482128 - corrupt font crashes Firefox [@ ApplyMorphForRun][@ gfxAtsuiFont::GetCharWidth] on Mac OS 10.4 Intel

Status: RESOLVED WORKSFORME

(Core :: Graphics, defect, P2)

Description

[[e-mail]]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9.0.7) Gecko/2009021906 Firefox/3.0.7
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9.0.7) Gecko/2009021906 Firefox/3.0.7

Whenever I visit news.google.com with Mac OS X 10.4 (Intel) in Firefox 3.0.7, Shiretoko (3.1b4), or MinefieldDebug (3.2a1pre), the application crashes. In 3.0.7 and 3.1b4 it crashes immediately. In 3.2a1pre the spinning color wheel spins for a while, then it crashes. 

This does not happen in 3.0.7 on Mac OS X (PPC) or 3.0.7 on Windows Vista. Also does not happen in Safari 3.2.1 (Mac OS X Intel).

After filing this I will attach a web archive of the page, which demonstrates the crash.

Reproducible: Always

Steps to Reproduce:
1. Load the attached web archive
2. Watch firefox fly into the bit bucket
3.
Actual Results:  
Firefox crashes

Expected Results:  
Firefox displays Google News.

Comment 1

[[e-mail]]

Attachment: Unzip to see a saved page of google news. Load this page to cause crash.

Comment 2

[[e-mail]]

Attachment: Crash details

Comment 3

[Matthias Versen [:Matti]]

please read http://developer.mozilla.org/En/How_to_get_a_stacktrace_for_a_bug_report

Comment 4

[[e-mail]]

I'm not sure if this is relevant to this bug, but ATSUGetGlyphInfo() has been marked as deprecated:

http://developer.apple.com/documentation/Carbon/Reference/ATSUI_Reference/DeprecationAppendix/AppendixADeprecatedAPI.html#//apple_ref/doc/uid/TP30000309-CH1g-F15046

Comment 5

[[e-mail]]

Here is a 3.1b4 crash report stack trace:
http://crash-stats.mozilla.com/report/index/48aaa11c-2682-45f8-93c9-4262f2090308

Here is a 3.0.7 (Safe Mode) stack trace:
http://crash-stats.mozilla.com/report/index/efd78553-f0b8-4c03-95f7-a00482090308?p=1

Comment 6

[[e-mail]]

ATSUGetGlyphInfo()'s deprecation is probably not relevant to this particular bug since when it crashes, aGlyphID is NULL, so the section of code in which it would be called is not executed. Also, it crashes before reaching that if statement in ATSUGetGlyphBounds().

Comment 7

[Jonathan Kew [:jfkthame]]

Please try disabling all non-Apple fonts you have installed (in /Library/Fonts and/or ~/Library/Fonts), and see if the crash persists. This problem is likely being triggered by a particular font that's present on your machine.

Comment 8

[John Daggett (:jtd)]

Michael, I set up a special build with logging around the point of failure.  If it's not too much trouble, could you download this build to your Desktop and run through the steps below?

  http://tinyurl.com/logcharwidth

Steps to log the error:

1. Run Terminal application
2. Enter these commands:

  cd ~/Desktop/Minefield.app/Contents/MacOS/
  export NSPR_LOG_FILE=~/Desktop/funkyfont.out
  export NSPR_LOG_MODULES=charwidth:5
  ./firefox
  
3. After Firefox starts, run the testcase that crashes 
4. Attach the log file 'funkyfont.out', located on the desktop

This will dump information about which font is causing the crash.  The last line in the file should identify the name of the problematic font.

Comment 9

[[e-mail]]

Thank you very much your help. With the special build from comment 8, I found out that it was the "Song" font installed in my /Library/Fonts folder. Using the validate feature in Font Book shows that there is a problem with the PostScript Compatibility Table. And if I disable it then Google News works fine. So it must have been a corrupt font after all.

I'll mark this bug as invalid since it wasn't a problem with Firefox after all.

Thanks again for your help everybody!

Comment 10

[Jonathan Kew [:jfkthame]]

Thanks for letting us know. Is the "Song" font involved one that's freely available somewhere? I'd be curious to see what kind of problem in the font was leading to the crash.

Comment 11

[John Daggett (:jtd)]

Sorry for the bugspam.  Reopening because we should be catching these errors if possible and not crashing.

Comment 12

[philippe (part-time)]

(In reply to comment #10)
> Thanks for letting us know. Is the "Song" font involved one that's freely
> available somewhere? I'd be curious to see what kind of problem in the font was
> leading to the crash.

Song came pre-installed with 10.3.x (and older maybe). I have it on an old G4 /10.3.9 

http://support.apple.com/kb/HT1538 doesn't list it for 10.4 (but it could have been installed through migration assistant).

(If you want the font to test, email me).

Comment 13

[John Daggett (:jtd)]

If the cause is indeed Song, then this testcase should induce the crash:

  http://tinyurl.com/badsong

However, using Philippe's copy of the font I was unable to induce a crash on 10.4.11 or 10.5.6.  Philippe's version of Song is 4.1d1e1 (FontBook, Preview > Show Font Info).  Stepping through in the debugger, no error occurs while reading in the metrics.

Michael, what's the version of Song you have?  Also, could you attach the logfile described in comment 8? I just want to confirm that the description of the font.

Comment 14

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

(In reply to comment #12)
> Song came pre-installed with 10.3.x (and older maybe). I have it on an old G4
> /10.3.9 
> 
> http://support.apple.com/kb/HT1538 doesn't list it for 10.4 (but it could have
> been installed through migration assistant).

Yeah, it vanished from new installs starting with 10.4; it used to be a default Moz font, but we had to sub it out back in bug 299222 because it was missing on 10.4.

I ran the copy from my 10.3 Mac (also 4.1d1e1) through Font Book on 10.5.6, and it does find a "minor" problem ("Warnings") with the "'post' table usability" in Song Regular.

Comment 15

[Wayne Mery (:wsmwk)]

 Mac 10.5 example from FF4.0.1 (bogus stack?)
d16a7ad7-5232-4f93-a892-152c42110323

Comment 16

[JP Rosevear [:jpr]]

Closing for a couple reasons:
1) gfxAtsuiFont is no longer used, so either its not a problem or we need new crash bugs for it with different signatures

2) It was the Song font, in which case its gone on our supported platforms and not worth caring about.

Comment 17

[JP Rosevear [:jpr]]

Actually closing

Comment 18

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Technically I think this is WORKSFORME since the bug report was valid but no longer causes a problem (and we don't know exactly why).