https://bugzilla.redhat.com/show_bug.cgi?id=1003069

Bug ID: 1003069 Summary: After updating to 2.10.94-1.fc20, firefox always crashes in http://start.fedoraproject.org/. Product: Fedora Version: 20 Component: fontconfig Severity: urgent Assignee: tagoh@redhat.com Reporter: sangu.fedora@gmail.com QA Contact: extras-qa@fedoraproject.org CC: fonts-bugs@lists.fedoraproject.org, i18n-bugs@lists.fedoraproject.org, pnemade@redhat.com, tagoh@redhat.com

Description of problem: $ firefox -g -d gdb Program received signal SIGSEGV, Segmentation fault. 0x000000000040e315 in jemalloc_crash () (gdb) bt #0 0x000000000040e315 in jemalloc_crash () #1 0x000000000040fd78 in arena_dalloc () #2 0x00007fffefb8899b in FcValueListDestroy (l=0x7ffff5405f60) at fcpat.c:151 #3 0x00007fffefb88e22 in IA__FcPatternDestroy (p=0x7fffbc48d5c0) at fcpat.c:376 #4 0x00007ffff408f187 in gfxFcFont::GetOrMakeFont(_FcPattern*, _FcPattern*, gfxFontStyle const*) () from /usr/lib64/firefox/xulrunner/libxul.so #5 0x00007ffff408f422 in gfxFcFontSet::GetFontAt(unsigned int, gfxFontStyle const*) () from /usr/lib64/firefox/xulrunner/libxul.so #6 0x00007ffff40910a0 in gfxPangoFontGroup::GetBaseFont() () from /usr/lib64/firefox/xulrunner/libxul.so #7 0x00007ffff407d972 in void gfxFontGroup::InitScriptRun<unsigned char>(gfxContext*, gfxTextRun*, unsigned char const*, unsigned int, unsigned int, int) () from /usr/lib64/firefox/xulrunner/libxul.so #8 0x00007ffff407e7d1 in void gfxFontGroup::InitTextRun<unsigned char>(gfxContext*, gfxTextRun*, unsigned char const*, unsigned int) () from /usr/lib64/firefox/xulrunner/libxul.so #9 0x00007ffff407e8b6 in gfxFontGroup::MakeTextRun(unsigned char const*, unsigned int, gfxTextRunFactory::Parameters const*, unsigned int) () from /usr/lib64/firefox/xulrunner/libxul.so #10 0x00007ffff34fe286 in BuildTextRunsScanner::BuildTextRunForFrames(void*) () ---Type <return> to continue, or q <return> to quit--- from /usr/lib64/firefox/xulrunner/libxul.so #11 0x00007ffff34fe71a in BuildTextRunsScanner::FlushFrames(bool, bool) () from /usr/lib64/firefox/xulrunner/libxul.so #12 0x00007ffff34fe906 in BuildTextRunsScanner::ScanFrame(nsIFrame*) () from /usr/lib64/firefox/xulrunner/libxul.so #13 0x00007ffff34fed5a in BuildTextRuns(gfxContext*, nsTextFrame*, nsIFrame*, nsLineList_iterator const*, nsTextFrame::TextRunType) () from /usr/lib64/firefox/xulrunner/libxul.so #14 0x00007ffff34fef6d in nsTextFrame::EnsureTextRun(nsTextFrame::TextRunType, gfxContext*, nsIFrame*, nsLineList_iterator const*, unsigned int*) () from /usr/lib64/firefox/xulrunner/libxul.so #15 0x00007ffff35038f0 in nsTextFrame::AddInlineMinWidthForFlow(nsRenderingContext*, nsIFrame::InlineMinWidthData*, nsTextFrame::TextRunType) () from /usr/lib64/firefox/xulrunner/libxul.so #16 0x00007ffff3503e5b in nsTextFrame::AddInlineMinWidth(nsRenderingContext*, nsIFrame::InlineMinWidthData*) () from /usr/lib64/firefox/xulrunner/libxul.so #17 0x00007ffff34b0d31 in nsBlockFrame::GetMinWidth(nsRenderingContext*) () from /usr/lib64/firefox/xulrunner/libxul.so #18 0x00007ffff346f46c in nsLayoutUtils::IntrinsicForContainer(nsRenderingContext*, nsIFrame*, nsLayoutUtils::IntrinsicWidthType) () from /usr/lib64/firefox/xulrunner/libxul.so ---Type <return> to continue, or q <return> to quit--- #19 0x00007ffff34e8042 in nsPlaceholderFrame::AddInlineMinWidth(nsRenderingContext*, nsIFrame::InlineMinWidthData*) () from /usr/lib64/firefox/xulrunner/libxul.so #20 0x00007ffff34b0d31 in nsBlockFrame::GetMinWidth(nsRenderingContext*) () from /usr/lib64/firefox/xulrunner/libxul.so #21 0x00007ffff34bcdb8 in nsFrame::ShrinkWidthToFit(nsRenderingContext*, int) () from /usr/lib64/firefox/xulrunner/libxul.so #22 0x00007ffff34b631a in nsContainerFrame::ComputeAutoSize(nsRenderingContext*, nsSize, int, nsSize, nsSize, nsSize, bool) () from /usr/lib64/firefox/xulrunner/libxul.so #23 0x00007ffff34bba75 in nsFrame::ComputeSize(nsRenderingContext*, nsSize, int, nsSize, nsSize, nsSize, unsigned int) () from /usr/lib64/firefox/xulrunner/libxul.so #24 0x00007ffff34b1834 in FloatMarginWidth(nsHTMLReflowState const&, int, nsIFrame*, nsCSSOffsetState const&) () from /usr/lib64/firefox/xulrunner/libxul.so #25 0x00007ffff34b2290 in nsBlockReflowState::FlowAndPlaceFloat(nsIFrame*) () from /usr/lib64/firefox/xulrunner/libxul.so #26 0x00007ffff34b29ca in nsBlockReflowState::AddFloat(nsLineLayout*, nsIFrame*, int) () from /usr/lib64/firefox/xulrunner/libxul.so #27 0x00007ffff34e27ab in nsLineLayout::ReflowFrame(nsIFrame*, unsigned int&, nsHTMLReflowMetrics*, bool&) () from /usr/lib64/firefox/xulrunner/libxul.so ---Type <return> to continue, or q <return> to quit--- #28 0x00007ffff34a9c2b in nsBlockFrame::ReflowInlineFrame(nsBlockReflowState&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*) () from /usr/lib64/firefox/xulrunner/libxul.so #29 0x00007ffff34af319 in nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool) () from /usr/lib64/firefox/xulrunner/libxul.so #30 0x00007ffff34af4fc in nsBlockFrame::ReflowInlineFrames(nsBlockReflowState&, nsLineList_iterator, bool*) () from /usr/lib64/firefox/xulrunner/libxul.so #31 0x00007ffff34afbc8 in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&) () from /usr/lib64/firefox/xulrunner/libxul.so #32 0x00007ffff34b044f in nsBlockFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) () from /usr/lib64/firefox/xulrunner/libxul.so #33 0x00007ffff34b1506 in nsBlockReflowContext::ReflowBlock(nsRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, nsHTMLReflowState&, unsigned int&, nsBlockReflowState&) () from /usr/lib64/firefox/xulrunner/libxul.so #34 0x00007ffff34adb32 in nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&, nsLineList_iterator, bool*) () from /usr/lib64/firefox/xulrunner/libxul.so #35 0x00007ffff34afbc8 in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&) () from /usr/lib64/firefox/xulrunner/libxul.so ---Type <return> to continue, or q <return> to quit--- #36 0x00007ffff34b044f in nsBlockFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) () from /usr/lib64/firefox/xulrunner/libxul.so #37 0x00007ffff34b1506 in nsBlockReflowContext::ReflowBlock(nsRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, nsHTMLReflowState&, unsigned int&, nsBlockReflowState&) () from /usr/lib64/firefox/xulrunner/libxul.so #38 0x00007ffff34adb32 in nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&, nsLineList_iterator, bool*) () from /usr/lib64/firefox/xulrunner/libxul.so #39 0x00007ffff34afbc8 in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&) () from /usr/lib64/firefox/xulrunner/libxul.so #40 0x00007ffff34b044f in nsBlockFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) () from /usr/lib64/firefox/xulrunner/libxul.so #41 0x00007ffff34b1506 in nsBlockReflowContext::ReflowBlock(nsRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, nsHTMLReflowState&, unsigned int&, nsBlockReflowState&) () from /usr/lib64/firefox/xulrunner/libxul.so #42 0x00007ffff34adb32 in nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&, nsLineList_iterator, bool*) () from /usr/lib64/firefox/xulrunner/libxul.so #43 0x00007ffff34afbc8 in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&) () from /usr/lib64/firefox/xulrunner/libxul.so #44 0x00007ffff34b044f in nsBlockFrame::Reflow(nsPresContext*, nsHTMLReflowMetri---Type <return> to continue, or q <return> to quit--- cs&, nsHTMLReflowState const&, unsigned int&) () from /usr/lib64/firefox/xulrunner/libxul.so #45 0x00007ffff34b1506 in nsBlockReflowContext::ReflowBlock(nsRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, nsHTMLReflowState&, unsigned int&, nsBlockReflowState&) () from /usr/lib64/firefox/xulrunner/libxul.so #46 0x00007ffff34adb32 in nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&, nsLineList_iterator, bool*) () from /usr/lib64/firefox/xulrunner/libxul.so #47 0x00007ffff34afbc8 in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&) () from /usr/lib64/firefox/xulrunner/libxul.so #48 0x00007ffff34b044f in nsBlockFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) () from /usr/lib64/firefox/xulrunner/libxul.so #49 0x00007ffff34b7367 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned int, unsigned int&, nsOverflowContinuationTracker*) () from /usr/lib64/firefox/xulrunner/libxul.so #50 0x00007ffff34d5560 in nsCanvasFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) () from /usr/lib64/firefox/xulrunner/libxul.so #51 0x00007ffff34b7367 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned int, unsig---Type <return> to continue, or q <return> to quit--- ned int&, nsOverflowContinuationTracker*) () from /usr/lib64/firefox/xulrunner/libxul.so #52 0x00007ffff34cc356 in nsHTMLScrollFrame::ReflowScrolledFrame(ScrollReflowState*, bool, bool, nsHTMLReflowMetrics*, bool) () from /usr/lib64/firefox/xulrunner/libxul.so #53 0x00007ffff34cdf6b in nsHTMLScrollFrame::ReflowContents(ScrollReflowState*, nsHTMLReflowMetrics const&) () from /usr/lib64/firefox/xulrunner/libxul.so #54 0x00007ffff34d3895 in nsHTMLScrollFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) () from /usr/lib64/firefox/xulrunner/libxul.so #55 0x00007ffff34b7367 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned int, unsigned int&, nsOverflowContinuationTracker*) () from /usr/lib64/firefox/xulrunner/libxul.so #56 0x00007ffff35088ab in ViewportFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) () from /usr/lib64/firefox/xulrunner/libxul.so #57 0x00007ffff34849bb in PresShell::DoReflow(nsIFrame*, bool) () from /usr/lib64/firefox/xulrunner/libxul.so #58 0x00007ffff3486231 in PresShell::ProcessReflowCommands(bool) () from /usr/lib64/firefox/xulrunner/libxul.so ---Type <return> to continue, or q <return> to quit--- #59 0x00007ffff348a345 in PresShell::FlushPendingNotifications(mozilla::ChangesToFlush) () from /usr/lib64/firefox/xulrunner/libxul.so #60 0x00007ffff348d88d in nsRefreshDriver::Tick(long, mozilla::TimeStamp) () from /usr/lib64/firefox/xulrunner/libxul.so #61 0x00007ffff348dc4c in mozilla::RefreshDriverTimer::Tick() () from /usr/lib64/firefox/xulrunner/libxul.so #62 0x00007ffff403477f in nsTimerImpl::Fire() () from /usr/lib64/firefox/xulrunner/libxul.so #63 0x00007ffff403484d in nsTimerEvent::Run() () from /usr/lib64/firefox/xulrunner/libxul.so #64 0x00007ffff4031868 in nsThread::ProcessNextEvent(bool, bool*) () from /usr/lib64/firefox/xulrunner/libxul.so #65 0x00007ffff400309d in NS_ProcessNextEvent(nsIThread*, bool) () from /usr/lib64/firefox/xulrunner/libxul.so #66 0x00007ffff3d61d84 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) () from /usr/lib64/firefox/xulrunner/libxul.so #67 0x00007ffff4057a91 in MessageLoop::Run() () from /usr/lib64/firefox/xulrunner/libxul.so #68 0x00007ffff3cbbd31 in nsBaseAppShell::Run() () from /usr/lib64/firefox/xulrunner/libxul.so #69 0x00007ffff3b88e23 in nsAppStartup::Run() () ---Type <return> to continue, or q <return> to quit--- from /usr/lib64/firefox/xulrunner/libxul.so #70 0x00007ffff3272a8f in XREMain::XRE_mainRun() () from /usr/lib64/firefox/xulrunner/libxul.so #71 0x00007ffff3272d12 in XREMain::XRE_main(int, char**, nsXREAppData const*) () from /usr/lib64/firefox/xulrunner/libxul.so #72 0x00007ffff3272f83 in XRE_main () from /usr/lib64/firefox/xulrunner/libxul.so #73 0x0000000000403bc1 in do_main(int, char**, nsIFile*) () #74 0x00000000004033cf in main () (gdb) quit

Version-Release number of selected component (if applicable): 2.10.94-1.fc20

How reproducible: always

Steps to Reproduce: 1. firefox starts 2. connect to http://start.fedoraproject.org/ 3.

Actual results:

Expected results:

Additional info: firefox-23.0.1-3.fc20.x86_64 xulrunner-23.0.1-1.fc20.x86_64