424165 - topcrashes [@ FontEntry::Release] [@ gfxWindowsPlatform::FindFontForCharProc] [@ gfxWindowsPlatform::FindFontEntry]

Status: VERIFIED FIXED

(Core :: Graphics, defect, P1)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

In 2008-03-20 builds (which have only been out for a few hours), three new topcrashes were introduced in Windows font code.  Since they're probably related, I'm filing just one bug.

The three stack signatures are FontEntry::Release, gfxWindowsPlatform::FindFontForCharProc, and gfxWindowsPlatform::FindFontEntry.

See crashes in the last 4 hours:
http://crash-stats.mozilla.com/?do_query=1&product=Firefox&version=Firefox%3A3.0b5pre&query_search=signature&query_type=contains&query=&date=&range_value=4&range_unit=hours

Comment 1

[Steve England [:stevee]]

Maybe caused by the landing of bug 382542.

Bug 424060 mentions a crash in gfxWindowsPlatform::FindFontForCharProc and has some STR, but I can't get them to crash me.

Comment 2

[Martijn Wargers (dead)]

Fwiw, I'm crashing with this stacktrace while trying to load any bugzilla page, so this is preventing me from using today's trunk build.

Comment 3

[Mike Beltzner [:beltzner, not reading bugmail]]

Stuart confirms this is caused by bug 382542, yeah.

Comment 4

[Martijn Wargers (dead)]

Using this:
<span style="font-weight: 200;"><span style="font-weight: lighter;">text
seems enough to cause the crash.

Comment 5

[François Gagné]

Also crashing loading bugzilla from Gmail.

xul!FontEntry::Release
xul!gfxWindowsPlatform::FindFontEntry+0x1019c7
xul!gfxWindowsPlatform::FindFontForCharProc+0x25
xul!nsBaseHashtable<nsStringHashKey,nsRefPtr<FontFamily>,nsRefPtr<FontFamily> >::s_EnumStub+0x15
xul!PL_DHashTableEnumerate+0x7d
xul!nsBaseHashtable<nsStringHashKey,nsRefPtr<FontFamily>,nsRefPtr<FontFamily> >::Enumerate+0x1f
xul!gfxWindowsPlatform::FindFontForChar+0x3f
xul!UniscribeItem::FindFontForChar+0x173c00
MOZCRT19!arena_malloc_small+0x144
MOZCRT19!arena_malloc+0x12
MOZCRT19!malloc+0x35
xul!nsTArray_base::EnsureCapacity+0x8f
xul!UniscribeItem::ComputeRanges+0xf5
xul!gfxWindowsFontGroup::InitTextRunUniscribe+0xa7
xul!gfxWindowsFontGroup::InitTextRunGDI+0x115c21
xul!gfxWindowsFontGroup::MakeTextRun+0x16b011
xul!TextRunWordCache::MakeTextRun+0x1e5
xul!gfxTextRunWordCache::MakeTextRun+0x24
xul!MakeTextRun+0x4c
xul!BuildTextRunsScanner::BuildTextRunForFrames+0x1aa2a6

Comment 6

[Stuart Parmenter]

Attachment: fix

This should fix it for real.

Comment 7

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Comment on attachment 310835 [details] [diff] [review]
fix

I think this looks fine, but I'd like to see some reftests for all this stuff...

Comment 8

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 310835 [details] [diff] [review]
fix

a=beltzner in the name of expedience, but stuart tells me he'll have a follow-up patch with some tests in a while ...

Comment 10

[Steve England [:stevee]]

In bug 424060 comment 4, pal-moz reports he is still crashing [@ gfxWindowsPlatform::FindFontForCharProc] even after the patch in this bug.

Comment 11

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Yeah, the crashes are still present in 20080321 builds in http://crash-stats.mozilla.com/?do_query=1&product=Firefox&version=Firefox%3A3.0b5pre&query_search=signature&query_type=contains&query=&date=&range_value=4&range_unit=hours

Comment 12

[Stuart Parmenter]

gfxWindowsPlatform::FindFontEntry is certainly fixed.  I can't see any way for the others to be occuring and no testcases...

Comment 13

[chris hofmann]

here is a list of all the comments where folks might have seen this and/or related crashes.     we should pound on all these hard to to make sure all the crashes have gone away, and maybe turn up some repeatable test cases.  all these are on windows.

many reports on wikipedia
Wikipedia wont load for some reason.......

URL: wikipedia.org - this build is bad - going to revert back to older build several days ago

Trying to load b.m.o in a background tab.
loading bugzilla home page

I was on kffl.com and went to the address bar to change to facebook.com and *poof* crash!

I have just wanted to write an e-mail at this server: www.iwiw.hu And it is crashed. 

I cannot run Firefox, it crashes at my home page at igoogle.com
crash when open iGoogle and Google Adsense..

Browsing news.google.com

GetHuman.com crashes with Minefield running in Safe Mode, when I click on a Google link to the Get Human database.

True culprit URL: http://www.mnn.ch/hyph/hyphenation2.html

clicked on facebook profile link - second time in a row that firefox crashed with this link

and another one - clicked on a facebook link again

Comment 15

[Stuart Parmenter]

I've gone through every single URL I've seen and can't find a crash.

Comment 17

[Bill Gianopoulos [:WG9s]]

Attachment: testcase

This testcase crashes with current trunk.  I believe the check-in here is the cause.

Comment 18

[Bill Gianopoulos [:WG9s]]

(In reply to comment #17)
> Created an attachment (id=311055) [details]
> testcase
> 
> This testcase crashes with current trunk.  I believe the check-in here is the
> cause.
> 

crash report for this is here:

http://crash-stats.mozilla.com/report/index/b92737f8-f78c-11dc-b426-001a4bd46e84

Comment 19

[Bill Gianopoulos [:WG9s]]

Whether or not this crashes would seem to depend on the installed fonts.  I have 2 Windows/XP systems.  One crashes on this, one does not.

Comment 20

[Stuart Parmenter]

Bill:  Can you run with NSPR_LOG_MODULES=winfonts:5 NSPR_LOG_FILE=foo.txt on the one that crashes and look and see what fonts it is trying to use before it crashes?  

Comment 21

[Bill Gianopoulos [:WG9s]]

I backed out the fix here and verified it is NOT the cause of my issue.  It just does not fix this crash case.

Comment 22

[Bill Gianopoulos [:WG9s]]

(In reply to comment #20)
> Bill:  Can you run with NSPR_LOG_MODULES=winfonts:5 NSPR_LOG_FILE=foo.txt on
> the one that crashes and look and see what fonts it is trying to use before it
> crashes?  
> 

Based on the end of the file, it would appear to be Tahoma

0[52f140]: Computing ranges for string: (len = 23)
0[52f140]:  0x0020 -
0[52f140]:  - Using Tahoma
0[52f140]:  0x0054 -
0[52f140]:  - Using Tahoma
0[52f140]:  0x0072 -
0[52f140]:  - Using Tahoma
0[52f140]:  0x0061 -
0[52f140]:  - Using Tahoma
0[52f140]:  0x006e -
0[52f140]:  - Using Tahoma
0[52f140]:  0x0073 -
0[52f140]:  - Using Tahoma
0[52f140]:  0x0066 -
0[52f140]:  - Using Tahoma
0[52f140]:  0x0065 -
0[52f140]:  - Using Tahoma
0[52f140]:  0x0072 -
0[52f140]:  - Using Tahoma
0[52f140]:  0x0072 -
0[52f140]:  - Using Tahoma
0[52f140]:  0x0069 -
0[52f140]:  - Using Tahoma
0[52f140]:  0x006e -
0[52f140]:  - Using Tahoma
0[52f140]:  0x0067 -
0[52f140]:  - Using Tahoma
0[52f140]:  0x0020 -
0[52f140]:  - Using Tahoma
0[52f140]:  0x0064 -
0[52f140]:  - Using Tahoma
0[52f140]:  0x0061 -
0[52f140]:  - Using Tahoma
0[52f140]:  0x0074 -
0[52f140]:  - Using Tahoma
0[52f140]:  0x0061 -
0[52f140]:  - Using Tahoma
0[52f140]:  0x0020 -
0[52f140]:  - Using Tahoma
0[52f140]:  0x0066 -
0[52f140]:  - Using Tahoma
0[52f140]:  0x0072 -
0[52f140]:  - Using Tahoma
0[52f140]:  0x006f -
0[52f140]:  - Using Tahoma
0[52f140]:  0x006d -
0[52f140]:  - Using Tahoma
0[52f140]:  Found 1 ranges

Comment 23

[Stuart Parmenter]

hrm, It is probably crashing on the next character looking for another font.

Comment 24

[Stuart Parmenter]

Attachment: test list all fonts

Ok, use this to get a list of all the fonts on your machine.

Comment 25

[Bill Gianopoulos [:WG9s]]

(In reply to comment #24)
> Created an attachment (id=311085) [details]
> test list all fonts
> 
> Ok, use this to get a list of all the fonts on your machine.
> 

Hmm. That does not seem to produce any output for me.

Comment 26

[Bill Gianopoulos [:WG9s]]

OK I saved it in a local file and it worked much better.  This is the list from the system that crashes:

Aharoni
Ahem
Alba
Alba Matter
Alba Super
Algerian
Andalus
Angsana New
AngsanaUPC
Arabic Transparent
Arial
Arial Black
Arial Narrow
Arial Unicode MS
Baby Kruffy
Baskerville Old Face
Bauhaus 93
Bell MT
Berlin Sans FB
Berlin Sans FB Demi
Bernard MT Condensed
Bodoni MT Poster Compressed
Book Antiqua
Bookman Old Style
Britannic Bold
Broadway
Browallia New
BrowalliaUPC
Brush Script MT
Calibri
Californian FB
Cambria
Cambria Math
Candara
Centaur
Century
Century Gothic
Chick
Chiller
Colonna MT
Comic Sans MS
Consolas
Constantia
Cooper Black
Corbel
Cordia New
CordiaUPC
Courier
Courier New
Croobie
David
David Transparent
DilleniaUPC
Estrangelo Edessa
Euclid
Euclid Fraktur
EucrosiaUPC
Fat
Fences
Fixed Miriam Transparent
Fixedsys
Footlight MT Light
FrankRuehl
Franklin Gothic Medium
FreesiaUPC
Freestyle Script
Freshbot
Frosty
Futura Bk
Futura Hv
Futura Lt
Futura Md
Garamond
Gautami
Georgia
GlooGun
Haettenschweiler
Harlow Solid Italic
Harrington
High Tower Text
Impact
Informal Roman
IrisUPC
JasmineUPC
Jenkins v2.0
Jokerman
Jokewood
Juice ITC
Kartika
KodchiangUPC
Kristen ITC
Kunstler Script
Latha
Levenim MT
LilyUPC
Lucida Bright
Lucida Calligraphy
Lucida Console
Lucida Fax
Lucida Handwriting
Lucida Sans
Lucida Sans Unicode
MS Dialog
MS Dialog Light
MS Reference Sans Serif
MS Sans Serif
MS Serif
MS SystemEx
MV Boli
Magneto
Mangal
Math1
Math4
Math4Mono
Mathematica1
Mathematica4
Mathematica4Mono
Matura MT Script Capitals
Microsoft Sans Serif
Miriam
Miriam Fixed
Miriam Transparent
Mistral
Modern
Modern No. 20
Monotype Corsiva
Narkisim
Niagara Engraved
Niagara Solid
Old English Text MT
Onyx
Palatino Linotype
Parchment
Playbill
Poor Richard
Poornut
Porky's
Pussycat
Raavi
Ravie
Raytheon Corporate Logo
Rod
Rod Transparent
Roman
STIXGeneral
STIXIntegrals
STIXNonUnicode
STIXSize1
STIXSize2
STIXSize3
STIXSize4
STIXSize5
STIXVariants
Script
Showcard Gothic
Shruti
Simplified Arabic
Simplified Arabic Fixed
Small Fonts
Snap ITC
Stencil
Sylfaen
System
Tahoma
Tempus Sans ITC
Terminal
Times New Roman
Traditional Arabic
Trebuchet MS
Tunga
VT220_ascii
VT220_special
Verdana
Viner Hand ITC
Vivaldi
Vladimir Script
Vrinda
WST_Czec
WST_Engl
WST_Fren
WST_Germ
WST_Ital
WST_Span
WST_Swed
Weltron Urban
Wide Latin
cmex10
cmmi10
cmr10
cmsy10

Comment 27

[Bill Gianopoulos [:WG9s]]

This is the list from the system that does NOT crash:

Ahem
Arial
Arial Black
Arial Narrow
Arial Unicode MS
Berling Antiqua
Book Antiqua
Bookman Old Style
Calibri
Cambria
Cambria Math
Candara
Century Gothic
Comic Sans MS
Consolas
Constantia
Corbel
Courier
Courier New
Estrangelo Edessa
Euclid
Euclid Fraktur
Fences
Fixedsys
Franklin Gothic Medium
FranklinGotTDemCon
Frutiger Linotype
Garamond
Gautami
Georgia
Haettenschweiler
Impact
Kartika
Latha
Lucida Console
Lucida Sans Typewriter
Lucida Sans Unicode
MS Sans Serif
MS Serif
MV Boli
Mangal
Math1
Math4
Math4Mono
Mathematica1
Mathematica4
Mathematica4Mono
Microsoft Sans Serif
Modern
Monotype Corsiva
Palatino Linotype
Raavi
Roman
STIXGeneral
STIXIntegrals
STIXNonUnicode
STIXSize1
STIXSize2
STIXSize3
STIXSize4
STIXSize5
STIXVariants
Script
Shruti
Small Fonts
Sylfaen
System
Tahoma
Terminal
Times New Roman
Trebuchet MS
Tunga
Verdana
Vrinda
WST_Czec
WST_Engl
WST_Fren
WST_Germ
WST_Ital
WST_Span
WST_Swed
cmex10
cmmi10
cmr10
cmsy10

Comment 28

[Stuart Parmenter]

Attachment: test render text with all fonts on your machine

ok, this test kind of sucks.  you need code2000, 2001, 2002 (http://www.code2000.net/) and Unicode Symbols (http://users.teilar.gr/~g1951d/download.html) to hopefully avoid fallback.

Once you've got those installed load this page and it should enumerate over all the fonts on your machine (like the last attachment) this time rendering the string Bill said was crashing with each font (specifying code2000, 2001, 2002 and Unicode Symbols as fallback).  Hopefully one of the fonts will crash and you'll be able to see the previous font and using the previous attachment determine what the font crashing is.

Bill: can you give this a shot?

Comment 29

[chris hofmann]

I notice that when I download and then install code2000, code2001, and code2002 minefield crashes shortly after the installation is finished, but I'm guessing that is another bug.

Comment 30

[Stuart Parmenter]

chris: I checked in a fix for that earlier today.

Comment 31

[Bill Gianopoulos [:WG9s]]

Attachment: font that fails the test

I have a lot of fonts that result in this crash on my system.  This is the first one.

Comment 32

[Bill Gianopoulos [:WG9s]]

This might be significant.

One of the fonts that causes the crash, I know is NOT a complete alphabet.  It is the font used for my company's logo.  The only characters in the font are those which make up the company name.

Comment 33

[Bill Gianopoulos [:WG9s]]

Comment on attachment 311094 [details]
font that fails the test

Turns out this font really did not cause the crash by itself.

Comment 34

[Bill Gianopoulos [:WG9s]]

The font that actually triggers the issue has licensing and trademark issues that prevented me from attaching it here.  I emailed it to Stuart and he has been able to duplicate the issue.

Comment 35

[Stuart Parmenter]

Attachment: fix one problem

This will fix a crash when fonts have weights > 900

Comment 36

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Comment on attachment 311102 [details] [diff] [review]
fix one problem

a=me for less crashy

Comment 37

[Stuart Parmenter]

ok, let us all cross out fingers that the patch I just checked in fixes the problem.

Comment 38

[Stuart Parmenter]

reopen if you guys are still seeing problems

Comment 39

[Bill Gianopoulos [:WG9s]]

This at least fixes my problem.  I am also no longer having issues with crashing in bugzilla.

Comment 40

[pal-moz]

not fixed,
https://bugzilla.mozilla.org/show_bug.cgi?id=424060#c21

Comment 41

[Martijn Wargers (dead)]

Attachment: testcase2

Ok, I still crash with this testcase, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5pre) Gecko/2008032204 Minefield/3.0b5pre
http://crash-stats.mozilla.com/report/index/6bd42ffa-f844-11dc-a1ec-001a4bd43e5c

Comment 42

[Stuart Parmenter]

Martijn: I can't reproduce or even speculate on how that would cause a crash.

Comment 43

[Bill Gianopoulos [:WG9s]]

This is another font dependent crash.  Once again crashes on system and not the other.  I will try to narrow it down to a specific font.

Comment 44

[Stuart Parmenter]

I suspect you guys are seeing 424566.  I'll check in a patch for that once the tree opens...

Comment 45

[Bill Gianopoulos [:WG9s]]

(In reply to comment #44)
> I suspect you guys are seeing 424566.  I'll check in a patch for that once the
> tree opens...
> 

That patch fixes the crash for me.

Comment 46

[Carsten Book [:Tomcat]]

verified fixed with the 2 testcases and Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9pre) Gecko/2008041217 Minefield/3.0pre ID:2008041217 - no crash on testcases 

--> Verified fixed