Steps to reproduce:

1. Set gfx.e10s.font-list.shared to true.
2. Restart Firefox.
3. Download Font Loader.
4. Download Franklin Gothic Book Regular.ttf.
5. Open https://www.w3.org/TR/css-text-3/.
6. Open the Font Loader, Click on the Add Fonts button, Select the font file Franklin Gothic Book Regular.ttf then click Open.
7. Click on the Load button.

Actual results:

The tab crashed.
This also happens on startup.

Crash report: bp-a836c75e-d20f-4d68-bd78-ce16e0200218

Top 10 frames of crashing thread:

0 xul.dll mozilla::ipc::MessageChannel::CxxStackFrame::CxxStackFrame ipc/glue/MessageChannel.cpp:231
1 xul.dll mozilla::ipc::MessageChannel::Send ipc/glue/MessageChannel.cpp:1003
2 xul.dll mozilla::ipc::IProtocol::ChannelSend ipc/glue/ProtocolUtils.cpp:477
3 xul.dll mozilla::dom::PContentChild::SendSetCharacterMap ipc/ipdl/PContentChild.cpp:5847
4 xul.dll mozilla::fontlist::Face::SetCharacterMap gfx/thebes/SharedFontList.cpp:95
5 xul.dll gfxDWriteFontEntry::ReadCMAP gfx/thebes/gfxDWriteFontList.cpp:525
6 xul.dll gfxFontEntry::TestCharacterMap gfx/thebes/gfxFontEntry.cpp:164
7 xul.dll gfxFontGroup::GetFirstValidFont gfx/thebes/gfxTextRun.cpp:2100
8 xul.dll nsFontMetrics::XHeight gfx/src/nsFontMetrics.cpp:163
9 xul.dll Gecko_GetFontMetrics layout/style/GeckoBindings.cpp:1487

Regression range:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=22d3cd05bacfefefb8f53a89ab63166f7e775c9d&tochange=780285749c804b0b84c3607d362cd9905c286512

Regressed by: bug 1611617

Yeah, I just hit this locally too (during normal browsing, no special testcase/STR). The change in bug 1611617 made us potentially load character maps at times we didn't previously, and in particular it can happen during stylo traversal, where we're not allowed to do IPC.

I suspect this may have been possible previously, but the recent change made it much more likely. We need to make SetCharacterMap check whether it's on the main thread, and if not, post a runnable instead of trying to do the IPC directly.

Try build should appear at https://treeherder.mozilla.org/#/jobs?repo=try&revision=08c57d43c4a6f4428e8ce286ad4bdc942724b5b4.

https://hg.mozilla.org/mozilla-central/rev/eeef960d6919

Could not reproduce the crash in the first place using older versions of Firefox 73.0.1, 74.0b9 so I can't say this is verified. Blinky can you please check if 75.0b5 still crashes for you?
https://archive.mozilla.org/pub/firefox/candidates/75.0b5-candidates/build1/
Based on the crash stats there are no crashes recorded with this particular signature in Fx75 so this is a good indicator that this got fixed.

I can not reproduce the crash with 75.0b5.

(In reply to blinky from comment #8)

I can not reproduce the crash with 75.0b5.

Thanks very much. I'll mark this bug as verified based on the above comment.