[Bug 1053798] [abrt] gimp: pango_ot_info_get(): gimp-2.8 killed by SIGSEGV

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1053798

Nils Philippsen  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]
                   |                            |ect.org,
                   |                            |[e-mail]
                   |                            |ct.org, [e-mail]
          Component|gimp                        |pango
           Assignee|[e-mail]         |[e-mail]

--- Comment #12 from Nils Philippsen  ---
This bug exists in older Fedora releases as well:

Fedora 19: bug #990653
Fedora 18: bug #948292

I'm mentioning the latter because there's a comment in it mentioning that it
only happens with specific fonts:

"Emmett Culley 2013-08-19 22:10:36 EDT

I found that is crashes when a stix font is either selected or even appears in
the scroll window.

Gimp no longer crashes after removing the stix fonts from my system ."

The issue seems to be in pango, here's part of the backtrace:

--- 8< ---
Thread 1 (Thread 0xb35bf880 (LWP 5239)):
#0  pango_ot_info_get (face=face@entry=0x0) at pango-ot-info.c:91
        _g_boolean_var_ = <optimized out>
        info = <optimized out>
#1  0xb755798f in gimp_font_get_sample_string (font_desc=0xbab60f00,
context=<optimized out>) at gimpfont.c:641
        font = 0xba301600
        tt = <optimized out>
        ot_alts = {-1233602475, -1162584064, -1238862369, -1233954773}
        os2 = <optimized out>
        n_sr_alts = 0
        face = 0x0
--- >8 ---

Notably, font is not NULL but face is. Here's the corresponding GIMP source
code (frame #1):

--- 8< --- app/text/gimpfont.c:636 -----------------------
  font = pango_context_load_font (context, font_desc);

g_return_val_if_fail (PANGO_IS_FC_FONT (font), "Aa");

face = pango_fc_font_lock_face (PANGO_FC_FONT (font));
  ot_info = pango_ot_info_get (face);
--- >8 ---------------------------------------------------

I.e. font is the result of pango_context_load_font(), is a valid FcFont object,
but the face returned by pango_fc_font_lock_face() is NULL which subsequently
lets pango_ot_info_get() crash. Changing component accordingly.