[bug #55625] Crash in GSHorizontalTypesetter -_getProposedRectFor:withLineHeight:

[Yavor Doganov]

URL:
  <https://savannah.gnu.org/bugs/?55625>

                 Summary: Crash in GSHorizontalTypesetter
-_getProposedRectFor:withLineHeight:
                 Project: GNUstep
            Submitted by: yavor
            Submitted on: Fri 01 Feb 2019 08:42:17 PM EET
                Category: Gui/AppKit
                Severity: 3 - Normal
              Item Group: Bug
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any

    _______________________________________________________

Details:

GNU/Linux x86_64, GUI 0.27.0, GCC 8.2.0

This happens with Lynkeos 3.1, when stacking images from a SER file (image
sequence container) with 125 images.  I cannot reproduce if I reduce the
amount of images to 10-15.

Backtrace:

Thread 1 "Lynkeos" received signal SIGSEGV, Segmentation fault.
0x00007ffff4c33d33 in objc_msg_lookup (receiver=receiver@entry=0x555555d6f5f0,
op=op@entry=0x7ffff588c5c0 <_OBJC_SELECTOR_TABLE+384>) at
/build/gcc-8-ukX2xj/gcc-8-8.2.0/src/libobjc/sendmsg.c:442
442     /build/gcc-8-ukX2xj/gcc-8-8.2.0/src/libobjc/sendmsg.c: Няма такъв
файл или директория.
(gdb) thread apply all bt

Thread 6 (Thread 0x7fffe24c3700 (LWP 21302)):
#0  0x000055555560cb87 in -[LynkeosDrizzleInterpolator
interpolateInPLane:atX:atY:] (self=<optimized out>, _cmd=<optimized out>,
plane=<optimized out>, x=<optimized out>, y=<optimized out>) at
./GNUstep/../Sources/LynkeosDrizzleInterpolator.m:277
#1  0x000055555566c30a in -[SER(ImageBuffer)
_initWithData:format:width:lineW:height:atX:Y:W:H:withTransform:withOffsets:]
(self=<optimized out>, _cmd=0x55555573f440 <_OBJC_SELECTOR_TABLE+2048>,
data=<optimized out>, format=<optimized out>, width=<optimized out>,
lineW=<optimized out>, height=440, x=125, y=39, w=280, h=270, transform=...,
offsets=0x7fffd801e2e0) at ./GNUstep/../Sources/SER_ImageBuffer.m:177
#2  0x000055555566d5ad in -[SER(Reader)
_getCustomImageSampleAtIndex:atX:Y:W:H:withTransform:withOffsets:]
(self=0x5555561b3b80, _cmd=<optimized out>, index=<optimized out>,
x=<optimized out>, y=<optimized out>, w=<optimized out>, h=270, transform=...,
offsets=0x7fffd801e2e0) at ./GNUstep/../Sources/SER_Reader.m:482
#3  0x000055555563ae9a in -[MyImageListItem
getCustomImageSampleinRect:withTransform:withOffsets:] (self=0x5555565d50e0,
_cmd=<optimized out>, rect=..., transform=..., offsets=<optimized out>) at
./GNUstep/../Sources/MyImageListItem.m:1056
#4  0x000055555564772f in -[MyImageStacker processItem:] (self=0x7fffd80231e0,
_cmd=<optimized out>, item=0x5555565d50e0) at
./GNUstep/../Sources/MyImageStacker.m:273
#5  0x000055555565c341 in -[MyProcessingThread(Private) processList]
(self=0x7fffd800ad30, _cmd=<optimized out>) at
./GNUstep/../Sources/MyProcessingThread.m:120
#6  0x000055555565c525 in +[MyProcessingThread threadWithAttributes:]
(self=<optimized out>, _cmd=<optimized out>, attr=0x5555581af160) at
./GNUstep/../Sources/MyProcessingThread.m:180
#7  0x00007ffff4f56608 in nsthreadLauncher (thread=0x555555d53780) at
NSThread.m:1311
#8  0x00007ffff58cdfa3 in start_thread (arg=<optimized out>) at
pthread_create.c:486
#9  0x00007ffff4b3e7ef in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 1 (Thread 0x7fffe91753c0 (LWP 21287)):
#0  0x00007ffff4c33d33 in objc_msg_lookup
(receiver=receiver@entry=0x555555d6f5f0, op=op@entry=0x7ffff588c5c0
<_OBJC_SELECTOR_TABLE+384>) at
/build/gcc-8-ukX2xj/gcc-8-8.2.0/src/libobjc/sendmsg.c:442
#1  0x00007ffff564450c in -[GSHorizontalTypesetter
_getProposedRectFor:withLineHeight:] (self=0x555556f34070, _cmd=<optimized
out>, newParagraph=<optimized out>, line_height=13.999999999999998) at
GSHorizontalTypesetter.m:486
#2  0x00007ffff56446cb in -[GSHorizontalTypesetter _addExtraLineFragment]
(self=0x555556f34070, _cmd=<optimized out>) at GSHorizontalTypesetter.m:527
#3  0x00007ffff5645d2c in -[GSHorizontalTypesetter layoutLineNewParagraph:]
(self=0x555556f34070, _cmd=<optimized out>, newParagraph=1 '\001') at
GSHorizontalTypesetter.m:610
#4  0x00007ffff56464bd in -[GSHorizontalTypesetter
layoutGlyphsInLayoutManager:inTextContainer:startingAtGlyphIndex:previousLineFragmentRect:nextGlyphIndex:numberOfLineFragments:]
(self=0x555556f34070, _cmd=<optimized out>, layoutManager=<optimized out>,
textContainer=0x555556f6c680, glyphIndex=<optimized out>,
previousLineFragRect=..., nextGlyphIndex=0x7fffffffcc9c, howMany=0) at
GSHorizontalTypesetter.m:1293
#5  0x00007ffff56403df in -[GSLayoutManager(LayoutHelpers)
_doLayoutToContainer:] (self=0x555556001540, _cmd=<optimized out>, cindex=0)
at GSLayoutManager.m:1957
#6  0x00007ffff5641bc0 in -[GSLayoutManager(layout)
glyphRangeForTextContainer:] (self=0x555556001540, _cmd=<optimized out>,
container=<optimized out>) at GSLayoutManager.m:2647
#7  0x00007ffff55a2b27 in cache_lookup (hasSize=hasSize@entry=1 '\001',
size=..., useScreenFonts=<optimized out>) at NSStringDrawing.m:289
#8  0x00007ffff55a2dc7 in -[NSAttributedString(NSStringDrawing)
drawWithRect:options:] (self=0x5555563d2370, _cmd=<optimized out>, rect=...,
options=<optimized out>) at NSStringDrawing.m:482
#9  0x00007ffff54b685f in -[NSButtonCell drawTitle:withFrame:inView:]
(self=0x555557a66250, _cmd=<optimized out>, titleToDisplay=0x5555563d2370,
cellFrame=..., controlView=<optimized out>) at NSButtonCell.m:1062
#10 0x00007ffff54b6bf6 in -[NSButtonCell drawInteriorWithFrame:inView:]
(self=0x555557a66250, _cmd=<optimized out>, cellFrame=...,
controlView=0x55555842d9e0) at NSButtonCell.m:1355
#11 0x00007ffff54bd0dd in -[NSCell drawWithFrame:inView:]
(self=0x555557a66250, _cmd=<optimized out>, cellFrame=...,
controlView=0x55555842d9e0) at NSCell.m:2145
#12 0x00007ffff546d9e4 in -[NSActionCell drawWithFrame:inView:]
(self=0x555557a66250, _cmd=<optimized out>, cellFrame=...,
controlView=0x55555842d9e0) at NSActionCell.m:364
#13 0x00007ffff558a439 in -[NSScroller drawKnobSlot] (self=0x55555842d9e0,
_cmd=<optimized out>) at NSScroller.m:1138
#14 0x00007ffff5661d3c in -[GSTheme(Drawing)
drawScrollerRect:inView:hitPart:isHorizontal:] (self=<optimized out>,
_cmd=<optimized out>, rect=..., view=0x55555842d9e0, hitPart=0,
isHorizontal=<optimized out>) at GSThemeDrawing.m:2405
#15 0x00007ffff55fa593 in -[NSView displayRectIgnoringOpacity:inContext:]
(self=0x55555842d9e0, _cmd=<optimized out>, aRect=..., context=0x55555599db40)
at NSView.m:2600
#16 0x00007ffff55fa12f in -[NSView displayIfNeededInRectIgnoringOpacity:]
(self=0x55555842d9e0, _cmd=<optimized out>, aRect=...) at NSView.m:2480
#17 0x00007ffff55fa3c9 in -[NSView displayIfNeededInRectIgnoringOpacity:]
(self=0x5555581aeda0, _cmd=<optimized out>, aRect=...) at NSView.m:2506
#18 0x00007ffff55fa3c9 in -[NSView displayIfNeededInRectIgnoringOpacity:]
(self=0x55555843b6a0, _cmd=<optimized out>, aRect=...) at NSView.m:2506
#19 0x00007ffff55fa3c9 in -[NSView displayIfNeededInRectIgnoringOpacity:]
(self=0x555558545c20, _cmd=<optimized out>, aRect=...) at NSView.m:2506
#20 0x00007ffff55fa3c9 in -[NSView displayIfNeededInRectIgnoringOpacity:]
(self=0x55555847a370, _cmd=<optimized out>, aRect=...) at NSView.m:2506
#21 0x00007ffff55fa3c9 in -[NSView displayIfNeededInRectIgnoringOpacity:]
(self=0x555558549bf0, _cmd=<optimized out>, aRect=...) at NSView.m:2506
#22 0x00007ffff55fa3c9 in -[NSView displayIfNeededInRectIgnoringOpacity:]
(self=0x555557d90f40, _cmd=<optimized out>, aRect=...) at NSView.m:2506
#23 0x00007ffff55fa3c9 in -[NSView displayIfNeededInRectIgnoringOpacity:]
(self=0x5555561cd980, _cmd=<optimized out>, aRect=...) at NSView.m:2506
#24 0x00007ffff55eda4c in -[NSView displayIfNeeded] (self=0x5555561cd980,
_cmd=<optimized out>) at NSView.m:2440
#25 0x00007ffff5601108 in -[NSWindow displayIfNeeded] (self=0x555558222280,
_cmd=<optimized out>) at NSWindow.m:2488
#26 0x00007ffff55ff89f in -[NSWindow(GNUstepPrivate) _handleAutodisplay]
(self=0x555558222280, _cmd=<optimized out>) at NSWindow.m:189
#27 0x00007ffff560b9b6 in +[NSWindow(GNUstepPrivate) _handleAutodisplay:]
(self=0x7ffff573a7c0 <_OBJC_Class_NSIconWindow>, _cmd=<optimized out>,
bogus=<optimized out>) at /usr/include/GNUstep/GNUstepBase/GSIArray.h:522
#28 0x00007ffff4f25102 in -[GSRunLoopPerformer fire] (self=0x555557a034b0,
_cmd=<optimized out>) at NSRunLoop.m:119
#29 0x00007ffff4f280d2 in -[NSRunLoop(Private) _checkPerformers:]
(self=<optimized out>, _cmd=<optimized out>, context=<optimized out>) at
NSRunLoop.m:520
#30 0x00007ffff4f267dd in -[NSRunLoop acceptInputForMode:beforeDate:]
(self=0x555555d1c7f0, _cmd=0x7ffff51e7a90 <_OBJC_SELECTOR_TABLE+1232>,
mode=0x7ffff51e8840 <_OBJC_INSTANCE_2>, limit_date=0x5555581c9be0) at
NSRunLoop.m:1233
#31 0x00007ffff4f26514 in -[NSRunLoop runMode:beforeDate:]
(self=0x555555d1c7f0, _cmd=<optimized out>, mode=0x7ffff51e8840
<_OBJC_INSTANCE_2>, date=0x555555d2b0d0) at NSRunLoop.m:1304
#32 0x00007ffff561e772 in -[GSDisplayServer(EventOps)
getEventMatchingMask:beforeDate:inMode:dequeue:] (self=0x5555559b3180,
_cmd=<optimized out>, mask=4294967295, limit=<optimized out>,
mode=0x7ffff51e8840 <_OBJC_INSTANCE_2>, flag=<optimized out>) at
GSDisplayServer.m:1034
#33 0x00007fffe8d3b158 in -[XGServer(X11Ops)
getEventMatchingMask:beforeDate:inMode:dequeue:] (self=0x5555559b3180,
_cmd=<optimized out>, mask=4294967295, limit=0x555555d2b0d0,
mode=0x7ffff51e8840 <_OBJC_INSTANCE_2>, flag=<optimized out>) at
XGServerEvent.m:2567
#34 0x00007ffff548aa32 in DPSPeekEvent (mode=<optimized out>, limit=<optimized
out>, mask=<optimized out>, ctxt=<optimized out>) at
../Headers/Additions/GNUstepGUI/GSDisplayServer.h:207
#35 0x00007ffff548aa32 in -[NSApplication
nextEventMatchingMask:untilDate:inMode:dequeue:] (self=0x5555559e88a0,
_cmd=0x7ffff57396b0 <_OBJC_SELECTOR_TABLE+2896>, mask=4294967295,
expiration=0x555555d2b0d0, mode=0x7ffff51e8840 <_OBJC_INSTANCE_2>,
flag=<optimized out>) at NSApplication.m:2182
#36 0x00007ffff548890c in -[NSApplication run] (self=0x5555559e88a0,
_cmd=<optimized out>) at NSApplication.m:1554
#37 0x00007ffff5468965 in NSApplicationMain (argc=<optimized out>,
argv=<optimized out>) at Functions.m:91
#38 0x00007ffff4a6909b in __libc_start_main (main=0x555555601c80 <main>,
argc=1, argv=0x7fffffffe1e8, init=<optimized out>, fini=<optimized out>,
rtld_fini=<optimized out>, stack_end=0x7fffffffe1d8) at
../csu/libc-start.c:308
#39 0x000055555560203a in _start ()


Note that curParagraphStyle is not a valid object:

(gdb) up
#1  0x00007ffff564450c in -[GSHorizontalTypesetter
_getProposedRectFor:withLineHeight:] (self=0x555556f34070, _cmd=<optimized
out>, newParagraph=<optimized out>, line_height=13.999999999999998) at
GSHorizontalTypesetter.m:486
486     GSHorizontalTypesetter.m: Няма такъв файл или
директория.
(gdb) p curParagraphStyle 

$1 = (NSParagraphStyle *) 0x555555d6f5f0
(gdb) po curParagraphStyle 

Thread 1 "Lynkeos" received signal SIGSEGV, Segmentation fault.
0x00007ffff4c33d33 in objc_msg_lookup (receiver=receiver@entry=0x555555d6f5f0,
op=op@entry=0x7ffff51909f0 <_OBJC_SELECTOR_TABLE+208>) at
/build/gcc-8-ukX2xj/gcc-8-8.2.0/src/libobjc/sendmsg.c:442
442     /build/gcc-8-ukX2xj/gcc-8-8.2.0/src/libobjc/sendmsg.c: Няма такъв
файл или директория.
The program being debugged was signaled while in a function called from GDB.
GDB remains in the frame where the signal was received.
To change this behavior use "set unwindonsignal on".
Evaluation of the expression containing the function
(_NSPrintForDebugger) will be abandoned.
When the function is done executing, GDB will silently stop.


The attached minimal patch fixes it for me but I'm not sure I fully understand
the implications.



    _______________________________________________________

File Attachments:


-------------------------------------------------------
Date: Fri 01 Feb 2019 08:42:17 PM EET  Name:
0001-Fix-crash-in-GSHorizontalTypesetter-_getProposedRect.patch  Size: 1KiB  
By: yavor

<http://savannah.gnu.org/bugs/download.php?file_id=46154>

    _______________________________________________________

Reply to this item at:

  <https://savannah.gnu.org/bugs/?55625>

_______________________________________________
  Message sent via Savannah
  https://savannah.gnu.org/