390234 - Trunk mac-only topcrash at TextRunWordCache::CacheHashEntry::KeyEquals(TextRunWordCache::CacheHashKey const*) const

Status: VERIFIED FIXED

(Core :: Layout: Text and Fonts, defect)

Description

[Benjamin Smedberg]

There is a new trunk topcrash at TextRunWordCache::CacheHashEntry::KeyEquals(TextRunWordCache::CacheHashKey const*) const: mac-only, and appeared around 7/16

http://crash-stats.mozilla.com/report/list?range_unit=weeks&branch=1.9&range_value=2&signature=TextRunWordCache%3A%3ACacheHashEntry%3A%3AKeyEquals(TextRunWordCache%3A%3ACacheHashKey+const*)+const

definitely a blocker-not sure whether it should block M7

Comment 1

[Adam Guthrie]

Bonsai: http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=PhoenixTinderbox&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-07-18+03&maxdate=2007-07-19+06&cvsroot=%2Fcvsroot

Looks like a regression from either bug 364786 or bug 364300.

Comment 2

[Robert O'Callahan (:roc) (email my personal email if necessary)]

How are we going to fix this without a testcase? (I don't think I've seen it)

Comment 3

[Mike Connor [:mconnor]]

I think we can ship this in an alpha, especially given the absence of clear STR or a testcase...

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

It's often possible to fix topcrash bugs given stack + local variables.

Comment 5

[(not reading, please use [e-mail] instead)]

al might have a test case, see bug #390736

Comment 7

[(not reading, please use [e-mail] instead)]

from that bug, al writes:

Steps to Reproduce

1. Open the History Sidebar.
2. Change view to 'Most Visited' there.
3. Grab the scroll bar for the History Sidebar and drag it up and down over and
over again (you have to have a big enough history for this to work).

Comment 8

[Marcia Knous [:marcia]]

I hit this using today's build. I was scrolling rapidly through the Error Console, and then it crashed.

Comment 9

[philippe (part-time)]

Crashed while scrolling slowly through this table:
http://keryx.se/resources/html-elements.xhtml

Latest Camino trunk build, 10.4.10 ppc.

Comment 10

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: fix

What was happening is that ATSUI font fallback was creating textruns with multiple glyphruns, each with the same mFont. gfxTextRunWordCache::GetFontOrGroup was interpreting this as "must use group to index the cache, not font". But when we copy that textrun glyph data to the final textrun that actaully gets associated with the cache entry, that copy was coalescing all the glyphruns into one, and when we look up the copy in the cache, GetFontOrGroup was returning "must use the font to index the cache" and so we weren't finding the textrun's cache entry so we ended up with cache entries with dangling textrun pointers.

This patch fixes the bug by having gfxTextRun::SortGlyphRuns coalesce glyph runs with the same font so we get into the canonical form we expect.

The patch also adds some assertions to check that textrun construction has put glyphruns in canonical form. More importantly, it adds debug code to detect whenever a textrun has not been fully removed from the cache --- which makes these sorts of bugs much easier to detect and track down.

Comment 11

[Robert O'Callahan (:roc) (email my personal email if necessary)]

checked in

Comment 12

[Al Billings [:abillings - ex-MoCo]]

This is verified. My old test case doesn't crash and it used to be fairly easy to do.