nautilus crashed with SIGSEGV in cairo_surface_get_font_options()

this report has been filed here:

https://bugs.edge.launchpad.net/ubuntu/+source/cairo/+bug/256508

".
Thread 3 (process 7638):
#0 0xb8092424 in __kernel_vsyscall ()
#1 0xb73a3392 in pthread_cond_timedwait@@GLIBC_2.3.2 () from /lib/tls/i686/cmov/libpthread.so.0
#2 0xb772913d in g_cond_timed_wait_posix_impl (cond=0x8d365b0, entered_mutex=0x80, abs_time=0x7)
    at /build/buildd/glib2.0-2.17.6/gthread/gthread-posix.c:242
 result = <value optimized out>
 end_time = {tv_sec = 1218329403, tv_nsec = 179362000}
 timed_out = <value optimized out>
 __PRETTY_FUNCTION__ = "g_cond_timed_wait_posix_impl"
#3 0xb75d21f9 in g_async_queue_pop_intern_unlocked (queue=0x8885600, try=<value optimized out>,
    end_time=0xb6926324) at /build/buildd/glib2.0-2.17.6/glib/gasyncqueue.c:365
 retval = <value optimized out>
 __PRETTY_FUNCTION__ = "g_async_queue_pop_intern_unlocked"
#4 0xb75d22f7 in IA__g_async_queue_timed_pop (queue=0x8885600, end_time=0xb6926324)
    at /build/buildd/glib2.0-2.17.6/glib/gasyncqueue.c:491
 retval = <value optimized out>
 __PRETTY_FUNCTION__ = "IA__g_async_queue_timed_pop"
#5 0xb7624953 in g_thread_pool_thread_proxy (data=0x88c5620)
    at /build/buildd/glib2.0-2.17.6/glib/gthreadpool.c:121
 task = <value optimized out>
 pool = (GRealThreadPool *) 0x0
#6 0xb762334f in g_thread_create_proxy (data=0x88c5698) at /build/buildd/glib2.0-2.17.6/glib/gthread.c:635
 __PRETTY_FUNCTION__ = "g_thread_create_proxy"
#7 0xb739f4ff in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#8 0xb731c64e in clone () from /lib/tls/i686/cmov/libc.so.6
.
Thread 2 (process 7637):
#0 0xb8092424 in __kernel_vsyscall ()
#1 0xb7311de7 in poll () from /lib/tls/i686/cmov/libc.so.6
#2 0xb75fbd12 in g_main_context_iterate (context=0x8884d90, block=1, dispatch=1, self=0x8855408)
    at /build/buildd/glib2.0-2.17.6/glib/gmain.c:3033
 max_priority = 2147483647
 timeout = 500
 some_ready = <value optimized out>
 nfds = 16
 allocated_nfds = <value optimized out>
 fds = (GPollFD *) 0x8acdde8
 __PRETTY_FUNCTION__ = "g_main_context_iterate"
#3 0xb75fc3a2 in IA__g_main_loop_run (loop=0x88e1278) at /build/buildd/glib2.0-2.17.6/glib/gmain.c:2928
 self = (GThread *) 0x8855408
 __PRETTY_FUNCTION__ = "IA__g_main_loop_run"
#4 0xb7a17ce9 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#5 0x080803ab in main (argc=5, argv=0xbfcae824) at nautilus-main.c:581
 kill_shell = 0
 restart_shell = 0
 no_default_window = 0
 browser_window = 0
 no_desktop = 0
 autostart_mode = 0
 startup_id = <value optimized out>
 autostart_id = <value optimized out>
 startup_id_copy = 0x88a4b48 "My Book.volume"
 session_to_load = 0x0
 geometry = (gchar *) 0x0
 remaining = (const gchar **) 0x0
 perform_self_check = 0
 context = <value optimized out>
 application = (NautilusApplication *) 0x8881850
 program = (GnomeProgram *) 0x8868858
 options = {{long_name = 0x8161b5c "check", short_name = 99 'c', flags = 0, arg = G_OPTION_ARG_NONE,
    arg_data = 0xbfcae6f0, description = 0x8161bcc "Perform a quick set of self-check tests.",
    arg_description = 0x0}, {long_name = 0x81657cf "geometry", short_name = 103 'g', flags = 0,
    arg = G_OPTION_ARG_STRING, arg_data = 0xbfcae6f8,
    description ...

My educated guess is that 0xb78086a0 is an error surface, on which we attempt to initialize the font_options, hence the SIGSEGV.

Can you test this? (If I am right, you still won't see the desired result but the crash should be resolved.)

commit c73b3e43e120065e40d8fc48c9bdbd88ebe8ab40
Author: Chris Wilson <email address hidden>
Date: Tue Aug 12 21:21:20 2008 +0100

    [cairo-surface] Check for the error surface in _get_font_options()

    cairo_surface_get_font_options() has the side effect of initialising the
    font options on the surface, but fails to check that the surface is
    valid first. Therefore if we are passed a read-only error object, we will
    trigger a segmentation fault.

    Most likely this is the bug behind:
    http://bugs.freedesktop.org/show_bug.cgi?id=17096.

Verified that the above patch fixed the problem in that it at least prevents the segfault and the thumbnail even works.

Verified by compiling the cairo from the commit just before this one, and then running firefox with the compiled library LD_LIBRARY_PATH'd in. doing File->Open File, and navigating to the directory with the bad file. With the commit before this, firefox crashes.. with this fix, it works.

So, this fixes the bug in cairo, but should error surfaces be getting down this far? i.e., does this point to another bug in librsvg or pango?

Thanks for the fix.

Given the identification that it was indeed an error surface that we tried to write to, it is indicative that the caller could check for an error early (if they so desire) although they are free to just check for any errors after all the operations are completion.