918340 - crash in gfxSVGGlyphs::~gfxSVGGlyphs()

Status: VERIFIED FIXED

(Core :: Graphics: Text, defect)

Description

[Tracy Walker [:tracy]]

This bug was filed from the Socorro interface and is 
report bp-689827a8-d12a-42c8-b266-b80142130919.
=============================================================

This is a regression in Aurora(26) and Nightly(27)
@ gfxSVGGlyphs::~gfxSVGGlyphs()
@ gfxFontEntry::DisconnectSVG()

These were fixed in 24 and 25. Both have reappeared in notable volume. Based on crash data this started happening on 20130915
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=53d5e43e23cc&tochange=9366ee039645

Work was checked in by Jonathan Kew in that time frame in Bug 916048 - SVG-in-OpenType glyphs use the font's unitsPerEm value, not a fixed 1000-unit space

Comment 1

[Tracy Walker [:tracy]]

Jonathan, can you take a look?

Comment 2

[Jonathan Kew [:jfkthame]]

This must be due to bug 871961 (not 916048).

I suspect the root cause might turn out to be bug 838105, in which case this has just been fixed on trunk, but we'll need to wait and see whether the crashes stop as we don't have a reproducible testcase AFAIK.

If the crashes continue after the fix for 838105, we may have to back out bug 871961 parts 2 and 4 (again).

Comment 3

[Tracy Walker [:tracy]]

The only crashes occurring with this signature are with builds up to and including 20130919030202. No crashes with builds after that.  That coincides with the check-in for bug 838105.

Comment 4

[Tracy Walker [:tracy]]

Verified per no more crashes since bug 838105 fix was checked in.

The same goes for 
gfxFontEntry::DisconnectSVG()
and
hb_blob_destroy
No crashes at any of these signatures with builds after 20130919030202.