1003069 – After updating to 2.10.94-1.fc20, firefox always crashes in http://start.fedoraproject.org/.

Bug 1003069 - After updating to 2.10.94-1.fc20, firefox always crashes in http://start.fedoraproject.org/.

Summary: After updating to 2.10.94-1.fc20, firefox always crashes in http://start.fedo...

Keywords:
Status:	CLOSED RAWHIDE
Alias:	None
Product:	Fedora
Classification:	Fedora
Component:	fontconfig
Sub Component:
Version:	20
Hardware:	x86_64
OS:	Linux
Priority:	unspecified
Severity:	urgent
Target Milestone:	---
Assignee:	Akira TAGOH
QA Contact:	Fedora Extras Quality Assurance
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2013-08-30 16:46 UTC by sangu
Modified:	2013-08-31 02:23 UTC (History)
CC List:	4 users (show)
Fixed In Version:	fontconfig-2.10.95-1.fc20
Doc Type:	Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed:	2013-08-31 02:23:41 UTC
Type:	Bug
Embargoed:
Dependent Products:

Attachments	(Terms of Use)

Description sangu 2013-08-30 16:46:43 UTC

Description of problem:
$ firefox -g -d gdb
Program received signal SIGSEGV, Segmentation fault.
0x000000000040e315 in jemalloc_crash ()
(gdb) bt
#0  0x000000000040e315 in jemalloc_crash ()
#1  0x000000000040fd78 in arena_dalloc ()
#2  0x00007fffefb8899b in FcValueListDestroy (l=0x7ffff5405f60) at fcpat.c:151
#3  0x00007fffefb88e22 in IA__FcPatternDestroy (p=0x7fffbc48d5c0)
    at fcpat.c:376
#4  0x00007ffff408f187 in gfxFcFont::GetOrMakeFont(_FcPattern*, _FcPattern*, gfxFontStyle const*) () from /usr/lib64/firefox/xulrunner/libxul.so
#5  0x00007ffff408f422 in gfxFcFontSet::GetFontAt(unsigned int, gfxFontStyle const*) () from /usr/lib64/firefox/xulrunner/libxul.so
#6  0x00007ffff40910a0 in gfxPangoFontGroup::GetBaseFont() ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#7  0x00007ffff407d972 in void gfxFontGroup::InitScriptRun<unsigned char>(gfxContext*, gfxTextRun*, unsigned char const*, unsigned int, unsigned int, int) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#8  0x00007ffff407e7d1 in void gfxFontGroup::InitTextRun<unsigned char>(gfxContext*, gfxTextRun*, unsigned char const*, unsigned int) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#9  0x00007ffff407e8b6 in gfxFontGroup::MakeTextRun(unsigned char const*, unsigned int, gfxTextRunFactory::Parameters const*, unsigned int) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#10 0x00007ffff34fe286 in BuildTextRunsScanner::BuildTextRunForFrames(void*) ()
---Type <return> to continue, or q <return> to quit---
   from /usr/lib64/firefox/xulrunner/libxul.so
#11 0x00007ffff34fe71a in BuildTextRunsScanner::FlushFrames(bool, bool) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#12 0x00007ffff34fe906 in BuildTextRunsScanner::ScanFrame(nsIFrame*) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#13 0x00007ffff34fed5a in BuildTextRuns(gfxContext*, nsTextFrame*, nsIFrame*, nsLineList_iterator const*, nsTextFrame::TextRunType) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#14 0x00007ffff34fef6d in nsTextFrame::EnsureTextRun(nsTextFrame::TextRunType, gfxContext*, nsIFrame*, nsLineList_iterator const*, unsigned int*) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#15 0x00007ffff35038f0 in nsTextFrame::AddInlineMinWidthForFlow(nsRenderingContext*, nsIFrame::InlineMinWidthData*, nsTextFrame::TextRunType) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#16 0x00007ffff3503e5b in nsTextFrame::AddInlineMinWidth(nsRenderingContext*, nsIFrame::InlineMinWidthData*) () from /usr/lib64/firefox/xulrunner/libxul.so
#17 0x00007ffff34b0d31 in nsBlockFrame::GetMinWidth(nsRenderingContext*) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#18 0x00007ffff346f46c in nsLayoutUtils::IntrinsicForContainer(nsRenderingContext*, nsIFrame*, nsLayoutUtils::IntrinsicWidthType) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
---Type <return> to continue, or q <return> to quit---
#19 0x00007ffff34e8042 in nsPlaceholderFrame::AddInlineMinWidth(nsRenderingContext*, nsIFrame::InlineMinWidthData*) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#20 0x00007ffff34b0d31 in nsBlockFrame::GetMinWidth(nsRenderingContext*) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#21 0x00007ffff34bcdb8 in nsFrame::ShrinkWidthToFit(nsRenderingContext*, int)
    () from /usr/lib64/firefox/xulrunner/libxul.so
#22 0x00007ffff34b631a in nsContainerFrame::ComputeAutoSize(nsRenderingContext*, nsSize, int, nsSize, nsSize, nsSize, bool) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#23 0x00007ffff34bba75 in nsFrame::ComputeSize(nsRenderingContext*, nsSize, int, nsSize, nsSize, nsSize, unsigned int) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#24 0x00007ffff34b1834 in FloatMarginWidth(nsHTMLReflowState const&, int, nsIFrame*, nsCSSOffsetState const&) () from /usr/lib64/firefox/xulrunner/libxul.so
#25 0x00007ffff34b2290 in nsBlockReflowState::FlowAndPlaceFloat(nsIFrame*) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#26 0x00007ffff34b29ca in nsBlockReflowState::AddFloat(nsLineLayout*, nsIFrame*, int) () from /usr/lib64/firefox/xulrunner/libxul.so
#27 0x00007ffff34e27ab in nsLineLayout::ReflowFrame(nsIFrame*, unsigned int&, nsHTMLReflowMetrics*, bool&) () from /usr/lib64/firefox/xulrunner/libxul.so
---Type <return> to continue, or q <return> to quit---
#28 0x00007ffff34a9c2b in nsBlockFrame::ReflowInlineFrame(nsBlockReflowState&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#29 0x00007ffff34af319 in nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#30 0x00007ffff34af4fc in nsBlockFrame::ReflowInlineFrames(nsBlockReflowState&, nsLineList_iterator, bool*) () from /usr/lib64/firefox/xulrunner/libxul.so
#31 0x00007ffff34afbc8 in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&)
    () from /usr/lib64/firefox/xulrunner/libxul.so
#32 0x00007ffff34b044f in nsBlockFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#33 0x00007ffff34b1506 in nsBlockReflowContext::ReflowBlock(nsRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, nsHTMLReflowState&, unsigned int&, nsBlockReflowState&) () from /usr/lib64/firefox/xulrunner/libxul.so
#34 0x00007ffff34adb32 in nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&, nsLineList_iterator, bool*) () from /usr/lib64/firefox/xulrunner/libxul.so
#35 0x00007ffff34afbc8 in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&)
    () from /usr/lib64/firefox/xulrunner/libxul.so
---Type <return> to continue, or q <return> to quit---
#36 0x00007ffff34b044f in nsBlockFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#37 0x00007ffff34b1506 in nsBlockReflowContext::ReflowBlock(nsRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, nsHTMLReflowState&, unsigned int&, nsBlockReflowState&) () from /usr/lib64/firefox/xulrunner/libxul.so
#38 0x00007ffff34adb32 in nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&, nsLineList_iterator, bool*) () from /usr/lib64/firefox/xulrunner/libxul.so
#39 0x00007ffff34afbc8 in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&)
    () from /usr/lib64/firefox/xulrunner/libxul.so
#40 0x00007ffff34b044f in nsBlockFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#41 0x00007ffff34b1506 in nsBlockReflowContext::ReflowBlock(nsRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, nsHTMLReflowState&, unsigned int&, nsBlockReflowState&) () from /usr/lib64/firefox/xulrunner/libxul.so
#42 0x00007ffff34adb32 in nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&, nsLineList_iterator, bool*) () from /usr/lib64/firefox/xulrunner/libxul.so
#43 0x00007ffff34afbc8 in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&)
    () from /usr/lib64/firefox/xulrunner/libxul.so
#44 0x00007ffff34b044f in nsBlockFrame::Reflow(nsPresContext*, nsHTMLReflowMetri---Type <return> to continue, or q <return> to quit---
cs&, nsHTMLReflowState const&, unsigned int&) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#45 0x00007ffff34b1506 in nsBlockReflowContext::ReflowBlock(nsRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, nsHTMLReflowState&, unsigned int&, nsBlockReflowState&) () from /usr/lib64/firefox/xulrunner/libxul.so
#46 0x00007ffff34adb32 in nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&, nsLineList_iterator, bool*) () from /usr/lib64/firefox/xulrunner/libxul.so
#47 0x00007ffff34afbc8 in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&)
    () from /usr/lib64/firefox/xulrunner/libxul.so
#48 0x00007ffff34b044f in nsBlockFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#49 0x00007ffff34b7367 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned int, unsigned int&, nsOverflowContinuationTracker*) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#50 0x00007ffff34d5560 in nsCanvasFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#51 0x00007ffff34b7367 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned int, unsig---Type <return> to continue, or q <return> to quit---
ned int&, nsOverflowContinuationTracker*) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#52 0x00007ffff34cc356 in nsHTMLScrollFrame::ReflowScrolledFrame(ScrollReflowState*, bool, bool, nsHTMLReflowMetrics*, bool) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#53 0x00007ffff34cdf6b in nsHTMLScrollFrame::ReflowContents(ScrollReflowState*, nsHTMLReflowMetrics const&) () from /usr/lib64/firefox/xulrunner/libxul.so
#54 0x00007ffff34d3895 in nsHTMLScrollFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#55 0x00007ffff34b7367 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned int, unsigned int&, nsOverflowContinuationTracker*) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#56 0x00007ffff35088ab in ViewportFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#57 0x00007ffff34849bb in PresShell::DoReflow(nsIFrame*, bool) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#58 0x00007ffff3486231 in PresShell::ProcessReflowCommands(bool) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
---Type <return> to continue, or q <return> to quit---
#59 0x00007ffff348a345 in PresShell::FlushPendingNotifications(mozilla::ChangesToFlush) () from /usr/lib64/firefox/xulrunner/libxul.so
#60 0x00007ffff348d88d in nsRefreshDriver::Tick(long, mozilla::TimeStamp) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#61 0x00007ffff348dc4c in mozilla::RefreshDriverTimer::Tick() ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#62 0x00007ffff403477f in nsTimerImpl::Fire() ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#63 0x00007ffff403484d in nsTimerEvent::Run() ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#64 0x00007ffff4031868 in nsThread::ProcessNextEvent(bool, bool*) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#65 0x00007ffff400309d in NS_ProcessNextEvent(nsIThread*, bool) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#66 0x00007ffff3d61d84 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) () from /usr/lib64/firefox/xulrunner/libxul.so
#67 0x00007ffff4057a91 in MessageLoop::Run() ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#68 0x00007ffff3cbbd31 in nsBaseAppShell::Run() ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#69 0x00007ffff3b88e23 in nsAppStartup::Run() ()
---Type <return> to continue, or q <return> to quit---
   from /usr/lib64/firefox/xulrunner/libxul.so
#70 0x00007ffff3272a8f in XREMain::XRE_mainRun() ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#71 0x00007ffff3272d12 in XREMain::XRE_main(int, char**, nsXREAppData const*)
    () from /usr/lib64/firefox/xulrunner/libxul.so
#72 0x00007ffff3272f83 in XRE_main ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#73 0x0000000000403bc1 in do_main(int, char**, nsIFile*) ()
#74 0x00000000004033cf in main ()
(gdb) quit


Version-Release number of selected component (if applicable):
2.10.94-1.fc20

How reproducible:
always

Steps to Reproduce:
1. firefox starts
2. connect to http://start.fedoraproject.org/
3.

Actual results:


Expected results:


Additional info:
firefox-23.0.1-3.fc20.x86_64
xulrunner-23.0.1-1.fc20.x86_64

Comment 1 Akira TAGOH 2013-08-31 02:23:41 UTC

fixed in 2.10.95-1.fc20

Note You need to log in before you can comment on or make changes to this bug.