238619 - font-size: 0; Mozilla crashes after showing the title line [@ nsFontMetricsGTK::RealizeFont]

Status: RESOLVED FIXED

(Core Graveyard :: GFX: Gtk, defect)

Description

[Joachim]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; de-AT; rv:1.7b) Gecko/20040316
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; de-AT; rv:1.7b) Gecko/20040316

Cannot access fedora.redhat.com

Reproducible: Always
Steps to Reproduce:
1. go to that url
2.
3.

Actual Results:  
crash of Mozilla

Expected Results:  
show the page :-;

No problem on WIn32!
Maybe the source of problem, that I have SuSE 8.0, gcc version 2.95.3 20010315
(SuSE).

Comment 1

[Joachim]

I just tried to dubug it a little bit:

(no debugging symbols found)...
Program received signal SIGFPE, Arithmetic exception.
[Switching to Thread 1024 (LWP 20494)]
0x41095e0d in NSGetModule () from /opt/mozilla-1.7b/components/libgfx_gtk.so
(gdb)
============
other users on my machine can access the page!!
So it seems to be a problem from "left overs" in my .mozilla.

Comment 2

[R.K.Aa.]

Is it an xft build? do you have any *.fon files in your ~/.fonts dir? (bug 180309)

Comment 3

[Joachim]

(In reply to comment #2)
> Is it an xft build? do you have any *.fon files in your ~/.fonts dir? (bug 180309)

I do not have gtk2
There is no  ~/.font*
I think it is no xft:
ldd /opt/mozilla/mozilla-bin
        libmozjs.so => not found
        libplds4.so => not found
        libplc4.so => not found
        libnspr4.so => not found
        libpthread.so.0 => /lib/libpthread.so.0 (0x40035000)
        libdl.so.2 => /lib/libdl.so.2 (0x4004b000)
        libgtk-1.2.so.0 => /usr/lib/libgtk-1.2.so.0 (0x4004f000)
        libgdk-1.2.so.0 => /usr/lib/libgdk-1.2.so.0 (0x40202000)
        libgmodule-1.2.so.0 => /usr/lib/libgmodule-1.2.so.0 (0x40244000)
        libglib-1.2.so.0 => /usr/lib/libglib-1.2.so.0 (0x40248000)
        libXi.so.6 => /usr/X11R6/lib/libXi.so.6 (0x4026c000)
        libXext.so.6 => /usr/X11R6/lib/libXext.so.6 (0x40274000)
        libX11.so.6 => /usr/X11R6/lib/libX11.so.6 (0x40282000)
        libm.so.6 => /lib/libm.so.6 (0x40342000)
        libc.so.6 => /lib/libc.so.6 (0x40365000)
        /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)

This crash is only for ONE USER
There seems to be a problem in the local data:
  removing ~/.mozilla fixes the problem!
How to get the files to remove?
Are these leftover from older installations or plugins?

Comment 4

[Joachim]

This bug is triggert by prefs.js:
Add:
user_pref("font.scale.aa_bitmap.always", true);


And this bug ist triggert

Comment 5

[Andrew Schultz]

worksforme with linux trunk 2004040408, even with the AASB pref set.

Comment 6

[Tuukka Tolvanen (sp3000)]

Reporter, if bug 239654 and this one only occur under identical circumstances
(except for url) you might want to mark one as duplicate of the other

Comment 7

[Joachim]

Attachment: Here is my GDB output

Comment 8

[Joachim]

I was sad on this funny thing. So I downloaded the pages from fedora.redhad.com:
/css/content.css  /css/docbook.css  index.html  /css/layout.css
and changed a little bit the css.
The source of the touble is fixed by:
rh-fedora> diff layout.css*
3a4
>       /* nofont-family: arial; */
100c101
<       font-size: 0;
---
>       font-size: 0.1;

So my system does not like the "font-size: 0;"
Hope this helps a little bit

Comment 9

[Tuukka Tolvanen (sp3000)]

Joachim, if you could make a single-file testcase that has the minimum amount of
markup with which you crash, and attach that to this bug, that would be helpful

Comment 10

[Joachim]

Attachment: index.html calls layout.css, kill my mozilla 1.7

Loading this index.html will crash my Mozilla 1.7 final

Comment 11

[Andrew Schultz]

#0  0xb663efd8 in nsFontMetricsGTK::RealizeFont (this=0x877cef0)
    at nsFontMetricsGTK.cpp:1818
#1  0xb663ee82 in nsFontMetricsGTK::Init (this=0x877cef0, aFont=@0x87db9ec, 
    aLangGroup=0x83a2178, aContext=0x851aea8) at nsFontMetricsGTK.cpp:1704
#2  0xb788d076 in nsFontCache::GetMetricsFor ()
    from /build/andrew/gtk1/mozilla/dist/bin/libgkgfx.so

nsFontMetricsGTK.cpp:
1818  mEmAscent = nscoord(mMaxAscent * mEmHeight / lineSpacing);
both mMaxAscent and lineSpacing are 0.

Comment 12

[Andrew Schultz]

Attachment: patch

this bandaid doesn't give me a warm fuzzy feeling, but does fix the crash and
can't have adverse side-effects.

also, mEmHeight is only non-zero because it's forced to be (line 1806).

Comment 13

[Andrew Schultz]

Comment on attachment 182305 [details] [diff] [review]
patch

zero risk crash fix

Comment 14

[chris hofmann]

Comment on attachment 182305 [details] [diff] [review]
patch

a=chofmann

Comment 15

[Andrew Schultz]

fixed