428633 - Crash [@ FillInMorphRunContextForRun] with astral, thai and chinese character

Status: RESOLVED WORKSFORME

(Core :: Graphics, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: testcase

On 10.5.2 only (doesn't occur in 10.4), latest Minefield nightly crashes when viewing the attached testcase.

Crashes [@ OTL::GCommon::GetLookups] or [@ FillInMorphRunContextForRun], called through gfxAtsuiFontGroup::InitTextRun.  Sometimes, instead of crashing, it triggers

firefox-bin(3464,0xa08fdfa0) malloc: *** error for object 0x10a65050: incorrect checksum for freed object - object was probably modified after being freed.

Jesse Ruderman helped make the reduced testcase.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

My crash report is here:

http://crash-stats.mozilla.com/report/index/43e80638-084f-11dd-bf19-001cc45a2ce4

Apparently there was an identical crash in 10.5.2 on build id 2008030317 when searched in Mozilla Crash Reports:

http://crash-stats.mozilla.com/report/index/31b384b5-fa9a-11dc-b9fe-001a4bd43ed6

Comment 2

[Mike Beltzner [:beltzner, not reading bugmail]]

Roc, blocking and assigning to you based on the fact that this will hit a lot of international users and there's a nice, small testcase.

Comment 3

[Jesse Ruderman]

I don't think this bug would affect many users (aside from being a potential security hole).  It's not very likely that such a combination of characters would occur in a text run, even on a Thai or Chinese page.

Breakpad shows only one crash report for FillInMorphRunContextForRun other than Gary's in the last 3 months (see comment 1 for links).  There were 196 reports of OTL::GCommon::GetLookups crashes, which is substantial but not quite a topcrash.  (Those crashes aren't necessarily due to this bug, but do match one of this bug's crash signatures.)

Comment 4

[Mike Beltzner [:beltzner, not reading bugmail]]

Jesse corrected me in my thinking - the characters need to be combined to result in a crash. Roc, please re-plus it if you think this should block, but for now it doesn't.

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Should this be wanted1.9.0.x instead of wanted‑next?

Comment 6

[John Daggett (:jtd)]

Hmmm, possible duplicate of of 428633, crash in that case also shows OTL::GCommon::GetLookups.

With 10.5.3 and RC3, the testcase WFM, I don't see a crash or any message on the console.  Gary, do you still experience this?

Comment 7

[John Daggett (:jtd)]

(In reply to comment #6)
> Hmmm, possible duplicate of of 428633, crash in that case also shows
> OTL::GCommon::GetLookups.

Oops, I meant to write a duplicate of bug 436663...

Comment 8

[Jesse Ruderman]

WFM with Firefox trunk (debug+mallocscribble) on Leopard.

Comment 9

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Resolving WFM with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1a2pre) Gecko/20080816113032 Minefield/3.1a2pre

Comment 10

[Mats Palmgren (inactive)]

Landed a crashtest:
https://hg.mozilla.org/integration/mozilla-inbound/rev/a5f9ee46616a

Comment 11

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/a5f9ee46616a