743593 - Crash in _moz_cairo_font_face_destroy

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Loic]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20120408 Firefox/14.0a1
Build ID: 20120408031146

Steps to reproduce:

1. Be sure hardware acceleration (HWA) is enabled
2. Open this JS demo http://js1k.com/2012-love/demo/1243
NB: Note the demo slows Firefox a lot when HWA is enabled! (that's another issue, I guess)
3. Disable HWA
4. Quit Firefox


Actual results:

FF14 crashes after exiting.
FF13 doesn't crash but FF12 crashes too, reported here in https://bugzilla.mozilla.org/show_bug.cgi?id=737279#c9

CR: https://crash-stats.mozilla.com/report/index/bp-bc4f0cd7-c674-43ad-a67c-4e5752120408

Frame 	Module 	Signature 	Source
0 	xul.dll 	_moz_cairo_font_face_destroy 	gfx/cairo/cairo/src/cairo-font-face.c:141
1 	xul.dll 	gfxDWriteFont::`vector deleting destructor' 	
2 	xul.dll 	gfxFontCache::DestroyFont 	gfx/thebes/gfxFont.cpp:1274
3 	xul.dll 	gfxFontCache::NotifyExpired 	gfx/thebes/gfxFont.cpp:1262
4 	xul.dll 	nsExpirationTracker<gfxFont,3>::AgeOneGeneration 	obj-firefox/dist/include/nsExpirationTracker.h:221
5 	xul.dll 	nsExpirationTracker<gfxTextRun,3>::AgeAllGenerations 	obj-firefox/dist/include/nsExpirationTracker.h:245
6 	xul.dll 	gfxFontCache::~gfxFontCache 	gfx/thebes/gfxFont.cpp:1191
7 	xul.dll 	gfxFontCache::`scalar deleting destructor' 	
8 	xul.dll 	gfxFontCache::Shutdown 	gfx/thebes/gfxFont.cpp:1146
9 	xul.dll 	gfxPlatform::Shutdown 	gfx/thebes/gfxPlatform.cpp:350
10 	xul.dll 	nsComponentManagerImpl::KnownModule::~KnownModule 	xpcom/components/nsComponentManager.h:207
11 	xul.dll 	nsTArray<nsAutoPtr<nsComponentManagerImpl::KnownModule>,nsTArrayDefaultAllocator>::DestructRange 	obj-firefox/dist/include/nsTArray.h:1243
12 	xul.dll 	nsTArray<nsAutoPtr<nsComponentManagerImpl::KnownModule>,nsTArrayDefaultAllocator>::RemoveElementsAt 	obj-firefox/dist/include/nsTArray.h:963
13 	xul.dll 	nsComponentManagerImpl::Shutdown 	xpcom/components/nsComponentManager.cpp:770
14 	xul.dll 	mozilla::ShutdownXPCOM 	xpcom/build/nsXPComInit.cpp:701
15 	xul.dll 	ScopedXPCOMStartup::~ScopedXPCOMStartup 	toolkit/xre/nsAppRunner.cpp:1129
16 	xul.dll 	XREMain::XRE_main 	toolkit/xre/nsAppRunner.cpp:3871
17 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3925
18 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:107
19 	firefox.exe 	__tmainCRTStartup 	crtexe.c:552
20 	kernel32.dll 	BaseThreadInitThunk 	
21 	ntdll.dll 	__RtlUserThreadStart 	
22 	ntdll.dll 	_RtlUserThreadStart

Comment 1

[Alice0775 White]

Regression window(m-c)
Not crash:
http://hg.mozilla.org/mozilla-central/rev/ac5721fa4acb
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20120404 Firefox/14.0a1 ID:20120405024521
Crash:
http://hg.mozilla.org/mozilla-central/rev/90a4942abf08
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20120405 Firefox/14.0a1 ID:20120405105200
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=ac5721fa4acb&tochange=90a4942abf08



Regression window(m-i)
Not crash:
http://hg.mozilla.org/integration/mozilla-inbound/rev/a13c9668e47f
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20120404 Firefox/14.0a1 ID:20120404151823
Crash:
http://hg.mozilla.org/integration/mozilla-inbound/rev/3b2230d34d3f
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20120404 Firefox/14.0a1 ID:20120404152120
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=a13c9668e47f&tochange=3b2230d34d3f

Triggered by:
3b2230d34d3f	Matt Woodrow — Bug 719776: Kill some external dependencies inside Azure code. r=Bas

Comment 2

[Bas Schouten (:bas.schouten)]

Attachment: Make sure we use the actual font type

This is caused by, when hardware acceleration is switched off, mUseDirectWrite becoming false, but existing fonts in the cache still being DWrite fonts. We should properly detect the actual font type, and base our cast on that!

Comment 3

[Jonathan Kew [:jfkthame]]

Comment on attachment 613568 [details] [diff] [review]
Make sure we use the actual font type

Review of attachment 613568 [details] [diff] [review]:
-----------------------------------------------------------------

Seems fine, assuming you'll remove the gfx2d.sln chunk.

I notice that gfxWindowsPlatform seems to be acquiring a mixture of 2- and 4-space indentation, and even some hard tabs :( ... care to do some whitespace-fixup while you're here? The standard in gfx/ has historically been 4-space indents.

::: gfx/thebes/gfxFont.h
@@ +1533,5 @@
> +        FONT_TYPE_MAC,
> +        FONT_TYPE_OS2
> +    } FontType;
> +
> +    virtual FontType GetType() = 0;

This should to be declared as a const function (here and in all the implementations), I think.

Comment 4

[Bas Schouten (:bas.schouten)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/2fcf9cbedd48

Comment 5

[(no longer active)]

https://hg.mozilla.org/mozilla-central/rev/2fcf9cbedd48