Bug 7566 – REGRESSION: Reproducible crash in getWebCoreFont()

• Component: Layout and Rendering
• Status: RESOLVED FIXED

[Shawn Smith]

Random crashes while browsing.  No pattern found but crash reports all point to QFontMetricsPrivate::getWebCoreFont().  Crash log attached.

[Shawn Smith]

Created attachment 6818 [details]
Crash Log

[Eric Seidel (no email)]

Is this a new crash?  If so this should be a P1 and have the Regression keyword.  The crashlog shows you're running a nightly, which might indicate this is related to hyatt's recent Font rewrite.

[Shawn Smith]

This is a new crash with the latest nightly.  I suspect it has something to do with the font rewrite as it is crashing in that area of the code.  I still can't narrow it down to a specific web page with a good repro.  It is fairly random.  I have only seen it 3 times in normal nightly browsing.

Added Regression Keyword and set the Priority to P1.

[Alexander Romanovich]

I can repro this 100% by viewing the structure of a table in phpMyAdmin. Same crash as the original reporter. Hope that helps.

[Shawn Smith]

Found a good repro.

Go here:  http://www.regence.com/careers/

Click on "Search and Apply" button.  (Need to allow Pop-ups)

When pop-up window displays click on "Search Openings" button ... crash.

This is with this nightly:

WebKit
Sun Mar 5 11:59:00 GMT 2006

[Alexey Proskuryakov]

0    WebCore::FontRenderer::getWebCoreFont(WebCore::FontDescription const&) const + 40 (FontMac.mm:51)
1    WebCore::Font::getWebCoreFont() const + 68 (FontMac.mm:95)
2    QListBox::sizeForNumberOfLines(int) const + 960 (KWQListBox.mm:295)
3    WebCore::RenderSelect::layout() + 328 (render_form.cpp:798)
4    WebCore::RenderObject::layoutIfNeeded() + 76 (Font.h:458)
5    WebCore::RenderSelect::calcMinMaxWidth() + 192 (render_form.cpp:768)
6    WebCore::RenderObject::recalcMinMaxWidths() + 896 (render_object.cpp:2285)
7    WebCore::RenderObject::recalcMinMaxWidths() + 408 (render_object.cpp:2270)

[Alexey Proskuryakov]

*** Bug 7598 has been marked as a duplicate of this bug. ***

[Alexey Proskuryakov]

Created attachment 6870 [details]
random fix

The bug here is pretty obvious (a font is created without a renderer, then this null renderer is used), but my solution is kind of random - I don't really understand what Font::update() means.

[Alexey Proskuryakov]

*** Bug 7614 has been marked as a duplicate of this bug. ***

[Darin Adler]

Comment on attachment 6870 [details]
random fix

I think the correct fix is to add a call to update() to QListBox. On the other hand, I don't like the design here where you have to know when to call update(). Hyatt is the one who should review this and the one who should fix this too.

[Andrew Wellington]

*** Bug 7623 has been marked as a duplicate of this bug. ***

[Beth Dakin]

Created attachment 6899 [details]
Very reduced test case

Chris filed this in radar over the weekend also as <rdar://problem/4467128>. He attached this great reduced test case to the radar, so I thought I would put it here too.

[Beth Dakin]

Comment on attachment 6870 [details]
random fix

Darin and Hyatt discussed this on IRC and this is not the way Dave thinks the bug should be fixed. The callers should call update() instead. I am making a patch now...

[Beth Dakin]

Created attachment 6903 [details]
new patch

[Beth Dakin]

Comment on attachment 6903 [details]
new patch

Darin reviewed this, and I committed the fix.

[Daniel Peebles]

*** Bug 7757 has been marked as a duplicate of this bug. ***