739083 - xul!gfxUserFontSet::OnLoadComplete crash

Status: RESOLVED DUPLICATE of bug 736435

(Core :: Layout: Text and Fonts, defect)

Description

[passfree]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/536.4 (KHTML, like Gecko) Chrome/19.0.1077.3 Safari/536.4

Steps to reproduce:

This bug was found on windows 7. The stach trace for the crash is as it follows:


001fc6cc 72ecf07c c06d007e 00000000 00000001 KERNELBASE!RaiseException+0x58
001fc734 72ece9fd 00000150 001fc6f0 00000014 xul!__delayLoadHelper2+0x13b [f:\sp\vctools\delayimp\delayhlp.cpp @ 331]
001fc78c 72dcfd9a 0ac29000 00000001 80000000 xul!_tailMerge_gkmedias_dll+0xd
001fc900 727a69f0 0517ff60 0ac29000 00009e38 xul!gfxUserFontSet::OnLoadComplete+0xd1 [e:\builds\moz2_slave\rel-m-rel-xr-w32-bld\build\gfx\thebes\gfxuserfontset.cpp @ 587]
001fc994 7262137d 0a7a4a60 0aba7840 00000000 xul!nsFontFaceLoader::OnStreamComplete+0x14a [e:\builds\moz2_slave\rel-m-rel-xr-w32-bld\build\layout\style\nsfontfaceloader.cpp @ 248]
001fc9c0 7281b43d 0aba7850 0a8939fc 00000000 xul!nsStreamLoader::OnStopRequest+0x37 [e:\builds\moz2_slave\rel-m-rel-xr-w32-bld\build\netwerk\base\src\nsstreamloader.cpp @ 126]
001fc9d4 7260b191 0ab9bdc0 0a8939fc 00000000 xul!nsCORSListenerProxy::OnStopRequest+0x19 [e:\builds\moz2_slave\rel-m-rel-xr-w32-bld\build\content\base\src\nscrosssitelistenerproxy.cpp @ 623]
001fc9f4 726102e4 0a893a0c 05eb5d30 00000000 xul!nsBaseChannel::OnStopRequest+0x3f [e:\builds\moz2_slave\rel-m-rel-xr-w32-bld\build\netwerk\base\src\nsbasechannel.cpp @ 746]
001fca14 72610347 00000000 0aba7910 00000000 xul!nsInputStreamPump::OnStateStop+0x53 [e:\builds\moz2_slave\rel-m-rel-xr-w32-bld\build\netwerk\base\src\nsinputstreampump.cpp @ 581]
001fca28 72d8bf4b 05eb5d34 0aba9028 00c151d0 xul!nsInputStreamPump::OnInputStreamReady+0x38 [e:\builds\moz2_slave\rel-m-rel-xr-w32-bld\build\netwerk\base\src\nsinputstreampump.cpp @ 406]
001fca38 72d98afb 0aba7900 00c286c0 00c0e200 xul!nsOutputStreamReadyEvent::Run+0x1c [e:\builds\moz2_slave\rel-m-rel-xr-w32-bld\build\xpcom\io\nsstreamutils.cpp @ 115]
001fca68 72d7363d 01c151d0 00000000 001fca87 xul!nsThread::ProcessNextEvent+0x1bc [e:\builds\moz2_slave\rel-m-rel-xr-w32-bld\build\xpcom\threads\nsthread.cpp @ 660]
001fca7c 72d292fc 01c151d0 00000000 00c286c0 xul!NS_ProcessNextEvent_P+0x24 [e:\builds\moz2_slave\rel-m-rel-xr-w32-bld\build\obj-firefox\xpcom\build\nsthreadutils.cpp @ 245]
001fcaa8 72db11bf 01c286c0 72db1565 26ba15cf xul!mozilla::ipc::MessagePump::Run+0x46 [e:\builds\moz2_slave\rel-m-rel-xr-w32-bld\build\ipc\glue\messagepump.cpp @ 110]
001fcab0 72db1565 26ba15cf 00c151d0 00c286c0 xul!MessageLoop::RunInternal+0xb [e:\builds\moz2_slave\rel-m-rel-xr-w32-bld\build\ipc\chromium\src\base\message_loop.cc @ 209]
001fcae4 72db1780 037fca60 00000001 001fea00 xul!MessageLoop::RunHandler+0x4d [e:\builds\moz2_slave\rel-m-rel-xr-w32-bld\build\ipc\chromium\src\base\message_loop.cc @ 202]
001fcb04 72ca9fe0 73d1bdc0 037fca60 72c8aa72 xul!MessageLoop::Run+0x19 [e:\builds\moz2_slave\rel-m-rel-xr-w32-bld\build\ipc\chromium\src\base\message_loop.cc @ 176]
001fcb10 72c8aa72 037fca60 00cab2e0 00000000 xul!nsBaseAppShell::Run+0x2a [e:\builds\moz2_slave\rel-m-rel-xr-w32-bld\build\widget\src\xpwidgets\nsbaseappshell.cpp @ 191]
001fea64 72ba7e76 037fca60 00000000 725f9d00 xul!nsAppShell::Run+0x47 [e:\builds\moz2_slave\rel-m-rel-xr-w32-bld\build\widget\src\windows\nsappshell.cpp @ 258]
001fea70 725f9d00 00cab2e0 80000000 00000000 xul!nsAppStartup::Run+0x1e [e:\builds\moz2_slave\rel-m-rel-xr-w32-bld\build\toolkit\components\startup\nsappstartup.cpp @ 221]
001fede4 013c1709 00000001 00b12fc8 00c18040 xul!XRE_main+0x1692 [e:\builds\moz2_slave\rel-m-rel-xr-w32-bld\build\toolkit\xre\nsapprunner.cpp @ 3520]
001ffb2c 013c1852 00000001 00b12fc8 00001db1 runner!NS_internal_main+0x3ff [e:\builds\moz2_slave\rel-m-rel-xr-w32-bld\build\xulrunner\stub\nsxulstub.cpp @ 516]
001ffb60 013c2929 00000000 00b11ea0 00b11f10 runner!wmain+0xf1 [e:\builds\moz2_slave\rel-m-rel-xr-w32-bld\build\toolkit\xre\nswindowswmain.cpp @ 109]
001ffbb0 751c33ca fffde000 001ffbfc 772d9ed2 runner!__tmainCRTStartup+0x15e [f:\sp\vctools\crt_bld\self_x86\crt\src\crt0.c @ 327]
001ffbbc 772d9ed2 fffde000 7763d843 00000000 KERNEL32!BaseThreadInitThunk+0xe
001ffbfc 772d9ea5 013c2980 fffde000 00000000 ntdll_772a0000!__RtlUserThreadStart+0x70
001ffc14 00000000 013c2980 fffde000 00000000 ntdll_772a0000!_RtlUserThreadStart+0x1b

This bug seems to appear due to a web font loaded by CSS. The same code was tasted with xulrunner 8.0 without this problem. The font is actually local for a xul app/extension. Also, quite interesting the same code does not produce a crash if loaded from UNC path, perhaps because the loading will be slower and we don't hit this condition.