[cairo-bugs] [Bug 4030] Crash with cairo CVS

[bugzilla-daemon at freedesktop.org]

Please do not reply to this email: if you want to comment on the bug, go to    
       
the URL shown below and enter yourcomments there.     
   
https://bugs.freedesktop.org/show_bug.cgi?id=4030          
     




------- Additional Comments From mathis.ahrens at gmx.de  2006-01-28 16:16 -------
I see the same. Trying to summarize a bit:

I think there are two issues here:
1. Wrong font rendering of bitmap fonts by poppler 0.5.0 + fontconfig
2. Segfault when closing evince after that wrong rendering

This happens also in pdfs without Helvetica,
but it disappears when I disable bitmap fonts in my fontconfig 
like this: 
<selectfont>
  <rejectfont>
   <pattern>
     <patelt name="scalable"><bool>false</bool></patelt>
   </pattern>
  </rejectfont>
 </selectfont>

(reject NON-scalable, that is)

My version of the evince crash is similar:

#0  0xb6f29758 in FT_Done_Face (face=0x31) at ftobjs.c:1820
#1  0xb7199f85 in ~CairoFont (this=0xb5400708) at CairoFontEngine.cc:258
#2  0xb719a259 in ~CairoFontEngine (this=0x83c3140) at CairoFontEngine.cc:309
#3  0xb719a69a in ~CairoOutputDev (this=0x83bcea0) at CairoOutputDev.cc:65
#4  0xb7374b9f in poppler_document_save () from /usr/lib/libpoppler-glib.so.0
#5  0xb6db5f6b in g_object_unref () from /usr/lib/libgobject-2.0.so.0
#6  0xb76d04f0 in gtk_signal_emitv_by_name () from /usr/lib/libgtk-x11-2.0.so.0

poppler_document_save() or poppler_document_finalize()
both trigger the same deadly sequence:
 - some cairo destructors 
 - libfreetype's FT_Done_Face

This is where I loose it, I gotta sleep, but maybe this helps someone:

  FT_EXPORT_DEF( FT_Error )
  FT_Done_Face( FT_Face  face )
  {
    FT_Error     error;
    FT_Driver    driver;
    FT_Memory    memory;
    FT_ListNode  node;


    error = FT_Err_Invalid_Face_Handle;
    if ( face && face->driver )          // this is line 1820
    {
      driver = face->driver;
      memory = driver->root.memory;

      /* find face in driver's list */
      node = FT_List_Find( &driver->faces_list, face );
      if ( node )
      {
        /* remove face object from the driver's list */
        FT_List_Remove( &driver->faces_list, node );
        FT_FREE( node );

        /* now destroy the object proper */
        destroy_face( memory, face, driver );
        error = FT_Err_Ok;
      }
    }
    return error;
  }          
     
     
--           
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email         
     
------- You are receiving this mail because: -------
You are the QA contact for the bug, or are watching the QA contact.