743767 - Firefox crash @ memcpy | GlyphBufferAzure::Flush

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Marcia Knous [:marcia]]

Seen while looking at trunk crash stats. Crashes started showing up in crash stats using the 2012040603 build. Fairly small volume but looks like different users based on driver versions.

Comments: "Browsing the list of official components for Foobar2000 media player."

Possible regression range based on crash stats: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=ed9cbe6a817e&tochange=da0d07b5ca1e

https://crash-stats.mozilla.com/report/index/be348524-39fb-402d-8781-737652120409

Frame 	Module 	Signature 	Source
0 	msvcr100.dll 	memcpy 	f:\\dd\\vctools\\crt_bld\\SELF_64_amd64\\crt\\src\\amd64\\memcpy.asm:274
1 	xul.dll 	GlyphBufferAzure::Flush 	gfx/thebes/gfxFont.cpp:1517
2 	mozglue.dll 	choose_arena 	memory/jemalloc/jemalloc.c:2969
3 	uxtheme.dll 	_InternalSystemParametersInfo 	
4 	uxtheme.dll 	ThemeSystemParametersInfoA 	
5 	xul.dll 	gfxFont::Draw 	gfx/thebes/gfxFont.cpp:1922

Comment 1

[Jonathan Kew [:jfkthame]]

I see a couple of issues with the code in GlyphBufferAzure::Flush:

(a) incorrect casts, so that it'll look at the wrong location for the matrix in radial-gradient and surface patterns;

(b) it doesn't check whether the pattern may be one (color) that doesn't have a matrix at all.

(This code landed in bug 738691.)

Comment 2

[Jonathan Kew [:jfkthame]]

Attachment: patch (untested) - fix the pattern matrix issues

Comment 3

[Bas Schouten (:bas.schouten)]

Comment on attachment 613360 [details] [diff] [review]
patch (untested) - fix the pattern matrix issues

Review of attachment 613360 [details] [diff] [review]:
-----------------------------------------------------------------

I'm ashamed.

Comment 4

[Jonathan Kew [:jfkthame]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ca10513eff60

Comment 5

[(no longer active)]

https://hg.mozilla.org/mozilla-central/rev/ca10513eff60