201679 - crash on pages using some fonts (xft)

Status: RESOLVED DUPLICATE of bug 180309

(Core Graveyard :: GFX: Gtk, defect)

Description

[Thomas Kruse]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3) Gecko/20030327 Debian/1.3-4
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3) Gecko/20030327 Debian/1.3-4

I have the a crash-problem with http://www.php.net/manual/en/
I tracked it down to the font "Courier" - if I change the stylesheet to C1ourier
or delete the courier font completely, everything is fine.
System is Debian, unstable, mozilla with xft installed.

Reproducible: Always

Steps to Reproduce:
1. load the page
2. if that does not crash mozilla, scroll down

Actual Results:  
mozilla dies after eating 100% cpu time for a few seconds

Expected Results:  
I would like to view that page. and some others, that crash, too.

This guy may have the same problem: #193639, and some bug reports in the debian
bug tracking system indicate that I am not alone.

Comment 1

[Christopher Blizzard (:blizzard)]

Do you have any .fon fonts in your path (bug 180309) or anything fonts in your
path that you can't read (bug 183729)?

Comment 2

[Thomas Kruse]

No, no .fon files and the chmod was kind of obvious after the copied true type
fonts did not work :) (ops, forgot to mention, that I have some truetype fonts
installed) But I forget to meantion the following:
If I unset "allow websites to use other fonts", the crash does not happen.
(sound logical)
Something really weird happened, when I tried to remove the "Courier" fonts from
my system (for mozilla I'll sacrifice it, when neccessary) - the font is
unavailable in nearly every application (sure, I removed every font that looks
like courier, the alias for courier, too) except mozilla and gedit: "Courier
New" "Courier BT", "Courier".
Perhaps I've overseen the font file, but gtkfontsel does not show it, gedit and
mozilla both have it magically. Any hints to track that down?

Comment 3

[Thomas Kruse]

okay, xft looks for fonts even one level up from /usr/share/fonts/truetype/ -
sorry. No courier is really gone. but mozilla still crashes on that page - strange!
If I download the page, change the stylesheet and remove courier, it works. I am
really  puzzled now.

Comment 4

[Christopher Blizzard (:blizzard)]

Can you get a stack trace for me?

Comment 5

[Thomas Kruse]

I tried with mozilla --debug --debugger=gdb, but I did not get into gdb nor a
stacktrace. (I am not that expirienced with debugging as you might have guessed
by now.)
I addition to that I must confess that after rebooting the linux machine the
crash disappeared until a copied the courier.ttf fonts back to the truetype
directory. Perhaps something is broken with the font files or the xft library,
but I can't tell you :-(
Would it be of any help, if I attach the fonts in question or send them to you
via private mail.

Comment 6

[Andrew Schultz]

> I tried with mozilla --debug --debugger=gdb

% mozilla --sync &
% ps u -C mozilla-bin
% gdb _path_to_mozilla_/mozilla-bin _pid_of_mozilla_
(gdb) b abort
(gdb) b exit
(gdb) cont
[make Mozilla crash]
(gdb) bt

> crash disappeared until a copied the courier.ttf fonts back

does the courier.ttf have read permission?

ls -l courier.ttf

Comment 7

[Thomas Kruse]

alright - here it is. (debian mozilla seams to be stripped of debugging symbols,
though - sorry)

(no debugging symbols found)...done.
Loaded symbols for /usr/lib/mozilla/components/libtxmgr.so
0x406312c0 in poll () from /lib/libc.so.6
(gdb) 
(gdb) b abort
Breakpoint 1 at 0x4059c8c0
(gdb) b exit
Breakpoint 2 at 0x4059d81e
(gdb) cont
Continuing.
[New Thread 98308 (LWP 15351)]
[New Thread 114694 (LWP 15352)] 

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 16384 (LWP 15329)]
0x40b43bd8 in NSGetModule () from /usr/lib/mozilla/components/libgklayout.so
(gdb) 

#0  0x40b43bd8 in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#1  0x40b43d02 in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#2  0x40b43df1 in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#3  0x40b275dc in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#4  0x40b1e848 in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#5  0x40b26943 in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#6  0x40b21944 in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#7  0x40b209df in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#8  0x40b20566 in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#9  0x40b1e8dd in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#10 0x40b2d277 in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#11 0x40b3fe4a in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#12 0x40c0ba77 in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#13 0x40c0b6e5 in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#14 0x40c08624 in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#15 0x40bfe2fa in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#16 0x40c08624 in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#17 0x40c0d991 in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#18 0x40b3c301 in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#19 0x40b3c5af in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#20 0x40b3c345 in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#21 0x40c08624 in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#22 0x40c1affb in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#23 0x40b3b84b in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#24 0x40b2d277 in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#25 0x40b867d6 in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#26 0x40b652ff in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#27 0x40b71172 in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#28 0x40b729b0 in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#29 0x40b70d53 in NSGetModule ()
   from /usr/lib/mozilla/components/libgklayout.so
#30 0x408dd363 in PL_HandleEvent () from /usr/lib/mozilla/libxpcom.so
#31 0x408dd27d in PL_ProcessPendingEvents () from
/usr/lib/mozilla/libxpcom.so
#32 0x408de39f in nsEventQueueImpl::ProcessPendingEvents() ()
   from /usr/lib/mozilla/libxpcom.so
#33 0x410a775a in nsBaseWidget::ConvertToDeviceCoordinates(int&, int&) ()
   from /usr/lib/mozilla/components/libwidget_gtk2.so
#34 0x40484087 in g_vsnprintf () from /usr/lib/libglib-2.0.so.0
#35 0x4046744f in g_get_current_time () from /usr/lib/libglib-2.0.so.0
#36 0x40468369 in g_main_context_dispatch () from
/usr/lib/libglib-2.0.so.0#37 0x4046866f in g_main_context_dispatch () from
/usr/lib/libglib-2.0.so.0
#38 0x40468cbe in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#39 0x401dec97 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#40 0x410a7b34 in nsAppShell::Run() ()
   from /usr/lib/mozilla/components/libwidget_gtk2.so
#41 0x410789a6 in NSGetModule ()
   from /usr/lib/mozilla/components/libnsappshell.so
#42 0x08057baf in getCountry(nsAString const&, nsAString&) ()
#43 0x08058231 in main ()
#44 0x4058aa51 in __libc_start_main () from /lib/libc.so.6

the fonts in question (don't kill me, they're from a true-type cd and I know
it's redundant stuff :) )
total 1812
-rw-r--r--    1 root     root       105308 Apr  7 15:25 COUR.TTF
-rw-r--r--    1 root     root        90704 Apr  7 15:25 COURBD.TTF
-rw-r--r--    1 root     root        90988 Apr  7 15:25 COURBI.TTF
-rw-r--r--    1 root     root        23424 Apr  7 15:25 COURE.FON
-rw-r--r--    1 root     root        31744 Apr  7 15:25 COURF.FON
-rw-r--r--    1 root     root        88504 Apr  7 15:25 COURI.TTF
-r--r--r--    1 root     root        24416 Apr  7 15:26 COU_____.TTF
-rw-r--r--    1 root     root        52000 Apr  7 15:25 CUR10PBI.TTF
-rw-r--r--    1 root     root        57168 Apr  7 15:25 CUR10PTB.TTF
-rw-r--r--    1 root     root        51924 Apr  7 15:25 CUR10PTI.TTF
-rw-r--r--    1 root     root        54272 Apr  7 15:25 CUR10PTN.TTF
-rw-r--r--    1 root     root       174596 Apr  7 15:25 Courb.ttf
-rw-r--r--    1 root     root       180160 Apr  7 15:25 Courz.ttf
-rw-r--r--    1 root     root       180288 Apr  7 15:25 cour.ttf
-rw-r--r--    1 root     root       181388 Apr  7 15:25 courbd.ttf
-rw-r--r--    1 root     root       186412 Apr  7 15:25 courbi.ttf
-rw-r--r--    1 root     root       195104 Apr  7 15:25 couri.ttf

Comment 8

[Andrew Schultz]

>  -rw-r--r--    1 root     root        23424 Apr  7 15:25 COURE.FON
>  -rw-r--r--    1 root     root        31744 Apr  7 15:25 COURF.FON

dupe of "Xft Crash while loading page with MS .fon font [@ GetNormalLineHeight]"
(crashes in layout)

*** This bug has been marked as a duplicate of 180309 ***