netbook-launcher crashed with SIGSEGV in clutter_actor_get_preferred_width()

[Matthew Lancey]

Binary package hint: netbook-launcher

Crash occurred just after switching from netbook interface to normal ubuntu desktop layout

ProblemType: Crash
Architecture: i386
CrashCounter: 1
Date: Sun Aug 30 18:20:29 2009
DistroRelease: Ubuntu 9.10
ExecutablePath: /usr/bin/netbook-launcher
Package: netbook-launcher 2.1.5-0ubuntu2
ProcCmdline: netbook-launcher
ProcEnviron:
 LANG=en_AU.UTF-8
 SHELL=/bin/bash
ProcVersionSignature: Ubuntu 2.6.31-8.28-generic
SegvAnalysis:
 Segfault happened at: 0x2de208: testb $0x8,0x35(%ecx)
 PC (0x002de208) ok
 source "$0x8" ok
 destination "0x35(%ecx)" (0xaaaaaadf) not located in a known VMA region (needed writable region)!
SegvReason: writing unknown VMA
Signal: 11
SourcePackage: netbook-launcher
StacktraceTop:
 ?? () from /usr/lib/libpango-1.0.so.0
 ?? () from /usr/lib/libclutter-glx-1.0.so.0
 clutter_actor_get_preferred_width ()
 clutter_actor_get_width ()
 clutter_actor_get_size ()
Tags: ubuntu-unr
Title: netbook-launcher crashed with SIGSEGV in clutter_actor_get_preferred_width()
Uname: Linux 2.6.31-8-generic i686
UserGroups: adm admin cdrom dialout lpadmin plugdev sambashare

[Apport retracing service (apport)]

StacktraceTop:pango_layout_get_extents_internal (layout=0xaaaaaaaa,
?? () from /usr/lib/libclutter-glx-1.0.so.0
clutter_actor_get_preferred_width ()
clutter_actor_get_width ()
clutter_actor_get_size ()

[Neil J. Patel (njpatel)]

Looks like CtkButton needs to be a bit weary about sending -1 as the for_width variable to CtkText (and in turn, ClutterText). Worth investigating to see if we can avoid this, or finding out why Pango has an issue in that function.

[Jason Smith (jassmith)]

This bug is a result of a bug in pango. I have only managed to reproduce the bug once and have had a heck of a time tracking it down from there. To reproduce it, run unr in a virtual machine and keep resizing the VM's screen for 20 or 30 minutes. Eventually it will die, hopefully with this.

The issue is in pango-layout.c in the pango source dir. There are two distinct blocks of code that act on width == -1. The first one recursively calls the extents call again, we dont see this in the trace however so likely this is not the issue. The second block is bigger and does a max on some structures, one of them is a pointer to a place on the heap. I believe this structure is somehow ending up as garbage, but looking at the code I do not see how.

To look at where I *think* the problem is, pango-layout.c:2538

[Rolf Leggewie (r0lf)]

netbook-launcher is part of lucid Desktop and no longer supported