1757897 - Crash in [@ gfxFT2LockedFace::GetGlyph]

Status: RESOLVED FIXED

(Core :: Layout: Text and Fonts, defect)

Description

[Calixte Denizet (:calixte)]

Maybe Fission related. (DOMFissionEnabled=1)

Crash report: https://crash-stats.mozilla.org/report/index/847080d8-5fe1-48d5-a70d-5da480220303

Reason: SIGSEGV / SEGV_MAPERR

Top 10 frames of crashing thread:

0 libxul.so gfxFT2LockedFace::GetGlyph gfx/thebes/gfxFT2Utils.cpp:43
1 libxul.so gfxFT2FontBase::GetGlyph gfx/thebes/gfxFT2FontBase.cpp:118
2 libxul.so gfxFT2FontBase::InitMetrics gfx/thebes/gfxFT2FontBase.cpp:460
3 libxul.so gfxFontconfigFontEntry::CreateFontInstance gfx/thebes/gfxFcPlatformFontList.cpp:915
4 libxul.so gfxFontEntry::FindOrMakeFont gfx/thebes/gfxFontEntry.cpp:281
5 libxul.so gfxFontGroup::GetFontAt gfx/thebes/gfxTextRun.cpp:2047
6 libxul.so gfxFontGroup::GetFirstValidFont gfx/thebes/gfxTextRun.cpp:2281
7 libxul.so gfxFontGroup::MakeTextRun gfx/thebes/gfxTextRun.cpp:2466
8 libxul.so BuildTextRunsScanner::FlushFrames layout/generic/nsTextFrame.cpp:1750
9 libxul.so nsTextFrame::EnsureTextRun layout/generic/nsTextFrame.cpp:3093

There are 3 crashes (from 2 installations) in nightly 99 starting with buildid 20220302065857. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1756720.

[1] https://hg.mozilla.org/mozilla-central/rev?node=3b719cd12933

Comment 1

[Jonathan Kew [:jfkthame]]

Attachment: Bug 1757897 - Add null-check for charmap in FT_Face, before trying to check for symbol encoding. r=lsalzman

We need a null-check here in case FT_Select_Charmap failed to find any usable charmap in the font
(e.g. maybe an old font with only a MacRoman charmap, but no Unicode or Symbol table).

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9b95c06fef27
Add null-check for charmap in FT_Face, before trying to check for symbol encoding. r=lsalzman

Comment 3

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/9b95c06fef27