Crash in FcPatternDestroy fontconfig

[evilpie]

Go to http://en.wikipedia.org/wiki/Hamster
Resize the window like a mad man

#0  0x00007ffff2cd1037 in raise () from /lib/x86_64-linux-gnu/libc.so.6
#1  0x00007ffff2cd4698 in abort () from /lib/x86_64-linux-gnu/libc.so.6
#2  0x00007ffff2d0e5ab in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#3  0x00007ffff2d1aa46 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#4  0x00007ffff0f30196 in ?? () from /usr/lib/x86_64-linux-gnu/libfontconfig.so.1
#5  0x00007ffff0f30382 in FcPatternDestroy () from /usr/lib/x86_64-linux-gnu/libfontconfig.so.1
#6  0x00007ffff32a3799 in __morestack () from /home/tom/servo/build/src/compiler/rust/x86_64-unknown-linux-gnu/stage2/lib/rustc/x86_64-unknown-linux-gnu/lib/librustrt.so
#7  0x00007ffff3293b4c in call_on_c_stack (fn_ptr=0x7ffff4f07d40 <FcPatternDestroy__c_stack_shim>, args=0x7fffd0204e00, this=0x7fffd8206b20) at /home/tom/servo/src/compiler/rust/src/rt/rust_task.h:481
#8  upcall_call_shim_on_c_stack (args=0x7fffd0204e00, fn_ptr=0x7ffff4f07d40 <FcPatternDestroy__c_stack_shim>) at /home/tom/servo/src/compiler/rust/src/rt/rust_upcall.cpp:70
#9  0x00007ffff4f07d31 in fontconfig::FcPatternDestroy::_29ffcf853e96a646::_0$x2e1 () from /home/tom/servo/build/src/platform/linux/rust-fontconfig/libfontconfig-102129e09d96658-0.1.so
#10 0x00007ffff4cbc4f2 in platform::linux::font_list::path_from_identifier::_227782f499c3905d::_0$x2e1 () from /home/tom/servo/build/src/components/gfx/libgfx-755b9bc410bb440-0.1.so
#11 0x00007ffff4cb3417 in platform::linux::font_context::__extensions__::meth_12827::create_font_from_identifier::_8ec95db4139ffb4c::_0$x2e1 () from /home/tom/servo/build/src/components/gfx/libgfx-755b9bc410bb440-0.1.so
#12 0x00007ffff4cb1b8b in font_context::__extensions__::meth_12473::create_font_instance::_554813c3b0171a5b::_0$x2e1 () from /home/tom/servo/build/src/components/gfx/libgfx-755b9bc410bb440-0.1.so
#13 0x00007ffff4cb0fab in font_context::__extensions__::meth_12342::get_font_by_descriptor::_554813c3b0171a5b::_0$x2e1 () from /home/tom/servo/build/src/components/gfx/libgfx-755b9bc410bb440-0.1.so
#14 0x00007ffff4cc84f0 in text::text_run::__extensions__::meth_14596::deserialize::_9792cad8b3f0876::_0$x2e1 () from /home/tom/servo/build/src/components/gfx/libgfx-755b9bc410bb440-0.1.so
#15 0x00000000004b7993 in display_list::__extensions__::draw_into_context_27861::_5d1d8d32f375fc::_0$x2e1 ()
#16 0x00000000004b774c in render_task::__extensions__::render_27777::anon::anon::anon::anon::expr_fn_27820 ()
#17 0x000000000045d7de in time::profile_19903::_c2d03091e655a184::_0$x2e1 ()
#18 0x00000000004b70ed in render_task::__extensions__::render_27777::anon::anon::expr_fn_27782 ()
#19 0x000000000045d7de in time::profile_19903::_c2d03091e655a184::_0$x2e1 ()
#20 0x00000000004b6517 in render_task::__extensions__::render_27777::anon::expr_fn_27780 ()
#21 0x000000000045d7de in time::profile_19903::_c2d03091e655a184::_0$x2e1 ()
#22 0x0000000000554498 in __morestack ()
#23 0x00000000004a53a0 in render_task::__extensions__::create_26654::anon::expr_fn_26675 ()
#24 0x0000000000554498 in __morestack ()
#25 0x00007ffff77de2a5 in task::spawn::spawn_raw_oldsched::make_child_wrapper::anon::expr_fn_18675 ()
   from /home/tom/servo/build/src/compiler/rust/x86_64-unknown-linux-gnu/stage2/lib/rustc/x86_64-unknown-linux-gnu/lib/libstd-6c65cf4b443341b1-0.8-pre.so
#26 0x00007ffff78dfed0 in __morestack () from /home/tom/servo/build/src/compiler/rust/x86_64-unknown-linux-gnu/stage2/lib/rustc/x86_64-unknown-linux-gnu/lib/libstd-6c65cf4b443341b1-0.8-pre.so
#27 0x00007ffff3292a2b in task_start_wrapper (a=0x7fffd8214930) at /home/tom/servo/src/compiler/rust/src/rt/rust_task.cpp:164
#28 0x0000000000000000 in ?? ()

[pradeep90]

I get a core dump in Servo with FcPatternDestroy for an HTML file with > 10000 nodes and CSS file with > 1000 rules.

The relevant HTML and CSS files are at https://gist.github.com/pradeep90/7462416

I ran it on a Linux machine
Linux Servo64-4 3.8.0-30-generic #44-Ubuntu SMP Thu Aug 22 20:52:24 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux
Intel Xeon CPU E5-1620
3.60 GHz x 8

[pradeep90]

In particular, I'm using PuTTY and XMing to run Servo remotely on the Linux machine.
I'm guessing this has something to do with the XMing Server on the Windows side.

I have reproduced the segfault with the HTML file above many times.
So, we should try to run it:

• on a Mac with the above HTML file - to see if it is not Linux-specific
• directly on a Linux terminal with the above file to see if the Windows setup is the culprit

[june0cho]

I can also reproduce same segfault error when running Servo remotely on other Linux machine.
I'm also using Putty and Xming on the Windows side.

[metajack]

We don't use font-config on Mac, so this specific backtrace wouldn't happen. Perhaps @larsbergstrom can try and replicate?

[june0cho]

ohhh when I tested on the other Linux machine, it works well.
I tested on the same Windows(same Putty and Xming) and only accessed the other Linux machine.
The machine info is as below:

• 'works-well' machine info
  Linux jet 3.11.0-13-generic #20-Ubuntu SMP Wed Oct 23 07:38:26 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux
• 'work fail' machine info
  Linux ServoLinux 3.5.0-17-generic #28-Ubuntu SMP Tue Oct 9 19:31:23 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux

I'm not sure whether the kernel version is related or not.

[yichoi]

no relation with kernel version. seems related with font configuration with remote x server

[jdm]

I know that @evilpie was testing locally, not with a remote server, but I'm fine with focusing on solving the remote one here since it's so reproducible.

[june0cho]

I tested on the machine directly, and I got the same segfault error. So, it's not the problem related only on remote server.

[larsbergstrom]

I'll get a Linux VM set up and try to repro it here.

[larsbergstrom]

This bug doesn't reproduce in a VM running Ubuntu Linux on the file Pradeep provided. I'll try it on an actual machine with an NVidia card (I have one in a closet I should be able to set up).

@june0cho Can you tell if there is a video hardware difference between those machines? e.g.,

lbergstrom@ubuntu:~$ lspci | grep VGA
00:0f.0 VGA compatible controller: VMware SVGA II Adapter

Thanks!

[june0cho]

@larsbergstrom It was Nvidia! I think @pradeep90 's machine also has same graphic card. VGA info is as following:

• 'works well' machine:
  00:02.0 VGA compatible controller: Intel Corporation Xeon E3-1200 v3/4th Gen Core Processor Integrated Graphics Controller (rev 06)
• 'work fail' machine
  03:00.0 VGA compatible controller: NVIDIA Corporation Device 107d (rev a1)

[larsbergstrom]

Thanks for the info! I set up a NVidia-based linux box and have it building rust+servo. I'll test it tomorrow (I also have a Windows VM and XMing set up so I can reproduce your exact environment, just in case).

[pradeep90]

Just to confirm, I too have Nvidia graphics card on my Linux machine.
03:00.0 VGA compatible controller: NVIDIA Corporation GF119 [NVS 310] (rev a1)

[june0cho]

Thanks, lars! I just got the same error in acid2.html as well. It is not always shown for acid2.html, but seems fail once per 7~8 times. For pradeep's test file, the error was always shown.

[larsbergstrom]

Interesting; I can't even get far enough to see that crash. Any page I attempt to load generates warnings about calls to glxCreatePixmap and then segfaults soon thereafter. I'll play around with driver versions; I may just be far out of date.

[metajack]

This sounds like the RGB vs RGBA problem
On Nov 22, 2013 10:17 AM, "Lars Bergstrom" notifications@github.com wrote:

Interesting; I can't even get far enough to see that crash. Any page I
attempt to load generates warnings about calls to glxCreatePixmap and
then segfaults soon thereafter. I'll play around with driver versions; I
may just be far out of date.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/668#issuecomment-29090882
.

[larsbergstrom]

So, I've looked at a variety of NVidia drivers on Linux. I can reproduce this crash (or the RGBA issue) by choosing the appropriate driver. The easiest fix seems to be to use the Noveau driver, which you can install on Ubuntu by:
run gnome-control-center
Double-click Software & Updates
Click the Additional Drivers tab
Change the radio button to "Using X.Org X server - Noveau..."
Apply Changes

If that's not an option (say, because you are doing GPGPU programming on these boxes as well and need the NVidia drivers installed), then we are going to have to do some more work to figure out exactly how to work around each of the features that are missing from these cards. I'd want to talk to @pcwalton more before spending a bunch of time doing that to make sure I understand what his longer-term plans are in this space, because I thought he mentioned plans for some major changes to our graphics dependencies.

[jwise]

Is there a minimized test case? I can pass this along internally if there is something easy to repro that points to a bug in the NVIDIA drivers. I don't see anything in that stack trace from our libGL, though, and I'm not sure our driver team has time to diagnose "there's something bizarre deep in Servo".

Feel free to @jwise me if you come across NVIDIA driver bugs; I can triage and pass things along internally, given a clear enough repro case.

[larsbergstrom]

@jwise Thanks for the offer - if we run into something specific, I will definitely bug you!

I've tracked down the first part of our issues with Nvidia linux support ( #1185 ) as being a problem with our code. I suspect that the latter is as well and has to do with how we're create/destroying pixmaps that just happens to work with other driver stacks. I will also consult our internal gfx experts before running up the "bug in the drivers!" flag.

[larsbergstrom]

OK, I've confirmed that my pending PRs that clean up NVidia driver support also fix this issue. Will close once they land.

[larsbergstrom]

This should be fixed now!