346937 - Crash when opening Preferences window and clicking "Content" globe icon with xlib widget

Status: RESOLVED WONTFIX

(Core Graveyard :: GFX: Xlib, defect)

Description

[John Tytgat]

User-Agent:       Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.2 (like Gecko) Kubuntu 6.06 Dapper
Build Identifier: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.8.0.6) Gecko/20060730 Firefox/1.5.0.6

Using the xlib widget, I get a crash when opening Preferences window and clicking on the "Content" globe icon.  The stackdump is:

--8<--
#0  0x00000000005bbdc0 in GetAllFontNames ()
#1  0x00000000005bbe2b in EnumFonts ()
#2  0x00000000005bbf89 in nsFontEnumeratorXlib::EnumerateFonts ()
#3  0x00002aaaaaf2ee17 in XPTC_InvokeByIndex () from dist/bin/libxpcom_core.so
#4  0x0000000000468254 in XPCWrappedNative::CallMethod ()
#5  0x000000000046beb5 in XPC_WN_CallMethod ()
#6  0x00002aaaaac0a1c7 in js_Invoke () from dist/bin/libmozjs.so
#7  0x00002aaaaac13e27 in js_Interpret () from dist/bin/libmozjs.so
#8  0x00002aaaaac0a224 in js_Invoke () from dist/bin/libmozjs.so
#9  0x00002aaaaac059e6 in fun_call () from dist/bin/libmozjs.so
#10 0x00002aaaaac0a1c7 in js_Invoke () from dist/bin/libmozjs.so
#11 0x00002aaaaac13e27 in js_Interpret () from dist/bin/libmozjs.so
#12 0x00002aaaaac0a224 in js_Invoke () from dist/bin/libmozjs.so
#13 0x0000000000464590 in nsXPCWrappedJSClass::CallMethod ()
#14 0x00000000004607e8 in nsXPCWrappedJS::CallMethod ()
#15 0x00002aaaaaf2fa51 in PrepareAndDispatch () from dist/bin/libxpcom_core.so
#16 0x00002aaaaaf2ee8b in SharedStub () from dist/bin/libxpcom_core.so
#17 0x0000000000819814 in nsXULDocument::ResumeWalk ()
#18 0x0000000000819cb7 in nsXULDocument::OnStreamComplete ()
#19 0x00000000004baeee in nsStreamLoader::OnStopRequest ()
#20 0x00002aaaacdff99a in nsJARChannel::OnStopRequest ()
#21 0x00000000004a6c58 in nsInputStreamPump::OnStateStop ()
#22 0x00000000004a714a in nsInputStreamPump::OnInputStreamReady ()
#23 0x00002aaaaaf04744 in nsInputStreamReadyEvent::EventHandler ()
#24 0x00002aaaaaf17f8c in PL_HandleEvent () from dist/bin/libxpcom_core.so
#25 0x00002aaaaaf17ed2 in PL_ProcessPendingEvents () from dist/bin/libxpcom_core.so
#26 0x00002aaaaaf192f3 in nsEventQueueImpl::ProcessPendingEvents ()
#27 0x00000000005eeee6 in HandleQueueXtProc ()
#28 0x00002aaaab810c22 in _XtRemoveAllInputs () from /usr/lib/libXt.so.6
#29 0x00002aaaab810f74 in XtAppNextEvent () from /usr/lib/libXt.so.6
#30 0x00000000005f0c61 in nsAppShell::Run ()
#31 0x0000000000a96e8a in nsAppStartup::Run ()
#32 0x000000000043a298 in XRE_main ()
#33 0x00000000004360c6 in main ()
--8<--

The reason for this crash is that in GetAllFontNames() the aFmctx parameter is NULL because it got that value of the global variable global_fmctx in nsFontEnumeratorXlib::EnumerateAllFonts() (via EnumFonts() routine). The global variable global_fmctx seems to be only assigned in nsFontMetricsXlib::FamilyExists().

I've patched this problem by checking on aFmctx in GetAllFontNames() being NULL and return NS_ERROR_FAILURE but although that avoid the crash it doesn't seem to be a good fix solving the real problem.

Reproducible: Always

Comment 1

[John Tytgat]

Attachment: Patch to test aFmctx value in GetAllFontNames() working around the problem

Comment 2

[Adam Guthrie]

You will need to ask someone to review your patch. Stuart (pavlov@) or Vlad (:vlad) would be a good choice.

Comment 3

[timeless]

technically this function is internal, and we'd rather in general not to stick null checking into internal functions if we can null check earlier, so if you can show to yourself that there are few callers and only some aren't null checking, it'd be better if this check was moved to the caller(s).

An external method is usually NS_IMETHODIMP.

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 231699 [details] [diff] [review]
Patch to test aFmctx value in GetAllFontNames() working around the problem

The underlying bug here is pretty severe. You need to fix that to make sure that global_fmctx gets initialized.

Really, this code is very poorly maintained and is probably going to go away soon.

Comment 5

[Wayne Mery (:wsmwk)]

many xlib bugs are getting closed wontfix & invalid
example, bug 345450 

Comment 6

[Mats Palmgren (inactive)]

Gtk1/xlib widget code has been removed on trunk and this bug doesn't seem
like a branch candidate.

-> WONTFIX