GNOME Bugzilla – Bug 679654
crash for pango context list_families when going via Gtk
Last modified: 2012-07-20 21:54:07 UTC
Open a python terminal, and type >>> from gi.repository import Gtk >>> Gtk.TextView().get_pango_context().list_families() >>> Gtk.TextView().get_pango_context().list_families() Segmentation fault (core dumped) For me; second request always segphaults. I need the font families for the textview to show in the toolbar as options
aye, I can reproduce on a fairly standard Fedora 17 machine.
Stacktrace collected by abrt, but too big for this bugzilla. Downstream bugreport here: https://bugzilla.redhat.com/show_bug.cgi?id=838719 Core was generated by `/usr/bin/python /usr/bin/ipython'. Program terminated with signal 11, Segmentation fault.
+ Trace 230493
Thread 1 (Thread 0x7fcad57a7740 (LWP 3161))
From To Syms Read Shared Object Library 0x000000314bc3efd0 0x000000314bd1e570 Yes /lib64/libpython2.7.so.1.0 0x0000003127605790 0x0000003127610494 Yes /lib64/libpthread.so.0 0x0000003127e00ea0 0x0000003127e019e0 Yes /lib64/libdl.so.2 0x0000003138e00ee0 0x0000003138e01814 Yes /lib64/libutil.so.1 0x0000003127a055f0 0x0000003127a6cabc Yes /lib64/libm.so.6 0x000000312721ef60 0x000000312735fa40 Yes /lib64/libc.so.6 0x0000003126a00b20 0x0000003126a1a359 Yes /lib64/ld-linux-x86-64.so.2 0x00007fcacf0c0370 0x00007fcacf0c28dc Yes /usr/lib64/python2.7/lib-dynload/_collectionsmodule.so 0x00007fcaceeb8040 0x00007fcaceeb9ae4 Yes /usr/lib64/python2.7/lib-dynload/operator.so 0x00007fcaceca7ee0 0x00007fcacecac958 Yes /usr/lib64/python2.7/lib-dynload/itertoolsmodule.so 0x00007fcaceaa2c60 0x00007fcaceaa32a4 Yes /usr/lib64/python2.7/lib-dynload/_bisectmodule.so 0x00007fcace89dd60 0x00007fcace89ed34 Yes /usr/lib64/python2.7/lib-dynload/_heapq.so 0x00007fcace697720 0x00007fcace699de4 Yes /usr/lib64/python2.7/lib-dynload/stropmodule.so 0x00007fcace4930e0 0x00007fcace493b4c Yes /usr/lib64/python2.7/lib-dynload/_functoolsmodule.so 0x00007fcace28eb10 0x00007fcace28fec4 Yes /usr/lib64/python2.7/lib-dynload/_localemodule.so 0x00007fcace0867d0 0x00007fcace088f10 Yes /usr/lib64/python2.7/lib-dynload/_struct.so 0x00007fcacde7d4a0 0x00007fcacde806c4 Yes /usr/lib64/python2.7/lib-dynload/math.so 0x00007fcacdc76190 0x00007fcacdc780cc Yes /usr/lib64/python2.7/lib-dynload/binascii.so 0x00007fcacda728a0 0x00007fcacda73468 Yes /usr/lib64/python2.7/lib-dynload/_hashlib.so 0x0000003131614780 0x0000003131646c94 Yes /lib64/libssl.so.10 0x000000313025ca00 0x0000003130324528 Yes /lib64/libcrypto.so.10 0x0000003130a0ad60 0x0000003130a38424 Yes /lib64/libgssapi_krb5.so.2 0x000000313121b640 0x0000003131293340 Yes /lib64/libkrb5.so.3 0x000000312f201520 0x000000312f202114 Yes /lib64/libcom_err.so.2 0x000000312fe04490 0x000000312fe1c92c Yes /lib64/libk5crypto.so.3 0x0000003128601f50 0x000000312860e648 Yes /lib64/libz.so.1 0x0000003130602a60 0x0000003130607eac Yes /lib64/libkrb5support.so.0 0x000000312fa01120 0x000000312fa01ac4 Yes /lib64/libkeyutils.so.1 0x00000031292039b0 0x0000003129211dfc Yes /lib64/libresolv.so.2 0x0000003128a029d0 0x0000003128a12148 Yes /lib64/libgcc_s.so.1 0x0000003128e05fc0 0x0000003128e16768 Yes /lib64/libselinux.so.1 0x00007fcacd86e260 0x00007fcacd86eea8 Yes /usr/lib64/python2.7/lib-dynload/_randommodule.so 0x00007fcacd668ba0 0x00007fcacd66995c Yes /usr/lib64/python2.7/lib-dynload/cStringIO.so 0x00007fcacd463e20 0x00007fcacd464b34 Yes /usr/lib64/python2.7/lib-dynload/fcntlmodule.so 0x00007fcacd25eab0 0x00007fcacd25fb28 Yes /usr/lib64/python2.7/lib-dynload/timemodule.so 0x00007fcacd057cb0 0x00007fcacd059588 Yes /usr/lib64/python2.7/lib-dynload/selectmodule.so 0x00007fcaccd93040 0x00007fcaccd93720 Yes /usr/lib64/python2.7/lib-dynload/resource.so 0x00007fcaccb8e5f0 0x00007fcaccb8eed4 Yes /usr/lib64/python2.7/lib-dynload/termios.so 0x00007fcacc989d80 0x00007fcacc98a238 Yes /usr/lib64/python2.7/lib-dynload/grpmodule.so 0x00007fcacc7789d0 0x00007fcacc7811a8 Yes /usr/lib64/python2.7/lib-dynload/datetime.so 0x00007fcacc557a90 0x00007fcacc5665c0 Yes /usr/lib64/python2.7/lib-dynload/_io.so 0x00007fcacc342620 0x00007fcacc34a328 Yes /usr/lib64/python2.7/lib-dynload/_curses.so 0x0000003134608670 0x0000003134629a88 Yes /lib64/libncursesw.so.5 0x000000313a20cd90 0x000000313a218c48 Yes /lib64/libtinfo.so.5 0x00007fcacc130df0 0x00007fcacc137744 Yes /usr/lib64/python2.7/lib-dynload/_sqlite3.so 0x000000313c60a2e0 0x000000313c686860 Yes /lib64/libsqlite3.so.0 0x00007fcacbf13190 0x00007fcacbf20538 Yes /usr/lib64/python2.7/lib-dynload/_ctypes.so 0x000000312ae01950 0x000000312ae060ec Yes /lib64/libffi.so.5 0x00007fcacbcff220 0x00007fcacbd04858 Yes /usr/lib64/python2.7/lib-dynload/_socketmodule.so 0x00007fcacbaf72a0 0x00007fcacbaf9f40 Yes /usr/lib64/python2.7/lib-dynload/_ssl.so 0x00007fcacb8ecba0 0x00007fcacb8f03c4 Yes /usr/lib64/python2.7/lib-dynload/arraymodule.so 0x00007fcacb6e54d0 0x00007fcacb6e6f60 Yes /usr/lib64/python2.7/lib-dynload/zlibmodule.so No /usr/lib64/python2.7/site-packages/_xmlplus/parsers/pyexpat.so 0x000000312b603dd0 0x000000312b61cccc Yes /lib64/libexpat.so.1 0x00007fcacb2d3690 0x00007fcacb2d4780 Yes /usr/lib64/python2.7/lib-dynload/_lsprof.so 0x00007fcacb0c2a00 0x00007fcacb0cd38c Yes /usr/lib64/python2.7/lib-dynload/cPickle.so 0x00007fcaca6b9760 0x00007fcaca6ba8f4 Yes /usr/lib64/python2.7/lib-dynload/readline.so 0x0000003136214f20 0x0000003136233848 Yes /lib64/libreadline.so.6 0x00007fcaca49c6c0 0x00007fcaca4acfe8 Yes /usr/lib64/python2.7/site-packages/gi/_gi.so 0x000000313be07b50 0x000000313be248ec Yes /usr/lib64/libgirepository-1.0.so.1 0x000000312aa0a910 0x000000312aa37dcc Yes /usr/lib64/libgobject-2.0.so.0 0x000000312ce010f0 0x000000312ce01fd8 Yes /usr/lib64/libgmodule-2.0.so.0 0x0000003129600680 0x00000031296007fc Yes /usr/lib64/libgthread-2.0.so.0 0x0000003128202260 0x000000312820554c Yes /usr/lib64/librt.so.1 0x0000003126e19b70 0x0000003126eac70c Yes /usr/lib64/libglib-2.0.so.0 0x00007fcaca290ac0 0x00007fcaca291938 Yes /usr/lib64/libpyglib-gi-2.0-python.so.0 0x000000312ea2eee0 0x000000312eaea8a4 Yes /usr/lib64/libgio-2.0.so.0 0x00007fcaca0825f0 0x00007fcaca087da0 Yes /usr/lib64/python2.7/site-packages/gi/_glib/_glib.so 0x00007fcac9e60d80 0x00007fcac9e70ddc Yes /usr/lib64/python2.7/site-packages/gi/_gobject/_gobject.so 0x000000313826e2a0 0x00000031384ff650 Yes /usr/lib64/libgtk-3.so.0 0x0000003137e1a080 0x0000003137e5b924 Yes /lib64/libgdk-3.so.0 0x0000003133e04910 0x0000003133e09358 Yes /lib64/libpangocairo-1.0.so.0 0x000000312a21dea0 0x000000312a2a4260 Yes /lib64/libX11.so.6 0x000000312de02130 0x000000312de0bfb4 Yes /lib64/libXi.so.6 0x000000312e2014f0 0x000000312e203cf8 Yes /lib64/libXfixes.so.3 0x0000003133a09b30 0x0000003133a15c04 Yes /lib64/libatk-1.0.so.0 0x00007fcac9b043c0 0x00007fcac9b05374 Yes /lib64/libcairo-gobject.so.2 0x000000313360b2f0 0x000000313368215c Yes /lib64/libcairo.so.2 0x0000003132606750 0x0000003132619b50 Yes /lib64/libgdk_pixbuf-2.0.so.0 0x0000003132e07600 0x0000003132e21bfc Yes /lib64/libpangoft2-1.0.so.0 0x0000003132a0eeb0 0x0000003132a2d490 Yes /lib64/libpango-1.0.so.0 0x000000312c605ef0 0x000000312c61f6ec Yes /lib64/libfontconfig.so.1 0x000000312b203700 0x000000312b20d7d0 Yes /lib64/libXext.so.6 0x000000312da00b00 0x000000312da01438 Yes /lib64/libXinerama.so.1 0x000000312d601830 0x000000312d605f34 Yes /lib64/libXrandr.so.2 0x000000312e602a80 0x000000312e6076dc Yes /lib64/libXcursor.so.1 0x0000003134200c30 0x0000003134201774 Yes /lib64/libXcomposite.so.1 0x0000003132200b90 0x000000313220159c Yes /lib64/libXdamage.so.1 0x000000312be0cbc0 0x000000312be77250 Yes /lib64/libfreetype.so.6 0x000000312a6099c0 0x000000312a615878 Yes /lib64/libxcb.so.1 0x0000003133208d80 0x0000003133272eec Yes /usr/lib64/libpixman-1.so.0 0x000000312ba04fa0 0x000000312ba20ae0 Yes /usr/lib64/libpng15.so.15 0x000000312ca01a70 0x000000312ca079e0 Yes /usr/lib64/libXrender.so.1 0x0000003129e00e80 0x0000003129e01bb0 Yes /lib64/libXau.so.6 0x00007fcac98c31b0 0x00007fcac98ca67c Yes /lib64/libnss_files.so.2 0x00007fcac9643930 0x00007fcac965af98 Yes /usr/lib64/gio/modules/libgvfsdbus.so 0x0000003129a09310 0x0000003129a12c9c Yes /lib64/libgvfscommon.so.0 0x00007fcac9410f20 0x00007fcac94300cc Yes /lib64/libbluray.so.1 0x000000312c207760 0x000000312c2302b4 Yes /lib64/libdbus-1.so.3 0x000000312ee2cbc0 0x000000312ef0da74 Yes /lib64/libxml2.so.2 0x00007fcac9208700 0x00007fcac920a714 Yes /usr/lib64/gtk-3.0/3.0.0/theming-engines/libadwaita.so 0x000000313e207950 0x000000313e22b9e8 Yes /lib64/librsvg-2.so.2 0x0000003137208ce0 0x0000003137227428 Yes /lib64/libcroco-0.6.so.3 0x00007fcac9003020 0x00007fcac9005060 Yes /usr/lib64/gtk-3.0/modules/libcanberra-gtk-module.so 0x000000313f801cb0 0x000000313f803160 Yes /lib64/libcanberra-gtk3.so.0 0x0000003146c033c0 0x0000003146c0c31c Yes /lib64/libcanberra.so.0 0x0000003141c020b0 0x0000003141c0614c Yes /lib64/libvorbisfile.so.3 0x000000313a603810 0x000000313a61ad6c Yes /lib64/libvorbis.so.0 0x000000313ae01a70 0x000000313ae04138 Yes /lib64/libogg.so.0 0x0000003143c02880 0x0000003143c0c010 Yes /lib64/libtdb.so.1 0x000000313ce02400 0x000000313ce065d4 Yes /lib64/libltdl.so.7 0x0000003134e00dc0 0x0000003134e05cac Yes /lib64/libcrypt.so.1 0x0000003135203520 0x0000003135242538 Yes /lib64/libfreebl3.so $1 = 0x0 $2 = 0x0 rax 0x0 0 rbx 0x2fcee10 50130448 rcx 0x0 0 rdx 0x326f5c0 52884928 rsi 0x2fcee10 50130448 rdi 0x2fcee10 50130448 rbp 0x32c9400 0x32c9400 rsp 0x7fffc6a93dc0 0x7fffc6a93dc0 r8 0x3271500 52892928 r9 0x7fcac9e72a7f 140508947491455 r10 0x314bcd2500 211725133056 r11 0x0 0 r12 0x3271340 52892480 r13 0x2a6b769 44480361 r14 0x2fcee10 50130448 r15 0x1 1 rip 0x7fcac9e67d33 0x7fcac9e67d33 <pygobject_repr+51> eflags 0x10206 [ PF IF RF ] cs 0x33 51 ss 0x2b 43 ds 0x0 0 es 0x0 0 fs 0x0 0 gs 0x0 0 Dump of assembler code for function pygobject_repr: 0x00007fcac9e67d00 <+0>: push %rbp 0x00007fcac9e67d01 <+1>: lea 0xad77(%rip),%r9 # 0x7fcac9e72a7f 0x00007fcac9e67d08 <+8>: push %rbx 0x00007fcac9e67d09 <+9>: mov %rdi,%rbx 0x00007fcac9e67d0c <+12>: sub $0x128,%rsp 0x00007fcac9e67d13 <+19>: mov 0x10(%rdi),%rbp 0x00007fcac9e67d17 <+23>: mov %fs:0x28,%rax 0x00007fcac9e67d20 <+32>: mov %rax,0x118(%rsp) 0x00007fcac9e67d28 <+40>: xor %eax,%eax 0x00007fcac9e67d2a <+42>: test %rbp,%rbp 0x00007fcac9e67d2d <+45>: je 0x7fcac9e67d3e <pygobject_repr+62> 0x00007fcac9e67d2f <+47>: mov 0x0(%rbp),%rax => 0x00007fcac9e67d33 <+51>: mov (%rax),%rdi 0x00007fcac9e67d36 <+54>: callq 0x7fcac9e5fef0 <g_type_name@plt> 0x00007fcac9e67d3b <+59>: mov %rax,%r9 0x00007fcac9e67d3e <+62>: mov 0x8(%rbx),%rax 0x00007fcac9e67d42 <+66>: lea 0xa727(%rip),%rdx # 0x7fcac9e72470 0x00007fcac9e67d49 <+73>: lea 0x10(%rsp),%rdi 0x00007fcac9e67d4e <+78>: mov %rbx,%r8 0x00007fcac9e67d51 <+81>: mov $0x100,%esi 0x00007fcac9e67d56 <+86>: mov 0x18(%rax),%rcx 0x00007fcac9e67d5a <+90>: xor %eax,%eax 0x00007fcac9e67d5c <+92>: mov %rbp,(%rsp) 0x00007fcac9e67d60 <+96>: callq 0x7fcac9e60b80 <g_snprintf@plt> 0x00007fcac9e67d65 <+101>: lea 0x10(%rsp),%rdi 0x00007fcac9e67d6a <+106>: callq 0x7fcac9e603d0 <PyString_FromString@plt> 0x00007fcac9e67d6f <+111>: mov 0x118(%rsp),%rdx 0x00007fcac9e67d77 <+119>: xor %fs:0x28,%rdx 0x00007fcac9e67d80 <+128>: jne 0x7fcac9e67d8c <pygobject_repr+140> 0x00007fcac9e67d82 <+130>: add $0x128,%rsp 0x00007fcac9e67d89 <+137>: pop %rbx 0x00007fcac9e67d8a <+138>: pop %rbp 0x00007fcac9e67d8b <+139>: retq 0x00007fcac9e67d8c <+140>: callq 0x7fcac9e5ff00 <__stack_chk_fail@plt> End of assembler dump.
*** This bug has been marked as a duplicate of bug 675332 ***
No, this is a different problem, as explained in my analysis at https://bugzilla.gnome.org/show_bug.cgi?id=675332#c8 Here is a minimal demonstration of this bug: >>> from gi.repository import Gtk >>> def families(): ... m = Gtk.TextView() ... fl = [f.get_name() for f in m.get_pango_context().list_families()] ... return fl ... >>> f = families() >>> g = families() /usr/lib/python2.7/dist-packages/gi/types.py:43: Warning: g_object_get_qdata: assertion `G_IS_OBJECT (object)' failed return info.invoke(*args, **kwargs) /usr/lib/python2.7/dist-packages/gi/types.py:43: Warning: g_ascii_strncasecmp: assertion `s2 != NULL' failed return info.invoke(*args, **kwargs) Segmentation fault Underlying the crash is that pango creates a list of families once and stores it in a static variable or in a class variable depending upon the implementation. Once pygobject frees the family structs on that list (which it does after the first call to list_families(), as explained in #675332), then any other pango user (it need not be a TextView) that tries to access the list will segfault. pango_context.font_description is created separately and doesn't have anything to do with the font list.
As I suggested in #675332, adding "transfer container" annotations to pango_context_list_families and pango_font_map_list_families corrects the problem. Pushed to pango master as 0686aea