[Webkit-unassigned] [Bug 64364] New: crash in WebCore::FontFallbackList::determinePitch ()

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=64364

           Summary: crash in WebCore::FontFallbackList::determinePitch ()
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
        OS/Version: All
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: WebCore Misc.
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: marco at peereboom.us


WebCore/platform/graphics/FontFallbackList.cpp
void FontFallbackList::determinePitch(const Font* font) const

font can be NULL causing the following crash:
#0  0x00000002110c8d7b in WebCore::FontFallbackList::determinePitch () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#1  0x00000002111804be in WebCore::RenderBlock::findNextLineBreak () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#2  0x0000000211181c4c in WebCore::RenderBlock::layoutInlineChildren () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#3  0x0000000211170bf8 in WebCore::RenderBlock::layoutBlock () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#4  0x0000000211159fbd in WebCore::RenderBlock::layout () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#5  0x000000021116e552 in WebCore::RenderBlock::layoutBlockChild () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#6  0x00000002111701b8 in WebCore::RenderBlock::layoutBlockChildren () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#7  0x00000002111711d6 in WebCore::RenderBlock::layoutBlock () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#8  0x0000000211159fbd in WebCore::RenderBlock::layout () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#9  0x000000021116e552 in WebCore::RenderBlock::layoutBlockChild () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#10 0x00000002111701b8 in WebCore::RenderBlock::layoutBlockChildren () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#11 0x00000002111711d6 in WebCore::RenderBlock::layoutBlock () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#12 0x0000000211159fbd in WebCore::RenderBlock::layout () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#13 0x000000021116e552 in WebCore::RenderBlock::layoutBlockChild () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#14 0x00000002111701b8 in WebCore::RenderBlock::layoutBlockChildren () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#15 0x00000002111711d6 in WebCore::RenderBlock::layoutBlock () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#16 0x0000000211159fbd in WebCore::RenderBlock::layout () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#17 0x000000021116e552 in WebCore::RenderBlock::layoutBlockChild () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#18 0x00000002111701b8 in WebCore::RenderBlock::layoutBlockChildren () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#19 0x00000002111711d6 in WebCore::RenderBlock::layoutBlock () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#20 0x0000000211159fbd in WebCore::RenderBlock::layout () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#21 0x000000021116e552 in WebCore::RenderBlock::layoutBlockChild () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#22 0x00000002111701b8 in WebCore::RenderBlock::layoutBlockChildren () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#23 0x00000002111711d6 in WebCore::RenderBlock::layoutBlock () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#24 0x0000000211159fbd in WebCore::RenderBlock::layout () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#25 0x000000021116e552 in WebCore::RenderBlock::layoutBlockChild () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#26 0x00000002111701b8 in WebCore::RenderBlock::layoutBlockChildren () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#27 0x00000002111711d6 in WebCore::RenderBlock::layoutBlock () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#28 0x0000000211159fbd in WebCore::RenderBlock::layout () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#29 0x000000021116e552 in WebCore::RenderBlock::layoutBlockChild () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#30 0x00000002111701b8 in WebCore::RenderBlock::layoutBlockChildren () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#31 0x00000002111711d6 in WebCore::RenderBlock::layoutBlock () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#32 0x0000000211159fbd in WebCore::RenderBlock::layout () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#33 0x000000021116e552 in WebCore::RenderBlock::layoutBlockChild () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#34 0x00000002111701b8 in WebCore::RenderBlock::layoutBlockChildren () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#35 0x00000002111711d6 in WebCore::RenderBlock::layoutBlock () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#36 0x0000000211159fbd in WebCore::RenderBlock::layout () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#37 0x000000021116e552 in WebCore::RenderBlock::layoutBlockChild () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#38 0x00000002111701b8 in WebCore::RenderBlock::layoutBlockChildren () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#39 0x00000002111711d6 in WebCore::RenderBlock::layoutBlock () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#40 0x0000000211159fbd in WebCore::RenderBlock::layout () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#41 0x000000021116e552 in WebCore::RenderBlock::layoutBlockChild () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#42 0x00000002111701b8 in WebCore::RenderBlock::layoutBlockChildren () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#43 0x00000002111711d6 in WebCore::RenderBlock::layoutBlock () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#44 0x0000000211159fbd in WebCore::RenderBlock::layout () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#45 0x0000000211225d6f in WebCore::RenderView::layout () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#46 0x000000021108eeff in WebCore::FrameView::layout () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#47 0x000000021112420a in WebCore::ThreadTimers::sharedTimerFiredInternal () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#48 0x0000000210b04772 in WebCore::timeout_cb () from /usr/local/lib/libwebkitgtk-1.0.so.0.1
#49 0x00000002042e2b7b in g_source_get_time () from /usr/local/lib/libglib-2.0.so.2800.0
#50 0x00000002042e2173 in g_main_context_dispatch () from /usr/local/lib/libglib-2.0.so.2800.0
#51 0x00000002042e6152 in g_main_context_prepare () from /usr/local/lib/libglib-2.0.so.2800.0
#52 0x00000002042e6545 in g_main_loop_run () from /usr/local/lib/libglib-2.0.so.2800.0
#53 0x00000002122efa83 in gtk_main () from /usr/local/lib/libgtk-x11-2.0.so.2400.0
#54 0x0000000000417dc6 in main (argc=0, argv=0x7f7fffff2608) at /home/marco/xxxterm/xxxterm.c:8388

This seems to coincide with file descriptor starvation although I am not 100% sure of that.

Patch to follow.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.