Bug 591409 – crash in firefox

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 591409 - crash in firefox


Summary:	crash in firefox


Status:	RESOLVED FIXED

Product:	pango
Classification:	Platform
Component:	general
Version:	1.25.x
Hardware:	Other Linux

Importance:	Normal critical
Target Milestone:	---
Assigned To:	pango-maint
QA Contact:	pango-maint

URL:
Whiteboard:

Duplicates:	591574 (view as bug list)
Depends on:
Blocks:

Reported:	2009-08-11 06:09 UTC by Götz Waschk
Modified:	2009-08-12 15:53 UTC

See Also:
GNOME target:	---
GNOME version:	2.27/2.28

Description Götz Waschk 2009-08-11 06:09:43 UTC

This is on Mandriva Cooker with pango 1.25.1 and firefox 3.0.13:

# gdb firefox
GNU gdb 6.8-6mdv2009.1 (Mandriva Linux release 2009.1)
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i586-mandriva-linux-gnu"...
(no debugging symbols found)
(gdb) run "http://docs.sun.com/app/docs/doc/816-5168/fdwalk-3c?a=view"
Starting program: /usr/bin/firefox "http://docs.sun.com/app/docs/doc/816-5168/fdwalk-3c?a=view"
[Thread debugging using libthread_db enabled]
[New Thread 0xb7d9f8e0 (LWP 11290)]
[New Thread 0xb5196b70 (LWP 11301)]
[New Thread 0xb46e5b70 (LWP 11302)]
[New Thread 0xb39bcb70 (LWP 11305)]
[New Thread 0xb0d93b70 (LWP 11308)]
[Thread 0xb0d93b70 (LWP 11308) exited]
[New Thread 0xb0d93b70 (LWP 11309)]
[New Thread 0xb0556b70 (LWP 11310)]
[New Thread 0xafd55b70 (LWP 11311)]
[New Thread 0xaf554b70 (LWP 11312)]

Program received signal SIGSEGV, Segmentation fault.
hb_face_create_for_data (blob=0x9e4b6b0, index=0)
    at hb-open-file-private.hh:208
208	    switch (tag) {
Current language:  auto; currently c++
Missing debug package(s), you should install: firefox-debug-3.0.13-1mdv2010.0.i586
(gdb) bt

+ Trace 216874

#0 hb_face_create_for_data
at hb-open-file-private.hh line 208
#1 pango_ot_info_get
at pango-ot-info.c line 128
#2 basic_engine_shape
at basic-fc.c line 209
#3 _pango_engine_shape_shape
at pango-engine.c line 71
#4 pango_shape
at shape.c line 55
#5 ??
from /usr/lib/xulrunner-1.9/libxul.so
#6 ??
from /usr/lib/xulrunner-1.9/libxul.so
#7 gfxPangoFontGroup::CreateGlyphRunsItemizing
from /usr/lib/xulrunner-1.9/libxul.so
#8 gfxPangoFontGroup::InitTextRun
from /usr/lib/xulrunner-1.9/libxul.so
#9 gfxPangoFontGroup::MakeTextRun
from /usr/lib/xulrunner-1.9/libxul.so
#10 ??
from /usr/lib/xulrunner-1.9/libxul.so
#11 gfxTextRunWordCache::MakeTextRun
from /usr/lib/xulrunner-1.9/libxul.so
#12 ??
from /usr/lib/xulrunner-1.9/libxul.so
#13 ??
from /usr/lib/xulrunner-1.9/libxul.so
#14 ??
from /usr/lib/xulrunner-1.9/libxul.so
#15 ??
from /usr/lib/xulrunner-1.9/libxul.so
#16 ??
from /usr/lib/xulrunner-1.9/libxul.so
#17 ??
from /usr/lib/xulrunner-1.9/libxul.so
#18 ??
from /usr/lib/xulrunner-1.9/libxul.so
#19 ??
from /usr/lib/xulrunner-1.9/libxul.so
#20 ??
from /usr/lib/xulrunner-1.9/libxul.so
#21 ??
from /usr/lib/xulrunner-1.9/libxul.so
#22 ??
from /usr/lib/xulrunner-1.9/libxul.so
#23 ??
from /usr/lib/xulrunner-1.9/libxul.so
#24 ??
from /usr/lib/xulrunner-1.9/libxul.so
#25 ??
from /usr/lib/xulrunner-1.9/libxul.so
#26 ??
from /usr/lib/xulrunner-1.9/libxul.so
#27 ??
from /usr/lib/xulrunner-1.9/libxul.so
#28 ??
from /usr/lib/xulrunner-1.9/libxul.so
#29 ??
from /usr/lib/xulrunner-1.9/libxul.so
#30 ??
from /usr/lib/xulrunner-1.9/libxul.so
#31 ??
from /usr/lib/xulrunner-1.9/libxul.so
#32 ??
from /usr/lib/xulrunner-1.9/libxul.so
#33 ??
from /usr/lib/xulrunner-1.9/libxul.so
#34 ??
from /usr/lib/xulrunner-1.9/libxul.so
#35 ??
from /usr/lib/xulrunner-1.9/libxul.so

Comment 1 Götz Waschk 2009-08-11 11:05:38 UTC

Here is a complete backtrace:

(gdb) bt full

+ Trace 216877

#0 hb_face_create_for_data
at hb-open-file-private.hh line 208
#1 pango_ot_info_get
at pango-ot-info.c line 128
#2 basic_engine_shape
at basic-fc.c line 209
#3 _pango_engine_shape_shape
at pango-engine.c line 71
#4 pango_shape
at shape.c line 55
#5 ??
from /usr/lib/xulrunner-1.9/libxul.so
#6 ??
from /usr/lib/xulrunner-1.9/libxul.so
#7 gfxPangoFontGroup::CreateGlyphRunsItemizing
from /usr/lib/xulrunner-1.9/libxul.so
#8 gfxPangoFontGroup::InitTextRun
from /usr/lib/xulrunner-1.9/libxul.so
#9 gfxPangoFontGroup::MakeTextRun
from /usr/lib/xulrunner-1.9/libxul.so
#10 ??
from /usr/lib/xulrunner-1.9/libxul.so
#11 gfxTextRunWordCache::MakeTextRun
from /usr/lib/xulrunner-1.9/libxul.so
#12 ??
from /usr/lib/xulrunner-1.9/libxul.so
#13 ??
from /usr/lib/xulrunner-1.9/libxul.so
#14 ??
from /usr/lib/xulrunner-1.9/libxul.so
#15 ??
from /usr/lib/xulrunner-1.9/libxul.so
#16 ??
from /usr/lib/xulrunner-1.9/libxul.so
#17 ??
from /usr/lib/xulrunner-1.9/libxul.so
#18 ??
from /usr/lib/xulrunner-1.9/libxul.so
#19 ??
from /usr/lib/xulrunner-1.9/libxul.so
#20 ??
from /usr/lib/xulrunner-1.9/libxul.so
#21 ??
from /usr/lib/xulrunner-1.9/libxul.so
#22 ??
from /usr/lib/xulrunner-1.9/libxul.so
#23 ??
from /usr/lib/xulrunner-1.9/libxul.so
#24 ??
from /usr/lib/xulrunner-1.9/libxul.so
#25 ??
from /usr/lib/xulrunner-1.9/libxul.so
#26 ??
from /usr/lib/xulrunner-1.9/libxul.so
#27 ??
from /usr/lib/xulrunner-1.9/libxul.so
#28 ??
from /usr/lib/xulrunner-1.9/libxul.so
#29 ??
from /usr/lib/xulrunner-1.9/libxul.so
#30 ??
from /usr/lib/xulrunner-1.9/libxul.so
#31 ??
from /usr/lib/xulrunner-1.9/libxul.so
#32 ??
from /usr/lib/xulrunner-1.9/libxul.so
#33 ??
from /usr/lib/xulrunner-1.9/libxul.so
#34 ??
from /usr/lib/xulrunner-1.9/libxul.so
#35 ??
from /usr/lib/xulrunner-1.9/libxul.so
#36 ??
from /usr/lib/xulrunner-1.9/libxul.so
#37 ??
from /usr/lib/xulrunner-1.9/libxul.so
#38 ??
from /usr/lib/xulrunner-1.9/libxul.so
#39 ??
from /usr/lib/xulrunner-1.9/libxul.so
#40 ??
from /usr/lib/xulrunner-1.9/libxul.so
#41 ??
from /usr/lib/xulrunner-1.9/libxul.so
#42 ??
from /usr/lib/xulrunner-1.9/libxul.so
#43 ??
from /usr/lib/xulrunner-1.9/libxul.so
#44 ??
from /usr/lib/xulrunner-1.9/libxul.so
#45 ??
from /usr/lib/xulrunner-1.9/libxul.so
#46 ??
from /usr/lib/xulrunner-1.9/libxul.so
#47 ??
from /usr/lib/xulrunner-1.9/libxul.so
#48 ??
from /usr/lib/xulrunner-1.9/libxul.so
#49 ??
from /usr/lib/xulrunner-1.9/libxul.so
#50 ??
from /usr/lib/xulrunner-1.9/libxul.so
#51 ??
from /usr/lib/xulrunner-1.9/libxul.so
#52 ??
from /usr/lib/xulrunner-1.9/libxul.so
#53 ??
from /usr/lib/xulrunner-1.9/libxul.so
#54 ??
from /usr/lib/xulrunner-1.9/libxul.so
#55 ??
from /usr/lib/xulrunner-1.9/libxul.so
#56 ??
from /usr/lib/xulrunner-1.9/libxul.so
#57 ??
from /usr/lib/xulrunner-1.9/libxul.so
#58 ??
from /usr/lib/xulrunner-1.9/libxul.so
#59 ??
from /usr/lib/xulrunner-1.9/libxul.so
#60 ??
from /usr/lib/xulrunner-1.9/libxul.so
#61 ??
from /usr/lib/xulrunner-1.9/libxul.so
#62 ??
from /usr/lib/xulrunner-1.9/libxul.so
#63 ??
from /usr/lib/xulrunner-1.9/libxul.so
#64 ??
from /usr/lib/xulrunner-1.9/libxul.so
#65 ??
from /usr/lib/xulrunner-1.9/libxul.so
#66 ??
from /usr/lib/xulrunner-1.9/libxul.so
#67 ??
from /usr/lib/xulrunner-1.9/libxul.so
#68 ??
from /usr/lib/xulrunner-1.9/libxul.so
#69 ??
from /usr/lib/xulrunner-1.9/libxul.so
#70 ??
from /usr/lib/xulrunner-1.9/libxul.so
#71 XRE_main
from /usr/lib/xulrunner-1.9/libxul.so
#72 __gxx_personality_v0
at ../../../../libstdc++-v3/libsupc++/eh_personality.cc line 361
#73 __libc_start_main
at libc-start.c line 220
#74 __gxx_personality_v0
at ../../../../libstdc++-v3/libsupc++/eh_personality.cc line 361

Comment 2 Behdad Esfahbod 2009-08-11 13:50:19 UTC

Ok, bug happens when FreeType doesn't mmap() font.  I thought face->stream->base will be zero in that case, but apparently not.  We can branch on face->stream->read being non-null instead.

Fixing.

Thanks to fcrozat for IRC debug service.

Comment 3 Behdad Esfahbod 2009-08-11 13:52:34 UTC

Well, stream->base *is* NULL, it's just that stream->length is not zero.

Comment 4 Behdad Esfahbod 2009-08-11 14:12:03 UTC

commit 954319c6eb2eb3dc74a3e271ee5ae6f1ce12ee32
Author: Behdad Esfahbod <behdad@behdad.org>
Date:   Tue Aug 11 10:09:19 2009 -0400

    Bug 591409 – crash in firefox.  Handle non-mmapped FT_Face

Comment 5 Behdad Esfahbod 2009-08-12 15:53:25 UTC

*** Bug 591574 has been marked as a duplicate of this bug. ***