If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

Invalid write in gfxShapedWord::SetupClusterBoundaries with U+1112C

RESOLVED DUPLICATE of bug 732330

Status

()

Core
Layout: Text
--
critical
RESOLVED DUPLICATE of bug 732330
6 years ago
3 years ago

People

(Reporter: Jesse Ruderman, Unassigned)

Tracking

(Blocks: 1 bug, 4 keywords)

Trunk
x86_64
Mac OS X
assertion, crash, regression, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [sg:critical])

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
Created attachment 602603 [details]
testcase (crashes Firefox)

The testcase crashes Firefox trunk at random within a few seconds. It's more deterministic (and less crashy) under Valgrind:

> Invalid write of size 4
>    at 0xA696696: gfxShapedWord::SetupClusterBoundaries(gfxShapedWord::CompressedGlyph*, unsigned short const*, unsigned int) (gfxFont.cpp:3806)
>    by 0xA6A2286: void gfxFontGroup::InitScriptRun<unsigned short>(gfxContext*, gfxTextRun*, unsigned short const*, unsigned int, unsigned int, int) (gfxFont.cpp:3240)
>    by 0xA69E7B6: void gfxFontGroup::InitTextRun<unsigned short>(gfxContext*, gfxTextRun*, unsigned short const*, unsigned int) (gfxFont.cpp:3171)
>    by 0xA694E47: gfxFontGroup::MakeTextRun(unsigned short const*, unsigned int, gfxTextRunFactory::Parameters const*, unsigned int) (gfxFont.cpp:3076)
>    by 0x89ACC44: gfxTextRun* MakeTextRun<unsigned short>(unsigned short const*, unsigned int, gfxFontGroup*, gfxTextRunFactory::Parameters const*, unsigned int) (nsTextFrameThebes.cpp:559)
>    by 0x8993764: BuildTextRunsScanner::BuildTextRunForFrames(void*) (nsTextFrameThebes.cpp:1972)
>    by 0x8991B40: BuildTextRunsScanner::FlushFrames(bool, bool) (nsTextFrameThebes.cpp:1397)
>    by 0x89964C9: BuildTextRuns(gfxContext*, nsTextFrame*, nsIFrame*, nsLineList_iterator const*, nsTextFrame::TextRunType, float) (nsTextFrameThebes.cpp:1325)
>    by 0x89955C3: nsTextFrame::EnsureTextRun(nsTextFrame::TextRunType, float, gfxContext*, nsIFrame*, nsLineList_iterator const*, unsigned int*) (nsTextFrameThebes.cpp:2390)
>    by 0x89A7C6B: nsTextFrame::ReflowText(nsLineLayout&, int, nsRenderingContext*, bool, nsHTMLReflowMetrics&, unsigned int&) (nsTextFrameThebes.cpp:7375)
>    by 0x895B26D: nsLineLayout::ReflowFrame(nsIFrame*, unsigned int&, nsHTMLReflowMetrics*, bool&) (nsLineLayout.cpp:870)
>    by 0x88CA500: nsBlockFrame::ReflowInlineFrame(nsBlockReflowState&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*) (nsBlockFrame.cpp:3837)
>  Address 0x1032926f0 is 0 bytes after a block of size 128 alloc'd
>    at 0xC743: malloc (vg_replace_malloc.c:266)
>    by 0x7E1C784: moz_malloc (mozalloc.cpp:113)
>    by 0xA696E64: gfxTextRun::AllocateStorageForTextRun(unsigned long, unsigned int) (gfxFont.cpp:3977)
>    by 0xA69423F: gfxTextRun::Create(gfxTextRunFactory::Parameters const*, void const*, unsigned int, gfxFontGroup*, unsigned int) (gfxFont.cpp:3994)
>    by 0xA694E0C: gfxFontGroup::MakeTextRun(unsigned short const*, unsigned int, gfxTextRunFactory::Parameters const*, unsigned int) (gfxFont.cpp:3070)
>    by 0x89ACC44: gfxTextRun* MakeTextRun<unsigned short>(unsigned short const*, unsigned int, gfxFontGroup*, gfxTextRunFactory::Parameters const*, unsigned int) (nsTextFrameThebes.cpp:559)
>    by 0x8993764: BuildTextRunsScanner::BuildTextRunForFrames(void*) (nsTextFrameThebes.cpp:1972)
>    by 0x8991B40: BuildTextRunsScanner::FlushFrames(bool, bool) (nsTextFrameThebes.cpp:1397)
>    by 0x89964C9: BuildTextRuns(gfxContext*, nsTextFrame*, nsIFrame*, nsLineList_iterator const*, nsTextFrame::TextRunType, float) (nsTextFrameThebes.cpp:1325)
>    by 0x89955C3: nsTextFrame::EnsureTextRun(nsTextFrame::TextRunType, float, gfxContext*, nsIFrame*, nsLineList_iterator const*, unsigned int*) (nsTextFrameThebes.cpp:2390)
>    by 0x89A7C6B: nsTextFrame::ReflowText(nsLineLayout&, int, nsRenderingContext*, bool, nsHTMLReflowMetrics&, unsigned int&) (nsTextFrameThebes.cpp:7375)
>    by 0x895B26D: nsLineLayout::ReflowFrame(nsIFrame*, unsigned int&, nsHTMLReflowMetrics*, bool&) (nsLineLayout.cpp:870)

Seems to be a regression from the last few days.
(Reporter)

Updated

6 years ago
Whiteboard: [sg:critical]
This is the same issue as jdaggett encountered in bug 732330, and is already fixed on mozilla-inbound by bug 732443.
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 732330
Group: core-security
You need to log in before you can comment on or make changes to this bug.