597975 - crash within Uniscribe shaping code

Status: RESOLVED FIXED

(Core :: Layout: Text and Fonts, defect)

Description

[Mihai Potra]

User-Agent:       Mozilla/5.0 (Windows NT 5.1; rv:2.0b6) Gecko/20100101 Firefox/4.0b6
Build Identifier: Mozilla/5.0 (Windows NT 5.1; rv:2.0b6) Gecko/20100101 Firefox/4.0b6

The latest beta (4.0b6) simply crashes when accessing various websites. I noticed that especially on those that use AJAX (?). The best way to reproduce it is using google.com (with InstantSearch on!)

Reproducible: Always

Steps to Reproduce:
1. go to google.com (instantsearch on!)
2. type in "axis javascript"
3. should crash by the time you reach "javascr". If not, try deleting with the backspace key, until around "axis".
4. Will definitely crash
Actual Results:  
The browser completely crashed without any error message

Expected Results:  
Continue loading the page..

The analysis results of WinDbg:

FAULTING_IP: 
USP10!ClientData::GetOtlTable+35
74dc2645 8b4908          mov     ecx,dword ptr [ecx+8]

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
.exr 0xffffffffffffffff
ExceptionAddress: 74dc2645 (USP10!ClientData::GetOtlTable+0x00000035)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 00000006
Attempt to read from address 00000006

FAULTING_THREAD:  00000da8

PROCESS_NAME:  firefox.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  00000006

READ_ADDRESS:  00000006 

FOLLOWUP_IP: 
USP10!ClientData::GetOtlTable+35
74dc2645 8b4908          mov     ecx,dword ptr [ecx+8]

NTGLOBALFLAG:  70

APPLICATION_VERIFIER_FLAGS:  0

DEFAULT_BUCKET_ID:  INVALID_POINTER_READ

PRIMARY_PROBLEM_CLASS:  INVALID_POINTER_READ

BUGCHECK_STR:  APPLICATION_FAULT_INVALID_POINTER_READ_NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER:  from 74dcbcba to 74dc2645

STACK_TEXT:  
00122b9c 74dcbcba 46454447 00122bdc 00122bc4 USP10!ClientData::GetOtlTable+0x35
00122bb8 74dcb7af 46454447 00122bdc 00122c04 USP10!otlResourceMgr::getOtlTable+0x7a
00122be8 74dc30c1 00122c98 00122cec 00122d18 USP10!SubstituteOtlChars+0x1af
00122f00 1007e0f2 00000000 06f15ec8 00123892 USP10!OtlShape+0x3c5
00122f50 101733ca 00123878 0726f270 0000000d xul!UniscribeItem::Shape+0x82 [e:\builds\moz2_slave\win32_build\build\gfx\thebes\gfxuniscribeshaper.cpp @ 121]
0012357c 10087938 06f15c40 06ff4e80 00123878 xul!gfxUniscribeShaper::InitTextRun+0x37a [e:\builds\moz2_slave\win32_build\build\gfx\thebes\gfxuniscribeshaper.cpp @ 611]
001235a8 10087afd 06f15c40 06ff4e80 00123878 xul!gfxGDIFont::InitTextRun+0xf8 [e:\builds\moz2_slave\win32_build\build\gfx\thebes\gfxgdifont.cpp @ 182]
00123614 10082b7d 00123668 10082bc7 0012378c xul!gfxFontGroup::InitTextRun+0xbd [e:\builds\moz2_slave\win32_build\build\gfx\thebes\gfxfont.cpp @ 2245]
00123714 100878f2 06f15c40 1010fad9 03143c10 xul!gfxScriptItemizer::Next+0x1cd [e:\builds\moz2_slave\win32_build\build\gfx\thebes\gfxscriptitemizer.cpp @ 301]
00123740 781390c9 00610040 00000060 781390c9 xul!gfxGDIFont::InitTextRun+0xb2 [e:\builds\moz2_slave\win32_build\build\gfx\thebes\gfxgdifont.cpp @ 207]
001237b0 100d4cc9 00123878 0000001d 00123818 MOZCRT19!arena_malloc_small+0x149 [e:\builds\moz2_slave\win32_build\build\obj-firefox\memory\jemalloc\crtsrc\jemalloc.c @ 3786]
00123844 1017524d 00000000 00000000 05306710 xul!TextRunWordCache::MakeTextRun+0x4f9 [e:\builds\moz2_slave\win32_build\build\gfx\thebes\gfxtextrunwordcache.cpp @ 693]
001238b0 101755c6 00000000 101758bf 00000000 xul!TextRunWordCache::LookupWord+0xfd [e:\builds\moz2_slave\win32_build\build\gfx\thebes\gfxtextrunwordcache.cpp @ 403]
001239ac 781383c8 06ff4400 06f00000 06f00b80 xul!TextRunWordCache::MakeTextRun+0x266 [e:\builds\moz2_slave\win32_build\build\gfx\thebes\gfxtextrunwordcache.cpp @ 772]
001239c0 781384ef 781384f9 00610040 06ff4400 MOZCRT19!arena_dalloc_small+0x28 [e:\builds\moz2_slave\win32_build\build\obj-firefox\memory\jemalloc\crtsrc\jemalloc.c @ 4154]
001239d8 78138cb3 06ff4428 80000000 10114bc8 MOZCRT19!arena_dalloc+0x2f [e:\builds\moz2_slave\win32_build\build\obj-firefox\memory\jemalloc\crtsrc\jemalloc.c @ 4284]
001239e4 10114bc8 00000001 00000000 101758bf MOZCRT19!free+0x13 [e:\builds\moz2_slave\win32_build\build\obj-firefox\memory\jemalloc\crtsrc\jemalloc.c @ 6121]
001239f0 101758bf 00000000 0000000a 00000000 xul!nsTArray_base::ShiftData+0x38 [e:\builds\moz2_slave\win32_build\build\obj-firefox\xpcom\build\nstarray.cpp @ 164]
00123a04 00123a10 00125388 00000002 80000032 xul!TextRunWordCache::MakeTextRun+0x55f [e:\builds\moz2_slave\win32_build\build\gfx\thebes\gfxtextrunwordcache.cpp @ 806]
WARNING: Frame IP not in any known module. Following frames may be wrong.
00123a08 00125388 00000002 80000032 00000000 <Unloaded_Ed20.dll>+0x123a0f
00123a10 80000032 00000000 00000001 00000001 <Unloaded_Ed20.dll>+0x125387
00123a14 00000000 00000001 00000001 00000014 0x80000032


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  USP10!ClientData::GetOtlTable+35

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: USP10

IMAGE_NAME:  USP10.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  411096ba

STACK_COMMAND:  ~0s ; kb

FAILURE_BUCKET_ID:  INVALID_POINTER_READ_c0000005_USP10.dll!ClientData::GetOtlTable

BUCKET_ID:  APPLICATION_FAULT_INVALID_POINTER_READ_NULL_CLASS_PTR_DEREFERENCE_USP10!ClientData::GetOtlTable+35

WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/firefox_exe/2_0_0_3909/4c8fa718/USP10_dll/1_420_2600_2180/411096ba/c0000005/00032645.htm?Retriage=1

Followup: MachineOwner

Comment 1

[Jonathan Kew [:jfkthame]]

I tried the given steps using both 4.0b6 and the latest 4.0b7pre nightly on XP, and was not able to reproduce the crash.

My guess is that the crash is related to a specific font you happen to have installed. It's crashing deep inside the Windows text-layout code (uniscribe), perhaps due to an error in a font that's getting used for certain search results in your example. I'd recommend that you try uninstalling all third-party fonts from your system, and see if that helps; if so, you can try adding them back in stages to isolate the one that's causing the problem.

Comment 2

[Mihai Potra]

Jonathan, thank you very much for your suggestions.
You were right, it was a font at fault. I've identified the font as "M+ 1c", which I've downloaded from http://www.fontsquirrel.com/fonts/M-1c

removed the font - FireFox 4.0b6 didn't crash following the steps to reproduce
added the font again - FireFox started crashing again

In my searching I've also found a similar bug on chromium ( http://code.google.com/p/chromium/issues/detail?id=3950 ) which in turn refers to another bug here on bugzilla: https://bugzilla.mozilla.org/show_bug.cgi?id=418384 - which is marked as fixed (?) for FF 3 beta

As suggested in the chromium bug report ( http://code.google.com/p/chromium/issues/detail?id=3950#c8 ), I've updated my USP10.dll to the latest version (1.420.2600.2791) - the issues persists.

My concern is that this issue is clearly generated by a font, and I was able to reproduce it using Google.com home page. You say that the font is being used for certain search results, but I doubt that Google would use "M+ 1c" font for displaying their results on the home page.
(even if they were, shouldn't this be considered an exploit issue?)

As such I've attached below a more detailed list of the call stack for the bug. 
Please check out the xul InitTextRun() calls. They all report a memory access error, which sounds to me that this isn't something necessarily in the uniscribe.

00122458 7c90e9c0 7c8025db 000000c0 00000000 ntdll!KiFastSystemCallRet
0012245c 7c8025db 000000c0 00000000 00000000 ntdll!ZwWaitForSingleObject+0xc
001224c0 7c802542 000000c0 ffffffff 00000000 kernel32!WaitForSingleObjectEx+0xa8
001224d4 1052d0d0 000000c0 ffffffff 001227c0 kernel32!WaitForSingleObject+0x12
001224ec 1062fbdd 008400e0 001227c0 00000000 xul!google_breakpad::ExceptionHandler::WriteMinidumpOnHandlerThread(struct _EXCEPTION_POINTERS * exinfo = 0x001227c0, struct MDRawAssertionInfo * assertion = 0x001227c0)+0x6a [e:\builds\moz2_slave\win32_build\build\toolkit\crashreporter\google-breakpad\src\client\windows\handler\exception_handler.cc @ 754]
00122510 01114393 001227c0 001227c0 061e77e6 xul!google_breakpad::ExceptionHandler::HandleException(struct _EXCEPTION_POINTERS * exinfo = 0x001227c0)+0x54 [e:\builds\moz2_slave\win32_build\build\toolkit\crashreporter\google-breakpad\src\client\windows\handler\exception_handler.cc @ 522]
WARNING: Stack unwind information not available. Following frames may be wrong.
00122798 7c843622 001227c0 7c839a54 001227c8 nview!NVQueryDesktopContextMenu+0x2bb83
001227a0 7c839a54 001227c8 00000000 001227c8 kernel32!BaseProcessStart+0x39
001227c8 7c9037bf 001228b4 0012ffe0 001228d0 kernel32!_except_handler3+0x61
001227ec 7c90378b 001228b4 0012ffe0 001228d0 ntdll!ExecuteHandler2+0x26
0012289c 7c90eafa 00000000 001228d0 001228b4 ntdll!ExecuteHandler+0x24
0012289c 74dc2612 00000000 001228d0 001228b4 ntdll!KiUserExceptionDispatcher+0xe
00122b9c 74dcbb7a 46454447 00122bdc 00122bc4 usp10!ClientData::GetOtlTable+0x35
00122bb8 74dcb66f 46454447 00122bdc 00122c04 usp10!otlResourceMgr::getOtlTable+0x7a
00122be8 74dc308e 00122c98 00122cec 00122d18 usp10!SubstituteOtlChars+0x1af
00122f00 1007e0f2 00000000 0770da88 00123892 usp10!OtlShape+0x3c5
00122f50 101733ca 00123878 0727d240 0000000d xul!UniscribeItem::Shape(void)+0x82 [e:\builds\moz2_slave\win32_build\build\gfx\thebes\gfxuniscribeshaper.cpp @ 121]
0012357c 10087938 0770d920 0779a700 00123878 xul!gfxUniscribeShaper::InitTextRun(class gfxContext * aContext = 0x0770d920, class gfxTextRun * aTextRun = 0x0779a700, wchar_t * aString = 0x00123878 " ヘタリアドットコム：TVアニメ「ヘタリア Hetalia???", unsigned int aRunStart = 0xd, unsigned int aRunLength = 8, int aRunScript = 22)+0x37a [e:\builds\moz2_slave\win32_build\build\gfx\thebes\gfxuniscribeshaper.cpp @ 611]
001235a8 10087afd 0770d920 0779a700 00123878 xul!gfxGDIFont::InitTextRun(class gfxContext * aContext = <Memory access error>, class gfxTextRun * aTextRun = <Memory access error>, wchar_t * aString = <Memory access error>, unsigned int aRunStart = <Memory access error>, unsigned int aRunLength = <Memory access error>, int aRunScript = <Memory access error>)+0xf8 [e:\builds\moz2_slave\win32_build\build\gfx\thebes\gfxgdifont.cpp @ 182]
00123614 10082b7d 00123668 10082bc7 0012378c xul!gfxFontGroup::InitTextRun(class gfxContext * aContext = 0x18246c83, class gfxTextRun * aTextRun = 0xbd850f01, wchar_t * aString = 0x8b003d21 "--- memory read error at address 0x8b003d21 ---", unsigned int aTotalLength = 0xce8b0c75, unsigned int aScriptRunStart = 0xfe6a54e8, unsigned int aScriptRunEnd = 0xe8ce8bff, int aRunScript = -103837)+0xbd [e:\builds\moz2_slave\win32_build\build\gfx\thebes\gfxfont.cpp @ 2245]
00123624 10082c65 0770d920 0779a700 00123878 xul!gfxScriptItemizer::Next(unsigned int * aRunStart = 0x0000001d, unsigned int * aRunLimit = 0x0000000d, int * aRunScript = 0x00000016)+0x1cd [e:\builds\moz2_slave\win32_build\build\gfx\thebes\gfxscriptitemizer.cpp @ 301]
0012378c 1020a130 0770d920 0779a700 00123878 xul!gfxFontGroup::InitTextRun(class gfxContext * aContext = 0x0770d920, class gfxTextRun * aTextRun = 0x0779a700, wchar_t * aString = 0x00123878 " ヘタリアドットコム：TVアニメ「ヘタリア Hetalia???", unsigned int aLength = 0x1d)+0x8f [e:\builds\moz2_slave\win32_build\build\gfx\thebes\gfxfont.cpp @ 2214]
001237b0 100d4cc9 00123878 0000001d 00123818 xul!gfxFontGroup::MakeTextRun(wchar_t * aString = 0x00123878 " ヘタリアドットコム：TVアニメ「ヘタリア Hetalia???", unsigned int aLength = 0x1d, struct gfxTextRunFactory::Parameters * aParams = 0x00123818, unsigned int aFlags = 0x1500101)+0x47 [e:\builds\moz2_slave\win32_build\build\gfx\thebes\gfxfont.cpp @ 2190]
00123e04 10259e63 00125218 0000001e 05afbc50 xul!TextRunWordCache::MakeTextRun(wchar_t * aText = 0x00125218 " ヘタリアドットコム：TVアニメ「ヘタリア Hetalia 倠睯牥s???", unsigned int aLength = 0x1e, class gfxFontGroup * aFontGroup = 0x05afbc50, struct gfxTextRunFactory::Parameters * aParams = 0x00123ed4, unsigned int aFlags = 0x1500100)+0x4f9 [e:\builds\moz2_slave\win32_build\build\gfx\thebes\gfxtextrunwordcache.cpp @ 693]
00123e28 1019b8bb 00125218 0000001e 00123ed4 xul!MakeTextRun(wchar_t * aText = 0x00125218 " ヘタリアドットコム：TVアニメ「ヘタリア Hetalia 倠睯牥s???", unsigned int aLength = 0x1e, class gfxFontGroup * aFontGroup = 0xfffffffe, struct gfxTextRunFactory::Parameters * aParams = 0x00123ed4, unsigned int aFlags = 0x1500100)+0x39 [e:\builds\moz2_slave\win32_build\build\layout\generic\nstextframethebes.cpp @ 450]
001251e8 101a1dd0 001262e0 00125254 00000000 xul!BuildTextRunsScanner::BuildTextRunForFrames(void * aTextBuffer = 0x00000001)+0x88b [e:\builds\moz2_slave\win32_build\build\layout\generic\nstextframethebes.cpp @ 1812]
00126214 101b18e1 00000000 00000000 00000000 xul!BuildTextRunsScanner::FlushFrames(int aFlushLineBreaks = -1929379821, int aSuppressTrailingBreak = -2)+0xa0 [e:\builds\moz2_slave\win32_build\build\layout\generic\nstextframethebes.cpp @ 1243]
0012624c 101b18aa 069f8270 06a409b8 00000005 xul!BuildTextRunsScanner::ScanFrame(class nsIFrame * aFrame = 0x1839db33)+0x211 [e:\builds\moz2_slave\win32_build\build\layout\generic\nstextframethebes.cpp @ 1394]
00126284 1019e470 00000000 0770d920 00126714 xul!BuildTextRunsScanner::ScanFrame(class nsIFrame * aFrame = 0x00126548)+0x1da [e:\builds\moz2_slave\win32_build\build\layout\generic\nstextframethebes.cpp @ 1433]
001265d4 10192701 0770d920 069fccd0 00126a94 xul!BuildTextRuns(class gfxContext * aContext = 0x0770d920, class nsTextFrame * aForFrame = 0x069fccd0, class nsIFrame * aLineContainer = 0x00122bdc, class nsLineList_iterator * aForFrameLine = 0x00126a94)+0x280 [e:\builds\moz2_slave\win32_build\build\layout\generic\nstextframethebes.cpp @ 1151]

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Not going to block on a Uniscribe crash on a local font.

However, we should check that when using that font as a downloadable font, OTS prevents a crash.

Comment 4

[Al Billings [:abillings - ex-MoCo]]

That font is blocked in bug 588233's fix. I'm calling this fixed here.