Closed Bug 968026 Opened 6 years ago Closed 6 years ago

Crash in OpenType Sanitiser

Categories

(Core :: Graphics: Text, defect)

x86_64
Windows 7
defect
Not set

Tracking

()

RESOLVED FIXED
mozilla30
Tracking Status
firefox29 --- fixed
firefox30 --- fixed

People

(Reporter: jkitch, Assigned: jfkthame)

References

Details

(Keywords: regression)

Attachments

(1 file, 1 obsolete file)

Click on Firefox menu button, then select "Sign in to Sync".    Alternatively visit html5test.com

Nightly will then crash with the following error sent to console

###!!! ABORT: CRT ASSERT C:\Program Files (x86)\Microsoft Visual Studio 11.0\VC\
INCLUDE\xtree(237) : Assertion failed: map/set iterator not dereferencable


It appears that the offending line is
https://hg.mozilla.org/mozilla-central/annotate/2c366892729d/gfx/ots/src/ots.cc#l584


Note this is only reproducible on locally built versions of Firefox.

My build configuration is as follows:
Built from https://hg.mozilla.org/mozilla-central/rev/2c366892729d
mozilla-build-1.9pre (the one on the mozilla-build page on the wiki)
Visual Studio 2012 Update 4.
.mozconfig:
ac_add_options --enable-debug
ac_add_options --disable-optimize
Khaled, this corresponds to

  https://github.com/khaledhosny/ots/blob/master/src/ots.cc#L576

and on inspection, it looks suspicious to me... if |it == table_map.end()|, is it valid to try and access it->first at all?
Blocks: 941019
Keywords: regression
This is a regression from the OTS update in bug 941019, now fixed upstream; Fred, mind rubber-stamping this, as you handled the OTS import there? Thanks.
Attachment #8370635 - Flags: review?(fred.wang)
Assignee: nobody → jfkthame
Status: NEW → ASSIGNED
Attachment #8370635 - Flags: review?(fred.wang) → review+
Backed out for bustage:
https://hg.mozilla.org/integration/mozilla-inbound/rev/8d88bed7fef0

Will re-land after figuring out why it's unhappy.
OK, it's trivial: we don't want the |header| argument to GetTableAction, as that's related to the recent ots::OTSContext refactoring upstream that we haven't imported yet.
Attachment #8370635 - Attachment is obsolete: true
:jkitch, if you could confirm this resolves the problem you're seeing, we should then nominate it for aurora uplift.
Flags: needinfo?(jkitch.bug)
https://hg.mozilla.org/mozilla-central/rev/537c83f1c323
Status: ASSIGNED → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
This appears to have fixed the problem.  With the latest m-c I can no longer reproduce the crash.
Flags: needinfo?(jkitch.bug)
Comment on attachment 8370670 [details] [diff] [review]
cherrypick and rebase upstream commit a9a5f453467d1494ebf9f31cba99c2c49b37fd52 to fix potential OTS crash.

[Approval Request Comment]
Bug caused by (feature/regressing bug #): OTS update, bug 941019

User impact if declined: potential crash when using downloadable fonts

Testing completed (on m-c, etc.): confirmed to fix the crash with current m-c

Risk to taking this patch (and alternatives if risky): minimal risk, trivial bug-fix from OTS upstream

String or IDL/UUID changes made by this patch: none
Attachment #8370670 - Flags: approval-mozilla-aurora?
Attachment #8370670 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
You need to log in before you can comment on or make changes to this bug.