[Bug 1003069] New: After updating to 2.10.94-1.fc20, firefox always crashes in http://start.fedoraproject.org/.

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1003069

            Bug ID: 1003069
           Summary: After updating to 2.10.94-1.fc20, firefox always
                    crashes in http://start.fedoraproject.org/.
           Product: Fedora
           Version: 20
         Component: fontconfig
          Severity: urgent
          Assignee: tagoh(a)redhat.com
          Reporter: sangu.fedora(a)gmail.com
        QA Contact: extras-qa(a)fedoraproject.org
                CC: fonts-bugs(a)lists.fedoraproject.org,
                    i18n-bugs(a)lists.fedoraproject.org, pnemade(a)redhat.com,
                    tagoh(a)redhat.com



Description of problem:
$ firefox -g -d gdb
Program received signal SIGSEGV, Segmentation fault.
0x000000000040e315 in jemalloc_crash ()
(gdb) bt
#0  0x000000000040e315 in jemalloc_crash ()
#1  0x000000000040fd78 in arena_dalloc ()
#2  0x00007fffefb8899b in FcValueListDestroy (l=0x7ffff5405f60) at fcpat.c:151
#3  0x00007fffefb88e22 in IA__FcPatternDestroy (p=0x7fffbc48d5c0)
    at fcpat.c:376
#4  0x00007ffff408f187 in gfxFcFont::GetOrMakeFont(_FcPattern*, _FcPattern*,
gfxFontStyle const*) () from /usr/lib64/firefox/xulrunner/libxul.so
#5  0x00007ffff408f422 in gfxFcFontSet::GetFontAt(unsigned int, gfxFontStyle
const*) () from /usr/lib64/firefox/xulrunner/libxul.so
#6  0x00007ffff40910a0 in gfxPangoFontGroup::GetBaseFont() ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#7  0x00007ffff407d972 in void gfxFontGroup::InitScriptRun<unsigned
char>(gfxContext*, gfxTextRun*, unsigned char const*, unsigned int, unsigned
int, int) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#8  0x00007ffff407e7d1 in void gfxFontGroup::InitTextRun<unsigned
char>(gfxContext*, gfxTextRun*, unsigned char const*, unsigned int) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#9  0x00007ffff407e8b6 in gfxFontGroup::MakeTextRun(unsigned char const*,
unsigned int, gfxTextRunFactory::Parameters const*, unsigned int) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#10 0x00007ffff34fe286 in BuildTextRunsScanner::BuildTextRunForFrames(void*) ()
---Type <return> to continue, or q <return> to quit---
   from /usr/lib64/firefox/xulrunner/libxul.so
#11 0x00007ffff34fe71a in BuildTextRunsScanner::FlushFrames(bool, bool) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#12 0x00007ffff34fe906 in BuildTextRunsScanner::ScanFrame(nsIFrame*) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#13 0x00007ffff34fed5a in BuildTextRuns(gfxContext*, nsTextFrame*, nsIFrame*,
nsLineList_iterator const*, nsTextFrame::TextRunType) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#14 0x00007ffff34fef6d in nsTextFrame::EnsureTextRun(nsTextFrame::TextRunType,
gfxContext*, nsIFrame*, nsLineList_iterator const*, unsigned int*) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#15 0x00007ffff35038f0 in
nsTextFrame::AddInlineMinWidthForFlow(nsRenderingContext*,
nsIFrame::InlineMinWidthData*, nsTextFrame::TextRunType) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#16 0x00007ffff3503e5b in nsTextFrame::AddInlineMinWidth(nsRenderingContext*,
nsIFrame::InlineMinWidthData*) () from /usr/lib64/firefox/xulrunner/libxul.so
#17 0x00007ffff34b0d31 in nsBlockFrame::GetMinWidth(nsRenderingContext*) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#18 0x00007ffff346f46c in
nsLayoutUtils::IntrinsicForContainer(nsRenderingContext*, nsIFrame*,
nsLayoutUtils::IntrinsicWidthType) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
---Type <return> to continue, or q <return> to quit---
#19 0x00007ffff34e8042 in
nsPlaceholderFrame::AddInlineMinWidth(nsRenderingContext*,
nsIFrame::InlineMinWidthData*) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#20 0x00007ffff34b0d31 in nsBlockFrame::GetMinWidth(nsRenderingContext*) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#21 0x00007ffff34bcdb8 in nsFrame::ShrinkWidthToFit(nsRenderingContext*, int)
    () from /usr/lib64/firefox/xulrunner/libxul.so
#22 0x00007ffff34b631a in
nsContainerFrame::ComputeAutoSize(nsRenderingContext*, nsSize, int, nsSize,
nsSize, nsSize, bool) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#23 0x00007ffff34bba75 in nsFrame::ComputeSize(nsRenderingContext*, nsSize,
int, nsSize, nsSize, nsSize, unsigned int) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#24 0x00007ffff34b1834 in FloatMarginWidth(nsHTMLReflowState const&, int,
nsIFrame*, nsCSSOffsetState const&) () from
/usr/lib64/firefox/xulrunner/libxul.so
#25 0x00007ffff34b2290 in nsBlockReflowState::FlowAndPlaceFloat(nsIFrame*) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#26 0x00007ffff34b29ca in nsBlockReflowState::AddFloat(nsLineLayout*,
nsIFrame*, int) () from /usr/lib64/firefox/xulrunner/libxul.so
#27 0x00007ffff34e27ab in nsLineLayout::ReflowFrame(nsIFrame*, unsigned int&,
nsHTMLReflowMetrics*, bool&) () from /usr/lib64/firefox/xulrunner/libxul.so
---Type <return> to continue, or q <return> to quit---
#28 0x00007ffff34a9c2b in nsBlockFrame::ReflowInlineFrame(nsBlockReflowState&,
nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#29 0x00007ffff34af319 in
nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState&, nsLineLayout&,
nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*,
LineReflowStatus*, bool) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#30 0x00007ffff34af4fc in nsBlockFrame::ReflowInlineFrames(nsBlockReflowState&,
nsLineList_iterator, bool*) () from /usr/lib64/firefox/xulrunner/libxul.so
#31 0x00007ffff34afbc8 in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&)
    () from /usr/lib64/firefox/xulrunner/libxul.so
#32 0x00007ffff34b044f in nsBlockFrame::Reflow(nsPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#33 0x00007ffff34b1506 in nsBlockReflowContext::ReflowBlock(nsRect const&,
bool, nsCollapsingMargin&, int, bool, nsLineBox*, nsHTMLReflowState&, unsigned
int&, nsBlockReflowState&) () from /usr/lib64/firefox/xulrunner/libxul.so
#34 0x00007ffff34adb32 in nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&,
nsLineList_iterator, bool*) () from /usr/lib64/firefox/xulrunner/libxul.so
#35 0x00007ffff34afbc8 in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&)
    () from /usr/lib64/firefox/xulrunner/libxul.so
---Type <return> to continue, or q <return> to quit---
#36 0x00007ffff34b044f in nsBlockFrame::Reflow(nsPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#37 0x00007ffff34b1506 in nsBlockReflowContext::ReflowBlock(nsRect const&,
bool, nsCollapsingMargin&, int, bool, nsLineBox*, nsHTMLReflowState&, unsigned
int&, nsBlockReflowState&) () from /usr/lib64/firefox/xulrunner/libxul.so
#38 0x00007ffff34adb32 in nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&,
nsLineList_iterator, bool*) () from /usr/lib64/firefox/xulrunner/libxul.so
#39 0x00007ffff34afbc8 in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&)
    () from /usr/lib64/firefox/xulrunner/libxul.so
#40 0x00007ffff34b044f in nsBlockFrame::Reflow(nsPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#41 0x00007ffff34b1506 in nsBlockReflowContext::ReflowBlock(nsRect const&,
bool, nsCollapsingMargin&, int, bool, nsLineBox*, nsHTMLReflowState&, unsigned
int&, nsBlockReflowState&) () from /usr/lib64/firefox/xulrunner/libxul.so
#42 0x00007ffff34adb32 in nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&,
nsLineList_iterator, bool*) () from /usr/lib64/firefox/xulrunner/libxul.so
#43 0x00007ffff34afbc8 in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&)
    () from /usr/lib64/firefox/xulrunner/libxul.so
#44 0x00007ffff34b044f in nsBlockFrame::Reflow(nsPresContext*,
nsHTMLReflowMetri---Type <return> to continue, or q <return> to quit---
cs&, nsHTMLReflowState const&, unsigned int&) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#45 0x00007ffff34b1506 in nsBlockReflowContext::ReflowBlock(nsRect const&,
bool, nsCollapsingMargin&, int, bool, nsLineBox*, nsHTMLReflowState&, unsigned
int&, nsBlockReflowState&) () from /usr/lib64/firefox/xulrunner/libxul.so
#46 0x00007ffff34adb32 in nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&,
nsLineList_iterator, bool*) () from /usr/lib64/firefox/xulrunner/libxul.so
#47 0x00007ffff34afbc8 in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&)
    () from /usr/lib64/firefox/xulrunner/libxul.so
#48 0x00007ffff34b044f in nsBlockFrame::Reflow(nsPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#49 0x00007ffff34b7367 in nsContainerFrame::ReflowChild(nsIFrame*,
nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int,
unsigned int, unsigned int&, nsOverflowContinuationTracker*) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#50 0x00007ffff34d5560 in nsCanvasFrame::Reflow(nsPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#51 0x00007ffff34b7367 in nsContainerFrame::ReflowChild(nsIFrame*,
nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int,
unsigned int, unsig---Type <return> to continue, or q <return> to quit---
ned int&, nsOverflowContinuationTracker*) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#52 0x00007ffff34cc356 in
nsHTMLScrollFrame::ReflowScrolledFrame(ScrollReflowState*, bool, bool,
nsHTMLReflowMetrics*, bool) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#53 0x00007ffff34cdf6b in nsHTMLScrollFrame::ReflowContents(ScrollReflowState*,
nsHTMLReflowMetrics const&) () from /usr/lib64/firefox/xulrunner/libxul.so
#54 0x00007ffff34d3895 in nsHTMLScrollFrame::Reflow(nsPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#55 0x00007ffff34b7367 in nsContainerFrame::ReflowChild(nsIFrame*,
nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int,
unsigned int, unsigned int&, nsOverflowContinuationTracker*) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#56 0x00007ffff35088ab in ViewportFrame::Reflow(nsPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#57 0x00007ffff34849bb in PresShell::DoReflow(nsIFrame*, bool) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#58 0x00007ffff3486231 in PresShell::ProcessReflowCommands(bool) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
---Type <return> to continue, or q <return> to quit---
#59 0x00007ffff348a345 in
PresShell::FlushPendingNotifications(mozilla::ChangesToFlush) () from
/usr/lib64/firefox/xulrunner/libxul.so
#60 0x00007ffff348d88d in nsRefreshDriver::Tick(long, mozilla::TimeStamp) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#61 0x00007ffff348dc4c in mozilla::RefreshDriverTimer::Tick() ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#62 0x00007ffff403477f in nsTimerImpl::Fire() ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#63 0x00007ffff403484d in nsTimerEvent::Run() ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#64 0x00007ffff4031868 in nsThread::ProcessNextEvent(bool, bool*) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#65 0x00007ffff400309d in NS_ProcessNextEvent(nsIThread*, bool) ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#66 0x00007ffff3d61d84 in
mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) () from
/usr/lib64/firefox/xulrunner/libxul.so
#67 0x00007ffff4057a91 in MessageLoop::Run() ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#68 0x00007ffff3cbbd31 in nsBaseAppShell::Run() ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#69 0x00007ffff3b88e23 in nsAppStartup::Run() ()
---Type <return> to continue, or q <return> to quit---
   from /usr/lib64/firefox/xulrunner/libxul.so
#70 0x00007ffff3272a8f in XREMain::XRE_mainRun() ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#71 0x00007ffff3272d12 in XREMain::XRE_main(int, char**, nsXREAppData const*)
    () from /usr/lib64/firefox/xulrunner/libxul.so
#72 0x00007ffff3272f83 in XRE_main ()
   from /usr/lib64/firefox/xulrunner/libxul.so
#73 0x0000000000403bc1 in do_main(int, char**, nsIFile*) ()
#74 0x00000000004033cf in main ()
(gdb) quit


Version-Release number of selected component (if applicable):
2.10.94-1.fc20

How reproducible:
always

Steps to Reproduce:
1. firefox starts
2. connect to http://start.fedoraproject.org/
3.

Actual results:


Expected results:


Additional info:
firefox-23.0.1-3.fc20.x86_64
xulrunner-23.0.1-1.fc20.x86_64

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=BYIVT5FEik&a=cc_unsubscribe

[Bug 1003069] After updating to 2.10.94-1.fc20, firefox always crashes in http://start.fedoraproject.org/.

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1003069

Akira TAGOH <tagoh(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
   Fixed In Version|                            |fontconfig-2.10.95-1.fc20
         Resolution|---                         |RAWHIDE
        Last Closed|                            |2013-08-30 22:23:41



--- Comment #1 from Akira TAGOH <tagoh(a)redhat.com&gt; ---
fixed in 2.10.95-1.fc20

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=6udhTTnfXr&a=cc_unsubscribe