16996 2008-01-24 14:54:16 -0800 Crash in createFontCustomPlatformData when loading 0-byte font via @font-face 2008-01-24 15:14:46 -0800 1 1 1 Unclassified WebKit Page Loading 528+ (Nightly build) All All RESOLVED FIXED P2 Major --- 1 aroben aroben ddkilzer hyatt mitz oldest_to_newest 68135 0 aroben 2008-01-24 14:54:16 -0800 Loading a page with an @font-face rule like so: @font-face { font-family: EmptyFont; src: url(data:application/x-truetype-font,) format(truetype); } causes the following crash (the SharedBuffer is null): WebKit_debug.dll!WTF::Vector<char,0>::size() Line 422 + 0x11 bytes C++ WebKit_debug.dll!WebCore::SharedBuffer::size() Line 51 C++ > WebKit_debug.dll!WebCore::createFontCustomPlatformData(WebCore::SharedBuffer * buffer=0x00000000) Line 67 + 0xe bytes C++ WebKit_debug.dll!WebCore::CachedFont::ensureCustomFontData() Line 88 + 0x14 bytes C++ WebKit_debug.dll!WebCore::CSSFontFaceSource::getFontData(const WebCore::FontDescription & fontDescription={...}, bool syntheticBold=false, bool syntheticItalic=false, WebCore::CSSFontSelector * fontSelector=0x04ba47d0) Line 126 + 0xb bytes C++ WebKit_debug.dll!WebCore::CSSFontFace::getFontData(const WebCore::FontDescription & fontDescription={...}, bool syntheticBold=false, bool syntheticItalic=false) Line 84 + 0x2e bytes C++ WebKit_debug.dll!WebCore::CSSSegmentedFontFace::getFontData(const WebCore::FontDescription & fontDescription={...}, bool syntheticBold=false, bool syntheticItalic=false) Line 125 + 0x34 bytes C++ WebKit_debug.dll!WebCore::CSSFontSelector::getFontData(const WebCore::FontDescription & fontDescription={...}, const WebCore::AtomicString & familyName={...}) Line 359 + 0x1b bytes C++ WebKit_debug.dll!WebCore::FontCache::getFontData(const WebCore::Font & font={...}, int & familyIndex=1, WebCore::FontSelector * fontSelector=0x04ba47d0) Line 237 + 0x21 bytes C++ WebKit_debug.dll!WebCore::FontFallbackList::fontDataAt(const WebCore::Font * font=0x04ab0c88, unsigned int realizedFontIndex=0) Line 85 + 0x1c bytes C++ WebKit_debug.dll!WebCore::FontFallbackList::primaryFont(const WebCore::Font * f=0x04ab0c88) Line 56 + 0x1c bytes C++ WebKit_debug.dll!WebCore::FontFallbackList::determinePitch(const WebCore::Font * font=0x04ab0c88) Line 57 + 0xc bytes C++ WebKit_debug.dll!WebCore::FontFallbackList::isFixedPitch(const WebCore::Font * f=0x04ab0c88) Line 48 + 0x23 bytes C++ WebKit_debug.dll!WebCore::Font::isFixedPitch() Line 542 C++ WebKit_debug.dll!WebCore::RenderText::widthFromCache(const WebCore::Font & f={...}, int start=0, int len=12, int xPos=0) Line 408 + 0x8 bytes C++ WebKit_debug.dll!WebCore::RenderText::width(unsigned int from=0, unsigned int len=12, const WebCore::Font & f={...}, int xPos=0) Line 1042 + 0x18 bytes C++ WebKit_debug.dll!WebCore::RenderBlock::findNextLineBreak(WebCore::BidiIterator & start={...}, WebCore::BidiResolver<WebCore::BidiIterator,WebCore::BidiRun> & bidi={...}) Line 1647 + 0x37 bytes C++ WebKit_debug.dll!WebCore::RenderBlock::layoutInlineChildren(bool relayoutChildren=false, int & repaintTop=0, int & repaintBottom=0) Line 969 + 0x1a bytes C++ WebKit_debug.dll!WebCore::RenderBlock::layoutBlock(bool relayoutChildren=false) Line 583 C++ WebKit_debug.dll!WebCore::RenderBlock::layout() Line 492 + 0x14 bytes C++ WebKit_debug.dll!WebCore::RenderObject::layoutIfNeeded() Line 489 + 0x30 bytes C++ WebKit_debug.dll!WebCore::RenderBlock::layoutBlockChildren(bool relayoutChildren=false, int & maxFloatBottom=0) Line 1232 C++ WebKit_debug.dll!WebCore::RenderBlock::layoutBlock(bool relayoutChildren=false) Line 587 C++ WebKit_debug.dll!WebCore::RenderBlock::layout() Line 492 + 0x14 bytes C++ WebKit_debug.dll!WebCore::RenderObject::layoutIfNeeded() Line 489 + 0x30 bytes C++ WebKit_debug.dll!WebCore::RenderBlock::layoutBlockChildren(bool relayoutChildren=false, int & maxFloatBottom=0) Line 1232 C++ WebKit_debug.dll!WebCore::RenderBlock::layoutBlock(bool relayoutChildren=false) Line 587 C++ WebKit_debug.dll!WebCore::RenderBlock::layout() Line 492 + 0x14 bytes C++ WebKit_debug.dll!WebCore::RenderObject::layoutIfNeeded() Line 489 + 0x30 bytes C++ WebKit_debug.dll!WebCore::RenderBlock::layoutBlockChildren(bool relayoutChildren=false, int & maxFloatBottom=0) Line 1232 C++ WebKit_debug.dll!WebCore::RenderBlock::layoutBlock(bool relayoutChildren=false) Line 587 C++ WebKit_debug.dll!WebCore::RenderBlock::layout() Line 492 + 0x14 bytes C++ WebKit_debug.dll!WebCore::RenderView::layout() Line 114 C++ WebKit_debug.dll!WebCore::FrameView::layout(bool allowSubtree=true) Line 465 + 0x12 bytes C++ WebKit_debug.dll!WebCore::Document::updateLayout() Line 1152 C++ WebKit_debug.dll!WebCore::RenderLayer::hitTest(const WebCore::HitTestRequest & request={...}, WebCore::HitTestResult & result={...}) Line 1639 C++ WebKit_debug.dll!WebCore::Document::prepareMouseEvent(const WebCore::HitTestRequest & request={...}, const WebCore::IntPoint & documentPoint={...}, const WebCore::PlatformMouseEvent & event={...}) Line 1848 C++ WebKit_debug.dll!WebCore::EventHandler::prepareMouseEvent(const WebCore::HitTestRequest & request={...}, const WebCore::PlatformMouseEvent & mev={...}) Line 1229 + 0x21 bytes C++ WebKit_debug.dll!WebCore::EventHandler::handleMouseMoveEvent(const WebCore::PlatformMouseEvent & mouseEvent={...}, WebCore::HitTestResult * hoveredNode=0x0012f664) Line 998 C++ WebKit_debug.dll!WebCore::EventHandler::mouseMoved(const WebCore::PlatformMouseEvent & event={...}) Line 950 + 0x10 bytes C++ WebKit_debug.dll!WebView::handleMouseEvent(unsigned int message=512, unsigned int wParam=0, long lParam=4849836) Line 1217 + 0x1d bytes C++ WebKit_debug.dll!WebViewWndProc(HWND__ * hWnd=0x00070406, unsigned int message=512, unsigned int wParam=0, long lParam=4849836) Line 1635 + 0x14 bytes C++ 68136 1 18646 aroben 2008-01-24 14:54:51 -0800 Created attachment 18646 testcase (will crash when loaded) 68137 2 aroben 2008-01-24 15:04:13 -0800 I have a patch for this. 68138 3 18647 aroben 2008-01-24 15:10:11 -0800 Created attachment 18647 patch with test and changelog 68139 4 18647 hyatt 2008-01-24 15:11:43 -0800 Comment on attachment 18647 patch with test and changelog r=me 68140 5 aroben 2008-01-24 15:14:46 -0800 Committed as r29780. 18646 2008-01-24 14:54:51 -0800 2008-01-24 14:54:51 -0800 testcase (will crash when loaded) font-face-empty.html text/html 282 aroben PHN0eWxlPgogICAgQGZvbnQtZmFjZSB7CiAgICAgICAgZm9udC1mYW1pbHk6IFRlc3RGb250Owog ICAgICAgIHNyYzogdXJsKGRhdGE6YXBwbGljYXRpb24veC10cnVldHlwZS1mb250LCkgZm9ybWF0 KHRydWV0eXBlKTsKICAgIH0KPC9zdHlsZT4KPHAgc3R5bGU9ImZvbnQtZmFtaWx5OiBUZXN0Rm9u dCI+YDEyMzQ1Njc4OTAtPXF3ZXJ0eXVpb3BbXVxhc2RmZ2hqa2w7J3p4Y3Zibm0sLi9+IUAjJCVe JmFtcDsqKClfK1FXRVJZVUlPUHt9fEFTREZHSEpLTDoiWlhDVkJOTSZsdDsmZ3Q7PzwvcD4K 18647 2008-01-24 15:10:11 -0800 2008-01-24 15:11:43 -0800 patch with test and changelog 0001-Fix-Bug-16996-Crash-in-createFontCustomPlatformData.patch text/plain 4927 aroben RnJvbSBmZjM5YmQ1ZTM4NzdiOTM3YmQ1OTM2ZDdjZjM3N2NkOWY5YjE2ODJlIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBBZGFtIFJvYmVuIDxhcm9iZW5AYXBwbGUuY29tPgpEYXRlOiBU aHUsIDI0IEphbiAyMDA4IDE4OjA5OjQxIC0wNTAwClN1YmplY3Q6IFtQRlJdIEZpeCBCdWcgMTY5 OTY6IENyYXNoIGluIGNyZWF0ZUZvbnRDdXN0b21QbGF0Zm9ybURhdGEgd2hlbiBsb2FkaW5nIDAt Ynl0ZSBmb250IHZpYSBAZm9udC1mYWNlCgpXZWJDb3JlOgoKICAgICAgICBGaXggQnVnIDE2OTk2 OiBDcmFzaCBpbiBjcmVhdGVGb250Q3VzdG9tUGxhdGZvcm1EYXRhIHdoZW4gbG9hZGluZwogICAg ICAgIDAtYnl0ZSBmb250IHZpYSBAZm9udC1mYWNlCgogICAgICAgIDxodHRwOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNjk5Nj4KCiAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZ IChPT1BTISkuCgogICAgICAgIFRlc3Q6IGZhc3QvbG9hZGVyL2ZvbnQtZmFjZS1lbXB0eS5odG1s CgogICAgICAgICogcGxhdGZvcm0vZ3JhcGhpY3Mvd2luL0ZvbnRDdXN0b21QbGF0Zm9ybURhdGEu Y3BwOgogICAgICAgIChXZWJDb3JlOjpjcmVhdGVGb250Q3VzdG9tUGxhdGZvcm1EYXRhKTogTnVs bC1jaGVjayB0aGUgYnVmZmVyCiAgICAgICAgcGFyYW1ldGVyLgoKTGF5b3V0VGVzdHM6CgogICAg ICAgIFRlc3QgZm9yIEJ1ZyAxNjk5NjogQ3Jhc2ggaW4gY3JlYXRlRm9udEN1c3RvbVBsYXRmb3Jt RGF0YSB3aGVuIGxvYWRpbmcKICAgICAgICAwLWJ5dGUgZm9udCB2aWEgQGZvbnQtZmFjZQoKICAg ICAgICA8aHR0cDovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTY5OTY+CgogICAg ICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgoKICAgICAgICAqIGZhc3QvbG9hZGVyL2Zv bnQtZmFjZS1lbXB0eS1leHBlY3RlZC50eHQ6IEFkZGVkLgogICAgICAgICogZmFzdC9sb2FkZXIv Zm9udC1mYWNlLWVtcHR5Lmh0bWw6IEFkZGVkLgotLS0KIExheW91dFRlc3RzL0NoYW5nZUxvZyAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAxMiArKysrKysrKysrKysKIC4uLi9mYXN0 L2xvYWRlci9mb250LWZhY2UtZW1wdHktZXhwZWN0ZWQudHh0ICAgICAgIHwgICAgMyArKysKIExh eW91dFRlc3RzL2Zhc3QvbG9hZGVyL2ZvbnQtZmFjZS1lbXB0eS5odG1sICAgICAgIHwgICAxMyAr KysrKysrKysrKysrCiBXZWJDb3JlL0NoYW5nZUxvZyAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAgMTUgKysrKysrKysrKysrKysrCiAuLi4vZ3JhcGhpY3Mvd2luL0ZvbnRDdXN0 b21QbGF0Zm9ybURhdGEuY3BwICAgICAgICB8ICAgIDMgKysrCiA1IGZpbGVzIGNoYW5nZWQsIDQ2 IGluc2VydGlvbnMoKyksIDAgZGVsZXRpb25zKC0pCiBjcmVhdGUgbW9kZSAxMDA2NDQgTGF5b3V0 VGVzdHMvZmFzdC9sb2FkZXIvZm9udC1mYWNlLWVtcHR5LWV4cGVjdGVkLnR4dAogY3JlYXRlIG1v ZGUgMTAwNjQ0IExheW91dFRlc3RzL2Zhc3QvbG9hZGVyL2ZvbnQtZmFjZS1lbXB0eS5odG1sCgpk aWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9n CmluZGV4IDk3NGNiYWEuLmI0NTczNzIgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL0NoYW5nZUxv ZworKysgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxNSBAQAorMjAwOC0wMS0y NCAgQWRhbSBSb2JlbiAgPGFyb2JlbkBhcHBsZS5jb20+CisKKyAgICAgICAgVGVzdCBmb3IgQnVn IDE2OTk2OiBDcmFzaCBpbiBjcmVhdGVGb250Q3VzdG9tUGxhdGZvcm1EYXRhIHdoZW4gbG9hZGlu ZworICAgICAgICAwLWJ5dGUgZm9udCB2aWEgQGZvbnQtZmFjZQorCisgICAgICAgIDxodHRwOi8v YnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNjk5Nj4KKworICAgICAgICBSZXZpZXdl ZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICAqIGZhc3QvbG9hZGVyL2ZvbnQtZmFjZS1l bXB0eS1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAqIGZhc3QvbG9hZGVyL2ZvbnQtZmFj ZS1lbXB0eS5odG1sOiBBZGRlZC4KKwogMjAwOC0wMS0xNSAgTWljaGFlbCBHb2RkYXJkICA8bWlj aGFlbC5nb2RkYXJkQHRyb2xsdGVjaC5jb20+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgRGFyaW4u CmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9mYXN0L2xvYWRlci9mb250LWZhY2UtZW1wdHktZXhw ZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvZmFzdC9sb2FkZXIvZm9udC1mYWNlLWVtcHR5LWV4cGVj dGVkLnR4dApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi5kNGZhYTBlCi0tLSAv ZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvZmFzdC9sb2FkZXIvZm9udC1mYWNlLWVtcHR5LWV4 cGVjdGVkLnR4dApAQCAtMCwwICsxLDMgQEAKK1RoaXMgaXMgYSB0ZXN0IGZvciBCdWcgMTY5OTY6 IENyYXNoIGluIGNyZWF0ZUZvbnRDdXN0b21QbGF0Zm9ybURhdGEgd2hlbiBsb2FkaW5nIDAtYnl0 ZSBmb250IHZpYSBAZm9udC1mYWNlLgorCitgMTIzNDU2Nzg5MC09cXdlcnR5dWlvcFtdXGFzZGZn aGprbDsnenhjdmJubSwuL34hQCMkJV4mKigpXytRV0VSWVVJT1B7fXxBU0RGR0hKS0w6IlpYQ1ZC Tk08Pj8KZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2Zhc3QvbG9hZGVyL2ZvbnQtZmFjZS1lbXB0 eS5odG1sIGIvTGF5b3V0VGVzdHMvZmFzdC9sb2FkZXIvZm9udC1mYWNlLWVtcHR5Lmh0bWwKbmV3 IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMC4uM2UxN2QyZgotLS0gL2Rldi9udWxsCisr KyBiL0xheW91dFRlc3RzL2Zhc3QvbG9hZGVyL2ZvbnQtZmFjZS1lbXB0eS5odG1sCkBAIC0wLDAg KzEsMTMgQEAKKzxzdHlsZT4KKyAgICBAZm9udC1mYWNlIHsKKyAgICAgICAgZm9udC1mYW1pbHk6 IFRlc3RGb250OworICAgICAgICBzcmM6IHVybChkYXRhOmFwcGxpY2F0aW9uL3gtdHJ1ZXR5cGUt Zm9udCwpIGZvcm1hdCh0cnVldHlwZSk7CisgICAgfQorPC9zdHlsZT4KKzxzY3JpcHQ+CisgICAg aWYgKHdpbmRvdy5sYXlvdXRUZXN0Q29udHJvbGxlcikKKyAgICAgICAgbGF5b3V0VGVzdENvbnRy b2xsZXIuZHVtcEFzVGV4dCgpOworPC9zY3JpcHQ+Cis8cD5UaGlzIGlzIGEgdGVzdCBmb3IgPGEg aHJlZj0iaHR0cDovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTY5OTYiPkJ1ZyAx Njk5NjogQ3Jhc2ggaW4KK2NyZWF0ZUZvbnRDdXN0b21QbGF0Zm9ybURhdGEgd2hlbiBsb2FkaW5n IDAtYnl0ZSBmb250IHZpYSBAZm9udC1mYWNlPC9hPi48L3A+Cis8cCBzdHlsZT0iZm9udC1mYW1p bHk6IFRlc3RGb250Ij5gMTIzNDU2Nzg5MC09cXdlcnR5dWlvcFtdXGFzZGZnaGprbDsnenhjdmJu bSwuL34hQCMkJV4mYW1wOyooKV8rUVdFUllVSU9Qe318QVNERkdISktMOiJaWENWQk5NJmx0OyZn dDs/PC9wPgpkaWZmIC0tZ2l0IGEvV2ViQ29yZS9DaGFuZ2VMb2cgYi9XZWJDb3JlL0NoYW5nZUxv ZwppbmRleCBjMGU3ZjFmLi5mN2Q0NjRkIDEwMDY0NAotLS0gYS9XZWJDb3JlL0NoYW5nZUxvZwor KysgYi9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE4IEBACisyMDA4LTAxLTI0ICBBZGFt IFJvYmVuICA8YXJvYmVuQGFwcGxlLmNvbT4KKworICAgICAgICBGaXggQnVnIDE2OTk2OiBDcmFz aCBpbiBjcmVhdGVGb250Q3VzdG9tUGxhdGZvcm1EYXRhIHdoZW4gbG9hZGluZworICAgICAgICAw LWJ5dGUgZm9udCB2aWEgQGZvbnQtZmFjZQorCisgICAgICAgIDxodHRwOi8vYnVncy53ZWJraXQu b3JnL3Nob3dfYnVnLmNnaT9pZD0xNjk5Nj4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkg KE9PUFMhKS4KKworICAgICAgICBUZXN0OiBmYXN0L2xvYWRlci9mb250LWZhY2UtZW1wdHkuaHRt bAorCisgICAgICAgICogcGxhdGZvcm0vZ3JhcGhpY3Mvd2luL0ZvbnRDdXN0b21QbGF0Zm9ybURh dGEuY3BwOgorICAgICAgICAoV2ViQ29yZTo6Y3JlYXRlRm9udEN1c3RvbVBsYXRmb3JtRGF0YSk6 IE51bGwtY2hlY2sgdGhlIGJ1ZmZlcgorICAgICAgICBwYXJhbWV0ZXIuCisKIDIwMDgtMDEtMjQg IEhvbGdlciBIYW5zIFBldGVyIEZyZXl0aGVyICA8aG9sZ2VyLmZyZXl0aGVyQHRyb2xsdGVjaC5j b20+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgU2ltb24uCmRpZmYgLS1naXQgYS9XZWJDb3JlL3Bs YXRmb3JtL2dyYXBoaWNzL3dpbi9Gb250Q3VzdG9tUGxhdGZvcm1EYXRhLmNwcCBiL1dlYkNvcmUv cGxhdGZvcm0vZ3JhcGhpY3Mvd2luL0ZvbnRDdXN0b21QbGF0Zm9ybURhdGEuY3BwCmluZGV4IGJk MTA3NzguLjc1MmZlZDQgMTAwNjQ0Ci0tLSBhL1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3Mvd2lu L0ZvbnRDdXN0b21QbGF0Zm9ybURhdGEuY3BwCisrKyBiL1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhp Y3Mvd2luL0ZvbnRDdXN0b21QbGF0Zm9ybURhdGEuY3BwCkBAIC02Miw2ICs2Miw5IEBAIHNpemVf dCBnZXRCeXRlc1dpdGhPZmZzZXQodm9pZCAqaW5mbywgdm9pZCogYnVmZmVyLCBzaXplX3Qgb2Zm c2V0LCBzaXplX3QgY291bnQpCiAKIEZvbnRDdXN0b21QbGF0Zm9ybURhdGEqIGNyZWF0ZUZvbnRD dXN0b21QbGF0Zm9ybURhdGEoU2hhcmVkQnVmZmVyKiBidWZmZXIpCiB7CisgICAgaWYgKCFidWZm ZXIpCisgICAgICAgIHJldHVybiAwOworCiAgICAgLy8gR2V0IENHIHRvIGNyZWF0ZSB0aGUgZm9u dC4KICAgICBDR0RhdGFQcm92aWRlckRpcmVjdEFjY2Vzc0NhbGxiYWNrcyBjYWxsYmFja3MgPSB7 ICZnZXREYXRhLCAmcmVsZWFzZURhdGEsICZnZXRCeXRlc1dpdGhPZmZzZXQsIE5VTEwgfTsKICAg ICBSZXRhaW5QdHI8Q0dEYXRhUHJvdmlkZXJSZWY+IGRhdGFQcm92aWRlcihBZG9wdENGLCBDR0Rh dGFQcm92aWRlckNyZWF0ZURpcmVjdEFjY2VzcyhidWZmZXIsIGJ1ZmZlci0+c2l6ZSgpLCAmY2Fs bGJhY2tzKSk7Ci0tIAoxLjUuNC5yYzMKCg==