Bug 684959 – crash after "Add pango_shape_full()"

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 684959 - crash after "Add pango_shape_full()"


Summary:	crash after "Add pango_shape_full()"


Status:	RESOLVED FIXED

Product:	pango
Classification:	Platform
Component:	general
Version:	1.32.x
Hardware:	Other OpenBSD

Importance:	Normal critical
Target Milestone:	---
Assigned To:	pango-maint
QA Contact:	pango-maint

URL:
Whiteboard:

Duplicates:	684960 684987 684999 (view as bug list)
Depends on:
Blocks:

Reported:	2012-09-27 14:15 UTC by Jasper Lievisse Adriaanse
Modified:	2012-09-27 21:22 UTC

See Also:
GNOME target:	---
GNOME version:	---

Description Jasper Lievisse Adriaanse 2012-09-27 14:15:57 UTC

With pango 1.32.0 I'm seeing crashes in for example gedit (both 3.4.x and 3.6.x) on OpenBSD/amd64. I have no locales set, and when I locally revert this commit:
http://git.gnome.org/browse/pango/commit/?id=bbec7e8697907a922f80c00b94f54b9b8634d264
the issue goes away. My stack is fully up to date wrt gtk/glib/harfbuzz/etc.

axon:pango {1753} gdb /usr/local/bin/gedit

GNU gdb 6.3
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "amd64-unknown-openbsd5.2"...
(gdb) run
Starting program: /usr/local/bin/gedit 
[New process 24098]

(gedit:24098): Pango-CRITICAL **: pango_glyph_item_split: assertion `split_index < orig->item->length' failed

Program received signal SIGSEGV, Segmentation fault.
0x00001c48e0817c97 in append_attrs (glyph_item=0x0, attrs=0x1c48d6c4d770) at pango-glyph-item.c:499
499	  glyph_item->item->analysis.extra_attrs =
(gdb) bt

+ Trace 230921

#0 append_attrs
at pango-glyph-item.c line 499
#1 split_before_cluster_start
at pango-glyph-item.c line 528
#2 pango_glyph_item_apply_attrs
at pango-glyph-item.c line 633
#3 apply_no_shape_attributes
at pango-layout.c line 3779
#4 pango_layout_check_lines
at pango-layout.c line 3945
#5 pango_layout_get_extents_internal
at pango-layout.c line 2491
#6 pango_layout_get_extents
at pango-layout.c line 2673
#7 gtk_label_get_preferred_layout_size
at gtklabel.c line 3570
#8 gtk_label_get_preferred_size
at gtklabel.c line 3613
#9 gtk_label_get_preferred_width
at gtklabel.c line 3721
#10 compute_size_for_orientation
at gtksizerequest.c line 359
#11 gtk_widget_get_preferred_width
at gtksizerequest.c line 552
#12 gtk_box_get_size
at gtkbox.c line 1042
#13 gtk_box_get_preferred_width
at gtkbox.c line 1100
#14 compute_size_for_orientation
at gtksizerequest.c line 359
#15 gtk_widget_get_preferred_width
at gtksizerequest.c line 552
#16 gtk_box_get_size
at gtkbox.c line 1042
#17 gtk_box_get_preferred_width
at gtkbox.c line 1100
#18 compute_size_for_orientation
at gtksizerequest.c line 359
#19 gtk_widget_get_preferred_width
at gtksizerequest.c line 552
#20 gtk_window_get_preferred_width
at gtkwindow.c line 6513
#21 compute_size_for_orientation
at gtksizerequest.c line 359
#22 gtk_widget_get_preferred_width
at gtksizerequest.c line 552
#23 gtk_widget_get_preferred_size
at gtksizerequest.c line 694
#24 gtk_window_compute_hints
at gtkwindow.c line 7522
#25 gtk_window_compute_configure_request
at gtkwindow.c line 6844
#26 gtk_window_show
at gtkwindow.c line 4850
#27 g_cclosure_marshal_VOID__VOID
at gmarshal.c line 85
#28 g_type_class_meta_marshal
at gclosure.c line 970
#29 g_closure_invoke
at gclosure.c line 777
#30 signal_emit_unlocked_R
at gsignal.c line 3481
#31 g_signal_emit_valist
at gsignal.c line 3300
#32 g_signal_emit
at gsignal.c line 3356
#33 gtk_widget_show
at gtkwidget.c line 4042
#34 set_language_cb
at gedit-spell-plugin.c line 774
#35 g_cclosure_marshal_VOID__VOID
at gmarshal.c line 85
#36 g_closure_invoke
at gclosure.c line 777
#37 signal_emit_unlocked_R
at gsignal.c line 3551
#38 g_signal_emit_valist
at gsignal.c line 3300
#39 g_signal_emit
at gsignal.c line 3356
#40 _gtk_action_emit_activate
at gtkaction.c line 801
#41 gtk_action_activate
at gtkaction.c line 832
#42 gtk_real_menu_item_activate
at gtkmenuitem.c line 1827
#43 g_cclosure_marshal_VOID__VOIDv
at gmarshal.c line 115
#44 g_type_class_meta_marshalv
at gclosure.c line 997
#45 _g_closure_invoke_va
at gclosure.c line 840
#46 g_signal_emit_valist
at gsignal.c line 3211
#47 g_signal_emit
at gsignal.c line 3356
#48 gtk_widget_activate
at gtkwidget.c line 6325
#49 gtk_menu_shell_activate_item
at gtkmenushell.c line 1429
#50 gtk_menu_shell_button_release
at gtkmenushell.c line 830
#51 gtk_menu_button_release
at gtkmenu.c line 3429
#52 _gtk_marshal_BOOLEAN__BOXEDv
at gtkmarshalers.c line 130
#53 g_type_class_meta_marshalv
at gclosure.c line 997
#54 _g_closure_invoke_va
at gclosure.c line 840
#55 g_signal_emit_valist
at gsignal.c line 3211
#56 g_signal_emit
at gsignal.c line 3356
#57 gtk_widget_event_internal
at gtkwidget.c line 6294
#58 gtk_widget_event
at gtkwidget.c line 5951
#59 propagate_event_up
at gtkmain.c line 2400
#60 propagate_event
at gtkmain.c line 2499
#61 gtk_propagate_event
at gtkmain.c line 2535
#62 gtk_main_do_event
at gtkmain.c line 1723
#63 _gdk_event_emit
at gdkevents.c line 69
#64 gdk_event_source_dispatch
at gdkeventsource.c line 358
#65 g_main_dispatch
at gmain.c line 2715
#66 g_main_context_dispatch
at gmain.c line 3219
#67 g_main_context_iterate
at gmain.c line 3290
#68 g_main_loop_run
at gmain.c line 3484
#69 gtk_main
at gtkmain.c line 1163
#70 gedit_main
at gedit.c line 205
#71 main
at gedit.c line 331
#72 ??
from /usr/local/bin/gedit
#73 ??
#0 append_attrs
at pango-glyph-item.c line 499
#1 split_before_cluster_start
at pango-glyph-item.c line 528
#2 pango_glyph_item_apply_attrs
at pango-glyph-item.c line 633
#3 apply_no_shape_attributes
at pango-layout.c line 3779
#4 pango_layout_check_lines
at pango-layout.c line 3945
#5 pango_layout_get_extents_internal
at pango-layout.c line 2491
#6 pango_layout_get_extents
at pango-layout.c line 2673
#7 gtk_label_get_preferred_layout_size
at gtklabel.c line 3570
#8 gtk_label_get_preferred_size
at gtklabel.c line 3613
#9 gtk_label_get_preferred_width
at gtklabel.c line 3721
#10 compute_size_for_orientation
at gtksizerequest.c line 359
#11 gtk_widget_get_preferred_width
at gtksizerequest.c line 552
#12 gtk_box_get_size
at gtkbox.c line 1042
#13 gtk_box_get_preferred_width
at gtkbox.c line 1100
#14 compute_size_for_orientation
at gtksizerequest.c line 359
#15 gtk_widget_get_preferred_width
at gtksizerequest.c line 552
#16 gtk_box_get_size
at gtkbox.c line 1042
#17 gtk_box_get_preferred_width
at gtkbox.c line 1100
#18 compute_size_for_orientation
at gtksizerequest.c line 359
#19 gtk_widget_get_preferred_width
at gtksizerequest.c line 552
#20 gtk_window_get_preferred_width
at gtkwindow.c line 6513
#21 compute_size_for_orientation
at gtksizerequest.c line 359
#22 gtk_widget_get_preferred_width
at gtksizerequest.c line 552
#23 gtk_widget_get_preferred_size
at gtksizerequest.c line 694
#24 gtk_window_compute_hints
at gtkwindow.c line 7522
#25 gtk_window_compute_configure_request
at gtkwindow.c line 6844
#26 gtk_window_show
at gtkwindow.c line 4850
#27 g_cclosure_marshal_VOID__VOID
at gmarshal.c line 85
#28 g_type_class_meta_marshal
at gclosure.c line 970
#29 g_closure_invoke
at gclosure.c line 777
#30 signal_emit_unlocked_R
at gsignal.c line 3481
#31 g_signal_emit_valist
at gsignal.c line 3300
#32 g_signal_emit
at gsignal.c line 3356
#33 gtk_widget_show
at gtkwidget.c line 4042
#34 set_language_cb
at gedit-spell-plugin.c line 774
#35 g_cclosure_marshal_VOID__VOID
at gmarshal.c line 85
#36 g_closure_invoke
at gclosure.c line 777
#37 signal_emit_unlocked_R
at gsignal.c line 3551
#38 g_signal_emit_valist
at gsignal.c line 3300
#39 g_signal_emit
at gsignal.c line 3356
#40 _gtk_action_emit_activate
at gtkaction.c line 801
#41 gtk_action_activate
at gtkaction.c line 832
#42 gtk_real_menu_item_activate
at gtkmenuitem.c line 1827
#43 g_cclosure_marshal_VOID__VOIDv
at gmarshal.c line 115
#44 g_type_class_meta_marshalv
at gclosure.c line 997
#45 _g_closure_invoke_va
at gclosure.c line 840
#46 g_signal_emit_valist
at gsignal.c line 3211
#47 g_signal_emit
at gsignal.c line 3356
#48 gtk_widget_activate
at gtkwidget.c line 6325
#49 gtk_menu_shell_activate_item
at gtkmenushell.c line 1429
#50 gtk_menu_shell_button_release
at gtkmenushell.c line 830
#51 gtk_menu_button_release
at gtkmenu.c line 3429
#52 _gtk_marshal_BOOLEAN__BOXEDv
at gtkmarshalers.c line 130
#53 g_type_class_meta_marshalv
at gclosure.c line 997
#54 _g_closure_invoke_va
at gclosure.c line 840
#55 g_signal_emit_valist
at gsignal.c line 3211
#56 g_signal_emit
at gsignal.c line 3356
#57 gtk_widget_event_internal
at gtkwidget.c line 6294
#58 gtk_widget_event
at gtkwidget.c line 5951
#59 propagate_event_up
at gtkmain.c line 2400

axon:pango {1754} ^Dexit

Please let me know if there is any other information which I can provide in order to fix this issue.

Comment 1 Behdad Esfahbod 2012-09-27 16:54:18 UTC

*** Bug 684960 has been marked as a duplicate of this bug. ***

Comment 2 Behdad Esfahbod 2012-09-27 17:58:59 UTC

FWIW, this reproduces it for me:

./pango-view --markup --text 'به<span font="nazli">داد</span>' --width 1 --wrap=char

Comment 3 Behdad Esfahbod 2012-09-27 17:59:19 UTC

*** Bug 684987 has been marked as a duplicate of this bug. ***

Comment 4 Behdad Esfahbod 2012-09-27 18:10:30 UTC

Sorry everyone.  Found and fixed the bug:

commit 0d34c10108585b4cfed042aa2ef501780b2d2193
Author: Behdad Esfahbod <behdad@behdad.org>
Date:   Thu Sep 27 14:08:30 2012 -0400

    Fixup grapheme clusters
    
    After adding pango_shape_full() and passing full paragraph text to
    HarfBuzz, we were getting cluster values relative to beginning to
    paragraph back from HarfBuzz, and I forgot to account for that.  Caused
    severe crashes.
    
    Fixes:
    
    Bug 684959 - crash after "Add pango_shape_full()"
    
    and the dupes...

Comment 5 Behdad Esfahbod 2012-09-27 21:22:48 UTC

*** Bug 684999 has been marked as a duplicate of this bug. ***