968026 - Crash in OpenType Sanitiser

Status: RESOLVED FIXED

(Core :: Graphics: Text, defect)

Description

[James Kitchener (:jkitch)]

Click on Firefox menu button, then select "Sign in to Sync".    Alternatively visit html5test.com

Nightly will then crash with the following error sent to console

###!!! ABORT: CRT ASSERT C:\Program Files (x86)\Microsoft Visual Studio 11.0\VC\
INCLUDE\xtree(237) : Assertion failed: map/set iterator not dereferencable


It appears that the offending line is
https://hg.mozilla.org/mozilla-central/annotate/2c366892729d/gfx/ots/src/ots.cc#l584


Note this is only reproducible on locally built versions of Firefox.

My build configuration is as follows:
Built from https://hg.mozilla.org/mozilla-central/rev/2c366892729d
mozilla-build-1.9pre (the one on the mozilla-build page on the wiki)
Visual Studio 2012 Update 4.
.mozconfig:
ac_add_options --enable-debug
ac_add_options --disable-optimize

Comment 1

[Jonathan Kew [:jfkthame]]

Khaled, this corresponds to

  https://github.com/khaledhosny/ots/blob/master/src/ots.cc#L576

and on inspection, it looks suspicious to me... if |it == table_map.end()|, is it valid to try and access it->first at all?

Comment 2

[Khaled Hosny]

A thinko, fixed in https://github.com/khaledhosny/ots/commit/a9a5f453467d1494ebf9f31cba99c2c49b37fd52

Comment 3

[Jonathan Kew [:jfkthame]]

Attachment: cherrypick upstream commit a9a5f453467d1494ebf9f31cba99c2c49b37fd52 to fix potential OTS crash.

This is a regression from the OTS update in bug 941019, now fixed upstream; Fred, mind rubber-stamping this, as you handled the OTS import there? Thanks.

Comment 4

[Jonathan Kew [:jfkthame]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/48b28facb0b8

Comment 5

[Jonathan Kew [:jfkthame]]

Backed out for bustage:
https://hg.mozilla.org/integration/mozilla-inbound/rev/8d88bed7fef0

Will re-land after figuring out why it's unhappy.

Comment 6

[Jonathan Kew [:jfkthame]]

Attachment: cherrypick and rebase upstream commit a9a5f453467d1494ebf9f31cba99c2c49b37fd52 to fix potential OTS crash.

OK, it's trivial: we don't want the |header| argument to GetTableAction, as that's related to the recent ots::OTSContext refactoring upstream that we haven't imported yet.

Comment 7

[Jonathan Kew [:jfkthame]]

:jkitch, if you could confirm this resolves the problem you're seeing, we should then nominate it for aurora uplift.

Comment 8

[Jonathan Kew [:jfkthame]]

Relanded on inbound:
https://hg.mozilla.org/integration/mozilla-inbound/rev/537c83f1c323

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/537c83f1c323

Comment 10

[James Kitchener (:jkitch)]

This appears to have fixed the problem.  With the latest m-c I can no longer reproduce the crash.

Comment 11

[Jonathan Kew [:jfkthame]]

Comment on attachment 8370670 [details] [diff] [review]
cherrypick and rebase upstream commit a9a5f453467d1494ebf9f31cba99c2c49b37fd52 to fix potential OTS crash.

[Approval Request Comment]
Bug caused by (feature/regressing bug #): OTS update, bug 941019

User impact if declined: potential crash when using downloadable fonts

Testing completed (on m-c, etc.): confirmed to fix the crash with current m-c

Risk to taking this patch (and alternatives if risky): minimal risk, trivial bug-fix from OTS upstream

String or IDL/UUID changes made by this patch: none

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/e73d637566fd