424939 - Crash [@ cairo_win32_surface_create_similar_internal] with large number of fonts

Status: VERIFIED FIXED

(Core :: Graphics, defect, P2)

Description

[John Daggett (:jtd)]

Attachment: testcase, auto-generated weight tests

When testing a page with autogenerated content using lots of fonts, we crash down in cairo_win32_surface_create_similar_internal:

http://crash-stats.mozilla.com/report/index/4cd40407-fa40-11dc-b90d-001a4bd43e5c

0  	_cairo_win32_surface_create_similar_internal  	 mozilla/gfx/cairo/cairo/src/cairo-win32-surface.c:413
1 	_cairo_win32_surface_create_similar 	mozilla/gfx/cairo/cairo/src/cairo-win32-surface.c:427
2 	_cairo_surface_create_similar_scratch 	mozilla/gfx/cairo/cairo/src/cairo-surface.c:239
3 	_cairo_surface_create_similar_solid 	mozilla/gfx/cairo/cairo/src/cairo-surface.c:322
4 	_moz_cairo_surface_create_similar 	mozilla/gfx/cairo/cairo/src/cairo-surface.c:305
5 	_moz_cairo_push_group_with_content 	mozilla/gfx/cairo/cairo/src/cairo.c:496
6 	gfxContext::PushGroup(gfxASurface::gfxContentType) 	mozilla/gfx/thebes/src/gfxContext.cpp:712

Note: the testcase uses the set of fonts on my system, which includes Windows XP JA fonts + Japanese MS Office fonts.  I'm guessing from the stack crawl that this is something to do with the size of the page and not the fonts per se.

Comment 1

[John Daggett (:jtd)]

Probably the 10000 GDI object limit again.  Related to bug 374272.

Comment 2

[timeless]

Attachment: work from something else

jtd: can you try this patch? i had an older version of this from a previous bug (not sure what bug, my tree doesn't track bug numbers), which was to this same area (it wasn't good for cairo because it had nsdebug stuff).

this isn't a real review request, i just want to know if it works (if it does, someone should send the patch to the cairo team).

Comment 3

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Ah right, Stuart already found this bug last week and I gave him a local patch.. I just pushed a fix upstream (basically identical to the patch here).

Comment 4

[John Daggett (:jtd)]

(In reply to comment #2)
> jtd: can you try this patch? i had an older version of this from a previous bug
> (not sure what bug, my tree doesn't track bug numbers), which was to this same
> area (it wasn't good for cairo because it had nsdebug stuff).

This looks fine but from the sounds of it there's already a patch coming in via a cairo update.

Comment 5

[(not currently active) Ted Mielczarek]

Vlad: I'm assigning this to you just to get it off of the "nobody" list.

Comment 6

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Should be fixed by cairo upgrade.

Comment 7

[Carsten Book [:Tomcat]]

no crash on testcase and Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9pre) Gecko/2008041217 Minefield/3.0pre ID:2008041217 

-> Verified fixed