1967046 - GPU process renders garbled text or crashes with USER_LIMITED access token level

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect, P1)

Description

[amyspark]

Attachment: Example garbled text

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0

Steps to reproduce:

Tried opening https://crash-stats.mozilla.org/report/index/f475359d-dc89-4d6c-b3c1-774180250517 for a crash I just had. Also tried opening the Bitwarden extension.

Actual results:

I get garbled text on the screen. In certain cases, the browser tab just crashes.

Expected results:

Text should be correctly rendered.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'WebExtensions::Untriaged' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[amyspark]

These are the crashes I got: https://crash-stats.mozilla.org/report/index/d70baf42-db65-4fe8-9a03-44a8d0250517 and https://crash-stats.mozilla.org/report/index/f475359d-dc89-4d6c-b3c1-774180250517

Tried tracking down the topmost frame function, but the page https://hg-edge.mozilla.org/mozilla-central/file/61e8f954db8a1c59290a5763d09dc43e17d6c2f9/gfx/thebes/gfxPlatform.cpp#l387 renders as total garbage characters. From the looks of it, monospace fonts are destroyed, and serif fonts are rendered at least ignoring ligatures.

Comment 3

[Francesco Lodolo [:flod]]

Based on the crashes, looks like the signature matches bug 1967071.

Comment 4

[amyspark]

Workaround: setting security.sandbox.gpu.level back to 1 is enough to make the browser usable again.

Comment 5

[Bob Owen (:bobowen)]

This is down to the having user installed fonts.
We need a policy rule to give access to these.

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:gcp, could you have a look please?

For more information, please visit BugBot documentation.

Comment 7

[Bob Owen (:bobowen)]

Marking as enhancement as this is caused by non-standard pref setting that will be fixed prior to re-landing.

Comment 8

[Bob Owen (:bobowen)]

Attachment: Bug 1967046: Add policy rule for Windows user fonts to GPU process sandbox. r=handyman!

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/6e7a0e8e97c2
https://hg.mozilla.org/integration/autoland/rev/fecca28886ea
Add policy rule for Windows user fonts to GPU process sandbox. r=handyman

Comment 10

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/fecca28886ea

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1966716

Comment 12

[Mathew Hodson]

140 was fixed by backout of bug 1966716

Comment 13

[Bob Owen (:bobowen)]

(In reply to Mathew Hodson from comment #12)

140 was fixed by backout of bug 1966716

That removed the regression, but the actual issue was fixed (hopefully) by the patch in this bug in 141.

Comment 14

[Kai Engert [:KaiE:]]

Thunderbird ESR 140 experiences a regression (bug 1970126) that can be fixed by applying the patches from this bug plus another bug to mozilla-esr140 (bug 1967046 and bug 1967485).

Could you please uplift the patches to mozilla-esr140 ?

In case it is helpful, I have prepared uplift patches for the https://phabricator.services.mozilla.com/source/firefox-esr140/ GIT repo, they are attached to bug 1970126.

Comment 15

[Bob Owen (:bobowen)]

Attachment: Bug 1967046: Add policy rule for Windows user fonts to GPU process sandbox. r=handyman!

Original Revision: https://phabricator.services.mozilla.com/D252467

Comment 16

[Pascal Chevrel (relman team) -> :pascalc]

(In reply to Mathew Hodson from comment #12)

140 was fixed by backout of bug 1966716

That backout that landed in both 140 and 140esr doesn't fix your issue?

Comment 17

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr140/rev/771d54d3337b

Comment 18

[Kai Engert [:KaiE:]]

(In reply to Pascal Chevrel:pascalc from comment #16)

(In reply to Mathew Hodson from comment #12)

140 was fixed by backout of bug 1966716

That backout that landed in both 140 and 140esr doesn't fix your issue?

We didn't need the backout. We rather need the patch to be present.
In the meantime it was landed, comment 17, and I believe that helped us.
Thanks