Re: GTK build crashes under X

[Benjamin Riefenstahl]

Hi Stephen, all,


Stephen Berman writes:
> Program received signal SIGSEGV, Segmentation fault.
> 0xb74b88fa in strcmp () from /lib/libc.so.6
> (gdb) bt
> #0  0xb74b88fa in strcmp () from /lib/libc.so.6
> #1  0xb79c1b45 in FcObjectToPtr () from /usr/lib/libfontconfig.so.1
> #2  0xb79c5741 in FcPatternAddWithBinding () from /usr/lib/libfontconfig.so.1
> [...]
> #41 0xb7df2c9c in gtk_widget_size_request ()
>    from /opt/gnome/lib/libgtk-x11-2.0.so.0
> #42 0x080f181c in xg_update_frame_menubar (f=0x8644250)
>     at /home/steve/emacs-22.0.90/src/gtkutil.c:2924
> #43 0x0808bb95 in set_frame_menubar (f=0x8644250, first_time=1, deep_p=1)
>     at /home/steve/emacs-22.0.90/src/xmenu.c:2098
> #44 0x0808bd90 in initialize_frame_menubar (f=0x8644250)
>     at /home/steve/emacs-22.0.90/src/xmenu.c:2495
> #45 0x080d6735 in Fx_create_frame (parms=139409981)
>     at /home/steve/emacs-22.0.90/src/xfns.c:3368
> #46 0x08159461 in Ffuncall (nargs=2, args=0xbfe1dfa8)
>     at /home/steve/emacs-22.0.90/src/eval.c:2997


I got a crash in the same spot with the latest pretest and I found
this thread in the mail archive.


I analysed it like this:

- The crash occurs because Fontconfig's (libfontconfig.so) data
  structures are corrupted, more specifically this involves a linked
  list in Fontconfig's fcname.c.

- That linked list is built from data that is passed-in through a
  Fontconfig API and used unchecked.

- The caller that registered this particular piece of data is Xft
  (libXft.so), called through the QT library linked in by
  gtk-qt-engine.  gtk-qt-engine seems to be a Gnome theme, probably
  used to coordinate settings of Gnome clients with KDE (my main
  desktop).

- gtk-qt-engine is loaded during Emacs' call to
  gtk_settings_set_string_property() in gtkutil.c:xg_initialize().

- When the crash occurs, gtk-qt-engine is not loaded any more.  It
  seems to get unloaded after the settings have been determined.  Xft
  is loaded (through Pango), but it is in a different place now than
  it used to be before, because Pango has re-loaded it on-demand long
  after it was already unloaded together with gtk-qt-engine.

The root cause seems to be that the Xft shared library is not
unloadable, it doesn't cleanup and unregister the data that it has
passed to fontconfig.


Work-arounds that fix it for me:

- Uninstall gtk-qt-engine. 

- Preload Xft using LD_PRELOAD. 


Possible work-around in Emacs:

- Link to Xft and call XftInit(0) in gtkutil.c:xg_initialize() or even
  before that.


I'm not sure where exactly the problem *should* be fixed.

- Fontconfig could copy the data that comes in.

- Xft could allocate the data on the heap instead of using a static
  structure.

- Xft could prevent unloading of itself. 

- Xft could provide a cleanup routine for QT and/or gtk-qt-engine to
  use.

- gtk-qt-engine could prevent unloading of Xft.  It makes things
  unusually complicated by combining the two toolkits in one process.


benny