
6 libxul.so <rayon_core::job::StackJob<L, F, R> as rayon_core::job::Job>::execute /usr/src/debug/firefox-95.0.2-2.fc34.x86_64/third_party/rust/rayon-core/src/job.rs:119
7 libxul.so rayon_core::registry::WorkerThread::wait_until_cold /usr/src/debug/firefox-95.0.2-2.fc34.x86_64/third_party/rust/rayon-core/src/registry.rs:726
8 libxul.so std::sys_common::backtrace::__rust_begin_short_backtrace /builddir/build/BUILD/rustc-1.57.0-src/library/std/src/sys_common/backtrace.rs:123
9 libxul.so core::ops::function::FnOnce::call_once{{vtable.shim}} /builddir/build/BUILD/rustc-1.57.0-src/library/core/src/ops/function.rs:227

This seems to be a Fedora-specific (actually not, seeing this on other distros) bug, crashed in the FreeType library. I am not sure if this bug belongs to third party affecting Firefox component, however I decided to start with the graphic component

Comment 1

[Gabriele Svelto [:gsvelto] (PTO)]

More related crash signatures. It seems that webrender::platform::unix::font::FontContext::load_glyph() is passing a NULL pointer into the freetype code.

Comment 2

[Sean Feng [:sefeng]]

We seems to have more crashes in libfreetype.

Comment 3

[Gabriele Svelto [:gsvelto] (PTO)]

There's a mix of very old distros in there, but also a few new ones for which we don't have symbols. I'll investigate.