506135 - Crash [@ gfxPangoFcFont::GfxFont] at start up

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[adrian]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2a1pre) Gecko/20090703 Minefield/3.6a1pre
Build Identifier: 20090723031317  Linux

Firefox crashes before starting.
firefox -profilemanager crashes, so it happens before a profile is loaded.

Reproducible: Always

Steps to Reproduce:
1. start firefox
Actual Results:  
The following error messages come out on the console
(crashreporter:6328): Gtk-CRITICAL **: gtk_widget_set_sensitive: assertion `GTK_IS_WIDGET (widget)' failed
(firefox-bin:6341): GLib-GObject-WARNING **: IA__g_object_set_valist: construct property "fontmap" for object `gfxPangoFcFont' can't be set after construction
(firefox-bin:6341): Pango-WARNING **: failed to choose a font, expect ugly output. engine-type='PangoRenderFc', script='latin'
(crashreporter:6348): Gtk-CRITICAL **: gtk_widget_set_sensitive: assertion `GTK_IS_WIDGET (widget)' failed

And a crash.

Expected Results:  
Firefox starts.

http://crash-stats.mozilla.com/report/index/1a9875ca-87ed-4a00-8d9c-6706f2090723
http://crash-stats.mozilla.com/report/index/10d53da6-9b7d-423c-a306-693552090723

Regression range
Nightly prior to does not crash but 20090723031317 crashes

Caused by check in for Bug 487971?

Comment 1

[timeless]

Signature	gfxPangoFcFont::GfxFont(gfxPangoFcFont*)
UUID	1a9875ca-87ed-4a00-8d9c-6706f2090723
Time 	2009-07-23 15:47:59.339567
Uptime	7
Last Crash	182766 seconds before submission
Product	Firefox
Version	3.6a1pre
Build ID	20090723031317
Branch	1.9.2
OS	Linux
OS Version	0.0.0 Linux 2.6.20 #1 PREEMPT Fri Apr 27 12:42:16 PDT 2007 i686 GNU/Linux
CPU	x86
CPU Info	AuthenticAMD family 1 model 12 stepping 0
Crash Reason	SIGSEGV
Crash Address	0xb7c34aa9
User Comments	
Processor Notes 	
Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	libxul.so 	gfxPangoFcFont::GfxFont 	gfx/thebes/src/gfxPangoFonts.cpp:672
1 	libxul.so 	gfxPangoFontGroup::CreateGlyphRunsItemizing 	gfx/thebes/src/gfxPangoFonts.cpp:3557
2 	libxul.so 	gfxPangoFontGroup::InitTextRun 	gfx/thebes/src/gfxPangoFonts.cpp:2900
3 	libxul.so 	gfxPangoFontGroup::MakeTextRun 	gfx/thebes/src/gfxPangoFonts.cpp:2879
4 	libxul.so 	TextRunWordCache::MakeTextRun 	gfx/thebes/src/gfxTextRunWordCache.cpp:683
5 	libxul.so 	gfxTextRunWordCache::MakeTextRun 	gfx/thebes/src/gfxTextRunWordCache.cpp:992
6 	libxul.so 	gfxTextRunCache::MakeTextRun 	gfx/thebes/src/gfxTextRunCache.cpp:89
7 	libxul.so 	nsThebesFontMetrics::AutoTextRun::AutoTextRun 	gfx/src/thebes/nsThebesFontMetrics.h:171
8 	libxul.so 	nsThebesFontMetrics::GetWidth 	gfx/src/thebes/nsThebesFontMetrics.cpp:338
9 	libxul.so 	nsThebesRenderingContext::GetWidthInternal 	gfx/src/thebes/nsThebesRenderingContext.cpp:1305
10 	libxul.so 	nsThebesRenderingContext::GetWidth 	gfx/src/thebes/nsThebesRenderingContext.cpp:930
11 	libxul.so 	nsLayoutUtils::GetStringWidth 	layout/base/nsLayoutUtils.cpp:2490
12 	libxul.so 	nsTextBoxFrame::GetTextSize 	layout/xul/base/src/nsTextBoxFrame.cpp:985
13 	libxul.so 	nsTextBoxFrame::CalcTextSize 	layout/xul/base/src/nsTextBoxFrame.cpp:999
14 	libxul.so 	nsTextBoxFrame::GetBoxAscent 	layout/xul/base/src/nsTextBoxFrame.cpp:1078
15 	libxul.so 	nsSprocketLayout::GetAscent 	layout/xul/base/src/nsSprocketLayout.cpp:1525
16 	libxul.so 	nsBoxFrame::GetBoxAscent 	layout/xul/base/src/nsBoxFrame.cpp:846
17 	libxul.so 	nsSprocketLayout::GetAscent 	layout/xul/base/src/nsSprocketLayout.cpp:1525
18 	libxul.so 	nsBoxFrame::GetBoxAscent 	layout/xul/base/src/nsBoxFrame.cpp:846
19 	libxul.so 	nsSprocketLayout::GetAscent 	layout/xul/base/src/nsSprocketLayout.cpp:1525
20 	libxul.so 	nsBoxFrame::GetBoxAscent 	layout/xul/base/src/nsBoxFrame.cpp:846

Comment 2

[adrian]

Regression range via hourly builds:
1248312596-20090722182956-a55505d20efd crashes
1248306466-20090722164746-9f11f584896f works 

I did a local build from tip which does not crash, but the approximate equivalent hourly does crash.

Comment 3

[Karl Tomlinson (:karlt)]

Attachment: use fontmap property on PangoFcFont only from Pango-1.24.4

(In reply to comment #0)
> (firefox-bin:6341): GLib-GObject-WARNING **: IA__g_object_set_valist: construct
> property "fontmap" for object `gfxPangoFcFont' can't be set after construction

Thanks, this is where things are starting to go wrong.
Pango-1.24.0 only allows the "fontmap" property to be set during construction of the PangoFcFont.

This was changed for Pango-1.24.1 in response to
https://bugzilla.gnome.org/show_bug.cgi?id=578336

However, setting the fontmap in the constructor won't be good enough because there is another issue.

When the fontmap property was added, it added weak references to the fontmap for each font, but these weak references were never removed when the font was destroyed.

http://git.gnome.org/cgit/pango/commit/?id=9305b9a9995e84ace3818a90346820ef8c47a3ce

This was corrected in Pango-1.24.4
http://bugzilla.gnome.org/show_bug.cgi?id=586814#c6
http://git.gnome.org/cgit/pango/commit/?id=643b70644aabdbebd6bdfe7a5f128efde39caced

So we're better off not using the fontmap property until Pango-1.24.4.
FWIW we're not the only people having to check which version of Pango we're using:
http://cvs.schmorp.de/deliantra/Deliantra-Client/pango-font.c?r1=1.3&r2=1.4

Comment 4

[Karl Tomlinson (:karlt)]

http://hg.mozilla.org/mozilla-central/rev/01ffe3325715