1 files changed, 36 insertions, 40 deletions

diff --git a/gfx/thebes/gfxPlatformFontList.cpp b/gfx/thebes/gfxPlatformFontList.cpp
index 1131ecb513..282fb36195 100644
--- a/gfx/thebes/gfxPlatformFontList.cpp
+++ b/gfx/thebes/gfxPlatformFontList.cpp
@@ -3014,7 +3014,8 @@ void gfxPlatformFontList::InitializeFamily(uint32_t aGeneration,
 }
 
 void gfxPlatformFontList::SetCharacterMap(uint32_t aGeneration,
-                                          const fontlist::Pointer& aFacePtr,
+                                          uint32_t aFamilyIndex, bool aAlias,
+                                          uint32_t aFaceIndex,
                                           const gfxSparseBitSet& aMap) {
   MOZ_ASSERT(XRE_IsParentProcess());
   auto list = SharedFontList();
@@ -3028,14 +3029,35 @@ void gfxPlatformFontList::SetCharacterMap(uint32_t aGeneration,
   if (AppShutdown::IsInOrBeyond(ShutdownPhase::AppShutdownConfirmed)) {
     return;
   }
-  auto* face = aFacePtr.ToPtr<fontlist::Face>(list);
-  if (face) {
+
+  const fontlist::Family* family;
+  if (aAlias) {
+    if (aFamilyIndex >= list->NumAliases()) {
+      MOZ_ASSERT(false, "AliasFamily index out of range");
+      return;
+    }
+    family = list->AliasFamilies() + aFamilyIndex;
+  } else {
+    if (aFamilyIndex >= list->NumFamilies()) {
+      MOZ_ASSERT(false, "Family index out of range");
+      return;
+    }
+    family = list->Families() + aFamilyIndex;
+  }
+
+  if (aFaceIndex >= family->NumFaces()) {
+    MOZ_ASSERT(false, "Face index out of range");
+    return;
+  }
+
+  if (auto* face =
+          family->Faces(list)[aFaceIndex].ToPtr<fontlist::Face>(list)) {
     face->mCharacterMap = GetShmemCharMap(&aMap);
   }
 }
 
-void gfxPlatformFontList::SetupFamilyCharMap(
-    uint32_t aGeneration, const fontlist::Pointer& aFamilyPtr) {
+void gfxPlatformFontList::SetupFamilyCharMap(uint32_t aGeneration,
+                                             uint32_t aIndex, bool aAlias) {
   MOZ_ASSERT(XRE_IsParentProcess());
   auto list = SharedFontList();
   MOZ_ASSERT(list);
@@ -3049,46 +3071,20 @@ void gfxPlatformFontList::SetupFamilyCharMap(
     return;
   }
 
-  // aFamilyPtr was passed from a content process which may not be trusted,
-  // so we cannot assume it is valid or safe to use. If the Pointer value is
-  // bad, we must not crash or do anything bad, just bail out.
-  // (In general, if the child process was trying to use an invalid pointer it
-  // should have hit the MOZ_DIAGNOSTIC_ASSERT in FontList::ToSharedPointer
-  // rather than passing a null or bad pointer to the parent.)
-
-  auto* family = aFamilyPtr.ToPtr<fontlist::Family>(list);
-  if (!family) {
-    // Unable to resolve to a native pointer (or it was null).
-    NS_WARNING("unexpected null Family pointer");
-    return;
-  }
-
-  // Validate the pointer before trying to use it: check that it points to a
-  // correctly-aligned offset within the Families() or AliasFamilies() array.
-  // We just assert (in debug builds only) on failure, and return safely.
-  // A misaligned pointer here would indicate a buggy (or compromised) child
-  // process, but crashing the parent would be unnecessary and does not yield
-  // any useful insight.
-  if (family >= list->Families() &&
-      family < list->Families() + list->NumFamilies()) {
-    size_t offset = (char*)family - (char*)list->Families();
-    if (offset % sizeof(fontlist::Family) != 0) {
-      MOZ_ASSERT(false, "misaligned Family pointer");
+  if (aAlias) {
+    if (aIndex >= list->NumAliases()) {
+      MOZ_ASSERT(false, "AliasFamily index out of range");
       return;
     }
-  } else if (family >= list->AliasFamilies() &&
-             family < list->AliasFamilies() + list->NumAliases()) {
-    size_t offset = (char*)family - (char*)list->AliasFamilies();
-    if (offset % sizeof(fontlist::Family) != 0) {
-      MOZ_ASSERT(false, "misaligned Family pointer");
-      return;
-    }
-  } else {
-    MOZ_ASSERT(false, "not a valid Family or AliasFamily pointer");
+    list->AliasFamilies()[aIndex].SetupFamilyCharMap(list);
     return;
   }
 
-  family->SetupFamilyCharMap(list);
+  if (aIndex >= list->NumFamilies()) {
+    MOZ_ASSERT(false, "Family index out of range");
+    return;
+  }
+  list->Families()[aIndex].SetupFamilyCharMap(list);
 }
 
 bool gfxPlatformFontList::InitOtherFamilyNames(uint32_t aGeneration,