355059 - valgrind free memory read warning from multiple FT_Done_Face calls in nsFontMetricsPS.cpp

Status: RESOLVED FIXED

(Core Graveyard :: GFX: Gtk, defect)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

When printing http://www.mozilla.com/firefox/all on a trunk build with cairo disabled I get a valgrind warning about reading freed memory (attached).  The attached patch fixes the warning.

I haven't bothered to figure out the ownership model here -- but it seems to be working well enough except for this issue -- although I suppose I haven't checked for leaks.  Then again, this code should be going away for 1.9.

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: valgrind warning

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: patch

This fixes the warning.  I'm not sure who owns the entry object, but this seems like the simplest patch to prevent the object from being accessed after being freed.

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Checked in to trunk, although the code isn't used there.

Comment 4

[Daniel Veditz [:dveditz]]

Comment on attachment 240846 [details] [diff] [review]
patch

approved for 1.8 branch, a=dveditz for drivers

Comment 5

[Robert Basch]

I believe the bugs addressed here are responsible for the problems described
in bug 336435 (Firefox hangs following printing on Linux).  I debugged this a
couple of months ago, and attached a patch which fixed several double-free
bugs, including the bugs fixed here.  However, I also found an additional bug
(a failure to increment the reference count on a CharSet following a look-up
in fontconfig), which is fixed in the first part of my patch.  See:

https://bugzilla.mozilla.org/attachment.cgi?id=237126&action=view

Can that part of the patch be reviewed and committed soon?  (Please let me
know if you want me to provide an updated patch).  It would be nice to get
all of these fixes into the next 1.5.0.x release, as these bugs are having
a major impact on our users.

Comment 6

[Robert Basch]

Ah, I now see that the additional bug I referred to was addressed in bug 294879,
and a fix has already been checked in, and included in 1.5.0.8.  So never mind
about reviewing that part of my patch.

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Checked in to MOZILLA_1_8_BRANCH.

Comment 8

[Jay Patel [:jay]]

Comment on attachment 240846 [details] [diff] [review]
patch

Approved for 1.8.0 branch, a=jay for drivers.

Comment 9

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Checked in to MOZILLA_1_8_0_BRANCH.

Comment 10

[Tony Chung [:tchung]]

hi david, can you provide steps on how QA can verify this fix on the 1.8 and 1.8.0 branch?  thanks.