Bug 92053 - new pango causes segmentation fault in pango_layout_line_get_pixel_extents()
Summary: new pango causes segmentation fault in pango_layout_line_get_pixel_extents()
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Red Hat Raw Hide
Classification: Retired
Component: pango
Version: 1.0
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Owen Taylor
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2003-06-02 06:16 UTC by Gary Peck
Modified: 2005-10-31 22:00 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2003-06-02 18:08:26 UTC
Embargoed:


Attachments (Terms of Use)
gconf-editor backtrace (3.72 KB, text/plain)
2003-06-02 16:00 UTC, Gary Peck
no flags Details

Description Gary Peck 2003-06-02 06:16:36 UTC
Description of problem:
many programs, including gconf-editor and epiphany, crash with a segmentation
fault after upgrading to the latest Raw Hide pango

Version-Release number of selected component (if applicable):
pango 1.2.2-1

How reproducible:
always

Steps to Reproduce:
1. gdb /usr/bin/gconf-editor
2. MOZILLA_FIVE_HOME=/usr/lib/mozilla-1.4b LD_LIBRARY_PATH=/usr/lib/mozilla-1.4b:$LD_LIBRARY_PATH gdb /usr/bin/epiphany-bin
3.
    
Actual results:
both runs of gdb produce the following output (with appropriately different
LWP thread number and function address):
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 16384 (LWP 16473)]
0x50138b62 in pango_layout_line_get_pixel_extents ()
   from /usr/lib/libpango-1.0.so.0

Expected results:
Programs should run normally.

Additional info:

Comment 1 Gary Peck 2003-06-02 06:22:02 UTC
i forgot to mention that when running epiphany you must go to a web page with a
downloadable file. click on the file, then click "Save" in the resulting dialog
box. epiphany will then crash when prompting for a directory to save the file in.

Comment 2 Nicolas Mailhot 2003-06-02 08:42:19 UTC
Add pan & evolution to the list

Comment 3 Owen Taylor 2003-06-02 13:18:06 UTC
Can you install
http://people.redhat.com/otaylor/tmp/pango-debuginfo-1.2.2-1.i386.rpm
and get a back trace? (Say of gconf-editor, as the smallest and
simplest of the programs you mention)


Comment 4 Daniel Malmgren 2003-06-02 14:58:16 UTC
I have the same problem. Also Galeon is giving it when trying to use the
tab-completion in the url field. Here is what I get when running gdb on
gconf-edit after having installed the pango-debuginfo rpm:

---------------------------------------------------------

(gdb) run
Starting program: /usr/bin/gconf-editor
(no debugging symbols found)...(no debugging symbols found)...(no debugging
symbols found)...(no debugging symbols found)...
(no debugging symbols found)...(no debugging symbols found)...(no debugging
symbols found)...(no debugging symbols found)...
(no debugging symbols found)...(no debugging symbols found)...[New Thread
1080581664 (LWP 3196)]
 
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1080581664 (LWP 3196)]
pango_layout_get_item_properties (item=0xbfffecb4, uline=0xbfffecb4,
rise=0xbfffecb8, ink_rect=0xbfffece0, logical_rect=0xbfffecd0,
    shape_set=0xbfffecbc) at pango-layout.c:3877
3877          switch (attr->klass->type)


Comment 5 Owen Taylor 2003-06-02 15:13:31 UTC
Once it stops in the debugger, if you do:

 (gdb) backtrace   [or bt, for short]

It will will show you a complete call list.

Are you using the standard fonts? I can't reproduce this with 
Red Hat 9 + pango-1.2.2.

Do you have to do anything special with gconf-editor to reproduce the crash?


Comment 6 Gary Peck 2003-06-02 15:57:49 UTC
i installed the debuginfo package. with gconf-editor, it only crashes once the
mouse is moved over one of the entries in the left pane. i'm attaching the
backtrace.

this system is running rawhide versions of all packages. the fonts being used in
/etc/fonts/fonts.conf are:
XFree86-base-fonts-4.3.0-13
gnome-print-0.37-4
bitmap-fonts-0.3-2
ghostscript-fonts-5.50-9
urw-fonts-2.0-29
fonts-ISO8859-2-100dpi-1.0-11
fonts-ISO8859-2-1.0-11
fonts-KOI8-R-100dpi-1.0-5
fonts-KOI8-R-1.0-5
ucs-fonts.tar.gz and ucs-fonts-asian.tar.gz from
http://www.cl.cam.ac.uk/~mgk25/ucs-fonts.html (the 2003-01-17 versions)
arialuni, code2000, cyberbit, and the true type fonts from windows xp

my gnome font preferences are set to "Sans" for application, desktop, and window
title font and "Monospace" for terminal font.

Comment 7 Gary Peck 2003-06-02 16:00:47 UTC
Created attachment 92084 [details]
gconf-editor backtrace

Comment 8 Tim Waugh 2003-06-02 16:01:47 UTC
This happens for me too, when running 'gramps' (gramps.sourceforge.net).

(gdb) info locals
tmp_list = (GSList *) 0x88ff4e0
(gdb) bt
#0  pango_layout_get_item_properties (item=0xbfffc504, uline=0xbfffc504,
    rise=0xbfffc508, ink_rect=0xbfffc530, logical_rect=0xbfffc520,
    shape_set=0xbfffc50c) at pango-layout.c:3877
3877          switch (attr->klass->type)
#1  0x4052c28e in pango_layout_run_get_extents (run=0x8a3d870, shape_setp=0x0,
    run_ink=0xbfffc508, run_logical=0xbfffc5b0) at pango-layout.c:3555
3555      pango_layout_get_item_properties (run->item, &uline, &rise,
#2  0x4052c4ff in pango_layout_line_get_extents (line=0x8a3e3c8, ink_rect=0x0,
    logical_rect=0xbfffc620) at pango-layout.c:3660
3660          pango_layout_run_get_extents (run, NULL,
#3  0x4052971d in get_line_extents_layout_coords (layout=0xbfffc504,
    line=0x8a3e3c8, layout_width=-1073756924, y_offset=0, baseline=0xbfffc6ac,
    line_ink_layout=0x0, line_logical_layout=0xbfffc6b0) at pango-layout.c:1843
1843      pango_layout_line_get_extents (line, line_ink_layout ? &line_ink : NULL,
#4  0x40529860 in pango_layout_get_extents_internal (layout=0x8a3d8a8,
    ink_rect=0x0, logical_rect=0x8a463b0, line_extents=0x8a463c0)
    at pango-layout.c:1911
1911            get_line_extents_layout_coords (layout, line,
#5  0x4052cecc in pango_layout_get_iter (layout=0x8a3d8a8)
    at pango-layout.c:4083
4083      pango_layout_get_extents_internal (layout,
#6  0x40468842 in gdk_draw_layout_with_colors ()
   from /usr/lib/libgdk-x11-2.0.so.0
#7  0x40468bb1 in gdk_draw_layout () from /usr/lib/libgdk-x11-2.0.so.0
#8  0x40322e62 in gtk_style_apply_default_background ()
   from /usr/lib/libgtk-x11-2.0.so.0
#9  0x403252b5 in gtk_paint_layout () from /usr/lib/libgtk-x11-2.0.so.0
#10 0x4024c621 in gtk_cell_renderer_text_new ()
   from /usr/lib/libgtk-x11-2.0.so.0
#11 0x40249263 in gtk_cell_renderer_render () from /usr/lib/libgtk-x11-2.0.so.0
#12 0x403a56c7 in gtk_tree_view_column_cell_get_size ()
   from /usr/lib/libgtk-x11-2.0.so.0
#13 0x403a57df in _gtk_tree_view_column_cell_render ()
   from /usr/lib/libgtk-x11-2.0.so.0
#14 0x40390c0d in gtk_tree_view_get_type () from /usr/lib/libgtk-x11-2.0.so.0
#15 0x402ccc2f in _gtk_marshal_BOOLEAN__BOXED ()
   from /usr/lib/libgtk-x11-2.0.so.0
#16 0x4009a247 in g_type_class_meta_marshal (closure=0xbfffcb10,
    return_value=0xbfffc504, n_param_values=3221210372,
    param_values=0xbfffcfec, invocation_hint=0xbfffc504,
    marshal_data=0xbfffc504) at gclosure.c:514
#17 0x40099ed7 in g_closure_invoke (closure=0xbfffcfec,
    return_value=0xbfffc504, n_param_values=3221210372,
    param_values=0xbfffc504, invocation_hint=0xbfffc504) at gclosure.c:437
#18 0x400ac439 in signal_emit_unlocked_R (node=0x82eb568, detail=0,
    instance=0x886ea90, emission_return=0xbfffcd60,
    instance_and_params=0xbfffcdc0) at gsignal.c:2860
#19 0x400ab7af in g_signal_emit_valist (instance=0x886ea90, signal_id=0,
    detail=0, var_args=0xbfffcf50 "X���X���") at gsignal.c:2564
#20 0x400abbe4 in g_signal_emit (instance=0xbfffc504, signal_id=3221210372,
    detail=3221210372) at gsignal.c:2612
#21 0x403b26fb in gtk_widget_send_expose () from /usr/lib/libgtk-x11-2.0.so.0
#22 0x402cb6fc in gtk_main_do_event () from /usr/lib/libgtk-x11-2.0.so.0
#23 0x40479db5 in gdk_window_clear_area_e () from /usr/lib/libgdk-x11-2.0.so.0
#24 0x40479e5a in gdk_window_process_all_updates ()
   from /usr/lib/libgdk-x11-2.0.so.0
#25 0x40479ec1 in gdk_window_process_all_updates ()
   from /usr/lib/libgdk-x11-2.0.so.0
#26 0x400f0743 in g_idle_dispatch (source=0x894fe80, callback=0,
    user_data=0xbfffc504) at gmain.c:3164
#27 0x400edb35 in g_main_dispatch (context=0x81ab330) at gmain.c:1653
#28 0x400eeb78 in g_main_context_dispatch (context=0x81ab334) at gmain.c:2197
#29 0x400eee8d in g_main_context_iterate (context=0x81ab330, block=1,
    dispatch=1, self=0x81a1bf0) at gmain.c:2278
#30 0x400ef0cc in g_main_context_iteration (context=0x81ab330,
    may_block=-1073756924) at gmain.c:2337
#31 0x402cb29f in gtk_main_iteration_do () from /usr/lib/libgtk-x11-2.0.so.0
#32 0x401b538e in pygtk_generic_cell_renderer_new ()
   from /usr/lib/python2.2/site-packages/gtk-2.0/gtk/_gtkmodule.so
#33 0x080d0e8e in PyCFunction_Call ()
#34 0x080b3797 in PyObject_Call ()
#35 0x0807c905 in PyEval_GetFuncDesc ()
#36 0x0807a613 in PyEval_EvalCode ()
#37 0x0807b0ce in PyEval_EvalCodeEx ()
#38 0x0807c62b in PyEval_GetFuncDesc ()
#39 0x0807a5a3 in PyEval_EvalCode ()
#40 0x0807b0ce in PyEval_EvalCodeEx ()
#41 0x0807c62b in PyEval_GetFuncDesc ()
#42 0x0807a5a3 in PyEval_EvalCode ()
#43 0x0807b0ce in PyEval_EvalCodeEx ()
#44 0x0807c62b in PyEval_GetFuncDesc ()
#45 0x0807a5a3 in PyEval_EvalCode ()
#46 0x0807b0ce in PyEval_EvalCodeEx ()
#47 0x0807c62b in PyEval_GetFuncDesc ()
#48 0x0807a5a3 in PyEval_EvalCode ()
#49 0x0807b0ce in PyEval_EvalCodeEx ()
#50 0x0807c62b in PyEval_GetFuncDesc ()
#51 0x0807a5a3 in PyEval_EvalCode ()
#52 0x0807b0ce in PyEval_EvalCodeEx ()
#53 0x0807c62b in PyEval_GetFuncDesc ()
#54 0x0807a5a3 in PyEval_EvalCode ()
#55 0x0807b0ce in PyEval_EvalCodeEx ()
#56 0x0807c62b in PyEval_GetFuncDesc ()
#57 0x0807a5a3 in PyEval_EvalCode ()
#58 0x0807b0ce in PyEval_EvalCodeEx ()
#59 0x0807c62b in PyEval_GetFuncDesc ()
#60 0x0807a5a3 in PyEval_EvalCode ()
#61 0x0807b0ce in PyEval_EvalCodeEx ()
#62 0x0807c62b in PyEval_GetFuncDesc ()
#63 0x0807a5a3 in PyEval_EvalCode ()
#64 0x0807b0ce in PyEval_EvalCodeEx ()
#65 0x080c447c in PyFunction_SetClosure ()
#66 0x080b3797 in PyObject_Call ()
#67 0x080ba4ab in PyMethod_New ()
#68 0x080b3797 in PyObject_Call ()
#69 0x0807c2d0 in PyEval_CallObjectWithKeywords ()
#70 0x080b631d in PyInstance_New ()
#71 0x080b3797 in PyObject_Call ()
#72 0x0807c905 in PyEval_GetFuncDesc ()
#73 0x0807a525 in PyEval_EvalCode ()
#74 0x0807b0ce in PyEval_EvalCodeEx ()
#75 0x08077fc5 in PyEval_EvalCode ()
#76 0x08097e29 in PyRun_FileExFlags ()
#77 0x08096d90 in PyRun_SimpleFileExFlags ()
#78 0x080966da in PyRun_AnyFileExFlags ()
#79 0x08053a19 in Py_Main ()
#80 0x08053469 in main ()
#81 0x00e95568 in __libc_start_main () from /lib/tls/libc.so.6

(I've annotated the first few frames with the source line)

Comment 9 Owen Taylor 2003-06-02 16:28:33 UTC
Ugh, I already fixed that... looks like I accidentally built a prerelease
of Pango-1.2.2 instead of the final one.


Comment 10 Owen Taylor 2003-06-02 18:08:26 UTC
http://people.redhat.com/otaylor/tmp/pango-1.2.2-2.i386.rpm
http://people.redhat.com/otaylor/tmp/pango-devel-1.2.2-2.i386.rpm

Have the right tarball and should fix this problem.



Note You need to log in before you can comment on or make changes to this bug.