Bug 1851919 - Pango 1.45 crashes pidgin with any link click
Summary: Pango 1.45 crashes pidgin with any link click
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: pango
Version: 33
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Peng Wu
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-06-29 12:47 UTC by Zdenek Kabelac
Modified: 2021-11-24 06:14 UTC (History)
12 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-11-24 06:14:34 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Zdenek Kabelac 2020-06-29 12:47:53 UTC
Description of problem:

I've noticed instant crash of a pidgin - with this new pango 1.45 package.
I've downgraded to version  pango-1.44.7-3.fc33  and pidgin is 'usable'
again (aka I can click on URL without getting instant core dump).

This is backtrace I'm getting on a crash:
(pidgin 2.13.0-20)

#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:49
--Type <RET> for more, q to quit, c to continue without paging--
49	  return ret;
[Current thread is 1 (Thread 0x7f2b86c61cc0 (LWP 100183))]
(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:49
#1  0x00007f2b883a78a4 in __GI_abort () at abort.c:79
#2  0x00007f2b886d5b6c in g_assertion_message
    (domain=<optimized out>, file=0x7f2b88b7e19b "../pango/pango-context.c", line=<optimized out>, func=<optimized out>, message=<optimized out>) at ../glib/gtestutils.c:2930
#3  0x00007f2b8873408f in g_assertion_message_expr
    (domain=0x7f2b88b79e0d "Pango", file=0x7f2b88b7e19b "../pango/pango-context.c", line=1435, func=0x7f2b88b7e3d0 "itemize_state_process_run", expr=<optimized out>) at ../glib/gtestutils.c:2956
#4  0x00007f2b88b603d6 in itemize_state_process_run () at /lib64/libpango-1.0.so.0
#5  0x00007f2b88b61218 in pango_itemize_with_base_dir () at /lib64/libpango-1.0.so.0
#6  0x00007f2b88b6a695 in pango_layout_check_lines.part () at /lib64/libpango-1.0.so.0
#7  0x00007f2b88b6c539 in pango_layout_get_extents_internal () at /lib64/libpango-1.0.so.0
#8  0x00007f2b88b6cac1 in pango_layout_get_pixel_size () at /lib64/libpango-1.0.so.0
#9  0x000056100c9047f1 in gtk_imhtml_tip ()
#10 0x00007f2b8870ba51 in g_timeout_dispatch
    (source=source@entry=0x56100ec326c0, callback=0x56100c9045b0 <gtk_imhtml_tip>, user_data=0x56100d93c2b0)
    at ../glib/gmain.c:4800
#11 0x00007f2b8870aeaf in g_main_dispatch (context=0x56100d287540) at ../glib/gmain.c:3309
#12 g_main_context_dispatch (context=0x56100d287540) at ../glib/gmain.c:3974
#13 0x00007f2b8870b238 in g_main_context_iterate
    (context=0x56100d287540, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>)
    at ../glib/gmain.c:4047
#14 0x00007f2b8870b553 in g_main_loop_run (loop=0x56100ea147e0) at ../glib/gmain.c:4241
#15 0x00007f2b88f37ba2 in gtk_main () at /lib64/libgtk-x11-2.0.so.0
#16 0x000056100c8bdb4c in main ()

Comment 1 Matthias Clasen 2020-07-01 14:10:44 UTC
whats the exact pango version ? I believe 1.45.3 should have all reported crashers fixed.

Comment 2 Zdenek Kabelac 2020-07-01 19:39:01 UTC
Happens with 1.45.3 - updated again to this version (as well as rest of my rawhide - so up-to-date to this minute) 

pango-1.45.3-1.fc33.x86_64
pango-devel-1.45.3-1.fc33.x86_64
pango-1.45.3-1.fc33.i686
pango-debugsource-1.45.3-1.fc33.x86_64
pango-debuginfo-1.45.3-1.fc33.x86_64


pidgin-2.13.0-21.fc33.x86_64
pidgin-debugsource-2.13.0-21.fc33.x86_64
pidgin-debuginfo-2.13.0-21.fc33.x86_64


now installed even -debug* package for better estimation:

Program terminated with signal SIGABRT, Aborted.
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:49
49	  return ret;
[Current thread is 1 (Thread 0x7fc73be71cc0 (LWP 1358))]
(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:49
#1  0x00007fc73d5b78a4 in __GI_abort () at abort.c:79
#2  0x00007fc73d8e5b6c in g_assertion_message
    (domain=<optimized out>, file=0x7fc73dd8e19b "../pango/pango-context.c", line=<optimized out>, func=<optimized out>, message=<optimized out>) at ../glib/gtestutils.c:2930
#3  0x00007fc73d94408f in g_assertion_message_expr
    (domain=domain@entry=0x7fc73dd89e0d "Pango", file=file@entry=0x7fc73dd8e19b "../pango/pango-context.c", line=line@entry=1435, func=func@entry=0x7fc73dd8e3d0 <__func__.5> "itemize_state_process_run", expr=expr@entry=0x7fc73dd8e300 "state->run_end != state->run_start") at ../glib/gtestutils.c:2956
#4  0x00007fc73dd703d6 in itemize_state_process_run (state=state@entry=0x7ffcccfeb4e0)
    at ../pango/pango-context.c:1435
#5  0x00007fc73dd71218 in pango_itemize_with_base_dir
    (context=0x55dd2f6a3300 [PangoContext], base_dir=base_dir@entry=PANGO_DIRECTION_LTR, text=0x55dd2f44c660 "http://sources.redhat.com/lvm2", start_index=0, length=200, attrs=attrs@entry=0x0, cached_iter=0x0)
    at ../pango/pango-context.c:1576
#6  0x00007fc73dd7a695 in pango_layout_check_lines (layout=<optimized out>) at ../pango/pango-layout.c:4360
#7  0x00007fc73dd7c539 in pango_layout_get_extents_internal
    (layout=layout@entry=0x55dd2f548a50 [PangoLayout], ink_rect=ink_rect@entry=0x0, logical_rect=logical_rect@entry=0x7ffcccfebd40, line_extents=line_extents@entry=0x0) at ../pango/pango-layout.c:2683
#8  0x00007fc73dd7cac1 in pango_layout_get_pixel_size
    (layout=layout@entry=0x55dd2f548a50 [PangoLayout], width=width@entry=0x7ffcccfebda4, height=height@entry=0x0) at ../pango/pango-layout.c:2952
#9  0x000055dd2c9697f1 in gtk_imhtml_tip (data=data@entry=0x55dd2e2bacf0) at gtkimhtml.c:599
#10 0x00007fc73d91ba51 in g_timeout_dispatch
    (source=source@entry=0x55dd2f6c7b10, callback=0x55dd2c9695b0 <gtk_imhtml_tip>, user_data=0x55dd2e2bacf0)
    at ../glib/gmain.c:4800
#11 0x00007fc73d91aeaf in g_main_dispatch (context=0x55dd2dc04540) at ../glib/gmain.c:3309
#12 g_main_context_dispatch (context=0x55dd2dc04540) at ../glib/gmain.c:3974
#13 0x00007fc73d91b238 in g_main_context_iterate
    (context=0x55dd2dc04540, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>)
    at ../glib/gmain.c:4047
#14 0x00007fc73d91b553 in g_main_loop_run (loop=0x55dd2f3aebd0) at ../glib/gmain.c:4241
#15 0x00007fc73e147ba2 in gtk_main () at /lib64/libgtk-x11-2.0.so.0
#16 0x000055dd2c922b4c in main (argc=<optimized out>, argv=<optimized out>) at gtkmain.c:939
(gdb) 
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:49
#1  0x00007fc73d5b78a4 in __GI_abort () at abort.c:79
#2  0x00007fc73d8e5b6c in g_assertion_message
    (domain=<optimized out>, file=0x7fc73dd8e19b "../pango/pango-context.c", line=<optimized out>, func=<optimized out>, message=<optimized out>) at ../glib/gtestutils.c:2930
#3  0x00007fc73d94408f in g_assertion_message_expr
    (domain=domain@entry=0x7fc73dd89e0d "Pango", file=file@entry=0x7fc73dd8e19b "../pango/pango-context.c", line=line@entry=1435, func=func@entry=0x7fc73dd8e3d0 <__func__.5> "itemize_state_process_run", expr=expr@entry=0x7fc73dd8e300 "state->run_end != state->run_start") at ../glib/gtestutils.c:2956
#4  0x00007fc73dd703d6 in itemize_state_process_run (state=state@entry=0x7ffcccfeb4e0)
    at ../pango/pango-context.c:1435
#5  0x00007fc73dd71218 in pango_itemize_with_base_dir
    (context=0x55dd2f6a3300 [PangoContext], base_dir=base_dir@entry=PANGO_DIRECTION_LTR, text=0x55dd2f44c660 "http://sources.redhat.com/lvm2", start_index=0, length=200, attrs=attrs@entry=0x0, cached_iter=0x0)
    at ../pango/pango-context.c:1576
#6  0x00007fc73dd7a695 in pango_layout_check_lines (layout=<optimized out>) at ../pango/pango-layout.c:4360
#7  0x00007fc73dd7c539 in pango_layout_get_extents_internal
    (layout=layout@entry=0x55dd2f548a50 [PangoLayout], ink_rect=ink_rect@entry=0x0, logical_rect=logical_rect@entry=0x7ffcccfebd40, line_extents=line_extents@entry=0x0) at ../pango/pango-layout.c:2683
#8  0x00007fc73dd7cac1 in pango_layout_get_pixel_size
    (layout=layout@entry=0x55dd2f548a50 [PangoLayout], width=width@entry=0x7ffcccfebda4, height=height@entry=0x0) at ../pango/pango-layout.c:2952
#9  0x000055dd2c9697f1 in gtk_imhtml_tip (data=data@entry=0x55dd2e2bacf0) at gtkimhtml.c:599
#10 0x00007fc73d91ba51 in g_timeout_dispatch
    (source=source@entry=0x55dd2f6c7b10, callback=0x55dd2c9695b0 <gtk_imhtml_tip>, user_data=0x55dd2e2bacf0)
    at ../glib/gmain.c:4800
#11 0x00007fc73d91aeaf in g_main_dispatch (context=0x55dd2dc04540) at ../glib/gmain.c:3309
#12 g_main_context_dispatch (context=0x55dd2dc04540) at ../glib/gmain.c:3974
#13 0x00007fc73d91b238 in g_main_context_iterate
    (context=0x55dd2dc04540, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>)
    at ../glib/gmain.c:4047
#14 0x00007fc73d91b553 in g_main_loop_run (loop=0x55dd2f3aebd0) at ../glib/gmain.c:4241
#15 0x00007fc73e147ba2 in gtk_main () at /lib64/libgtk-x11-2.0.so.0
#16 0x000055dd2c922b4c in main (argc=<optimized out>, argv=<optimized out>) at gtkmain.c:939



aborts here:

(gdb) list
2925	       * to avoid triggering any system crash-reporting daemon.
2926	       */
2927	      _exit (1);
2928	    }
2929	  else
2930	    g_abort ();
2931	}
2932	
2933	/**
2934	 * g_assertion_message_expr: (skip)



- now time to revert to 1.44 back again....

Comment 3 Peng Wu 2020-07-06 07:20:55 UTC
It seems gtkimhtml.c is from pidgin code, and it crashes when show the url tooltips.

Comment 4 Peng Wu 2020-07-15 08:03:34 UTC
It seems there is pidgin 2.14.1 in upstream.

URL: https://sourceforge.net/projects/pidgin/files/Pidgin/

Could you ask pidgin maintainer to update the package?

Comment 5 Peng Wu 2020-07-16 11:18:11 UTC
Okay, just find the pidgin update bug.

URL: https://bugzilla.redhat.com/show_bug.cgi?id=1856866

Comment 6 Matthias Clasen 2020-07-30 13:22:34 UTC
#5  0x00007fc73dd71218 in pango_itemize_with_base_dir
    (context=0x55dd2f6a3300 [PangoContext], base_dir=base_dir@entry=PANGO_DIRECTION_LTR, text=0x55dd2f44c660 "http://sources.redhat.com/lvm2", start_index=0, length=200, attrs=attrs@entry=0x0, cached_iter=0x0)

This looks curious. length is 200, but "http://sources.redhat.com/lvm2" is clearly shorter than 200 bytes.

Comment 7 Peng Wu 2020-08-03 01:38:26 UTC
Upstream URL: https://gitlab.gnome.org/GNOME/pango/-/merge_requests/214

Comment 8 Ben Cotton 2020-08-11 13:41:19 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 33 development cycle.
Changing version to 33.

Comment 9 Peng Wu 2021-08-26 07:27:18 UTC
Does this bug still happen in Fedora 34?

Comment 10 Ben Cotton 2021-11-04 13:45:23 UTC
This message is a reminder that Fedora 33 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora 33 on 2021-11-30.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
Fedora 'version' of '33'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 33 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 11 Ben Cotton 2021-11-04 14:14:52 UTC
This message is a reminder that Fedora 33 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora 33 on 2021-11-30.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
Fedora 'version' of '33'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 33 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 12 Ben Cotton 2021-11-04 15:12:30 UTC
This message is a reminder that Fedora 33 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora 33 on 2021-11-30.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
Fedora 'version' of '33'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 33 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 13 Peng Wu 2021-11-24 06:14:34 UTC
I think this bug is fixed.


Note You need to log in before you can comment on or make changes to this bug.