Bug 228186 – [Win] Crash under FontCache::lastResortFallbackFont

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKit Misc.

[Per Arne Vollan]

Frame[00]  Triage Symbol: [WebKit!WebCore::FontCache::lastResortFallbackFont+0xec]
    Frame[01]  Triage Symbol: [WebKit!WebCore::FontCascadeFonts::realizeFallbackRangesAt+0x271]
    Frame[02]  Triage Symbol: [WebKit!WebCore::FontCascade::primaryFont+0x35]
    Frame[03]  Triage Symbol: [WebKit!WebCore::LayoutIntegration::canUseForFontAndText+0x44]
    Frame[04]  Triage Symbol: [WebKit!WebCore::LayoutIntegration::canUseForChild+0x559]
    Frame[05]  Triage Symbol: [WebKit!WebCore::LayoutIntegration::canUseForLineLayoutWithReason+0x3e3]
    Frame[06]  Triage Symbol: [WebKit!WebCore::LayoutIntegration::LineLayout::canUseFor+0x2c]
    Frame[07]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutInlineChildren+0x2e]
    Frame[08]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x3b6]
    Frame[09]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[0a]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChild+0x292]
    Frame[0b]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChildren+0x47a]
    Frame[0c]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x3c1]
    Frame[0d]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[0e]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChild+0x292]
    Frame[0f]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChildren+0x47a]
    Frame[10]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x3c1]
    Frame[11]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[12]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChild+0x292]
    Frame[13]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChildren+0x47a]
    Frame[14]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x3c1]
    Frame[15]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[16]  Triage Symbol: [WebKit!WebCore::RenderView::layout+0x2ed]
    Frame[17]  Triage Symbol: [WebKit!WebCore::FrameViewLayoutContext::layout+0x5bf]
    Frame[18]  Triage Symbol: [WebKit!WebCore::Document::implicitClose+0x32b]
    Frame[19]  Triage Symbol: [WebKit!WebCore::FrameLoader::checkCompleted+0x13f]
    Frame[1a]  Triage Symbol: [WebKit!WebCore::CachedResourceLoader::loadDone+0x80]
    Frame[1b]  Triage Symbol: [WebKit!WebCore::SubresourceLoader::notifyDone+0x55]
    Frame[1c]  Triage Symbol: [WebKit!WebCore::SubresourceLoader::didFinishLoading+0x286]
    Frame[1d]  Triage Symbol: [WebKit!<lambda_e7e2d454785dfeaf6199132ec807941c>::operator+0xec]
    Frame[1e]  Triage Symbol: [WTF!WTF::RunLoop::performWork+0x23f]
    Frame[1f]  Ignore Symbol: [WTF!WTF::RunLoop::RunLoopWndProc+0x5c]
    Frame[20]  Triage Symbol: [USER32!UserCallWinProcCheckWow+0x2bd]
    Frame[21]  Triage Symbol: [USER32!DispatchMessageWorker+0x1e2]
    Frame[22]  Triage Symbol: [DumpRenderTreeLib!runTest+0xaf8]
    Frame[23]  Triage Symbol: [DumpRenderTreeLib!main+0x5d3]
    Frame[24]  Triage Symbol: [DumpRenderTree!main+0x880]
    Frame[25]  Triage Symbol: [DumpRenderTree!__scrt_common_main_seh+0x10c]
    Frame[26]  Triage Symbol: [KERNEL32!BaseThreadInitThunk+0x14]
    Frame[27]  Triage Symbol: [ntdll!RtlUserThreadStart+0x21]

[Per Arne Vollan]

Created attachment 434015 [details]
Patch

[Radar WebKit Bug Importer]

<rdar://problem/81275954>

[Per Arne Vollan]

Created attachment 434630 [details]
Patch

[Per Arne Vollan]

Created attachment 434766 [details]
Patch

[Per Arne Vollan]

Created attachment 434902 [details]
Patch

[Brent Fulgham]

Comment on attachment 434902 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=434902&action=review

> Source/WebKitLegacy/win/WebView.cpp:1327
> +    if (hdc) {

I wonder if we should just have an early return if hdc is blank? But this is fine as-is.

[Per Arne Vollan]

Created attachment 435874 [details]
Patch

[Ryan Haddad]

(In reply to Per Arne Vollan from comment #7)
> Created attachment 435874 [details]
> Patch
Though it ultimately passed on retry, it looks like the Win EWS run had a flaky crash, is this related to the patch?

https://ews-build.s3-us-west-2.amazonaws.com/Windows-EWS/r435874-101940-rerun/fast/forms/input-placeholder-paint-order-crash-log.txt

[Per Arne Vollan]

Created attachment 436006 [details]
Patch

[Per Arne Vollan]

(In reply to Ryan Haddad from comment #8)
> (In reply to Per Arne Vollan from comment #7)
> > Created attachment 435874 [details]
> > Patch
> Though it ultimately passed on retry, it looks like the Win EWS run had a
> flaky crash, is this related to the patch?
> 
> https://ews-build.s3-us-west-2.amazonaws.com/Windows-EWS/r435874-101940-
> rerun/fast/forms/input-placeholder-paint-order-crash-log.txt

I think this should be resolved in the latest WIP patch.

Thanks for reviewing!

[Per Arne Vollan]

Comment on attachment 436006 [details]
Patch

Thanks for reviewing!

[EWS]

Committed r281380 (240795@main): <https://commits.webkit.org/240795@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 436006 [details].