Bug 26798

Summary: Gnumeric crashes in libpango
Product: Mageia Reporter: GG HH <boulshet>
Component: RPM PackagesAssignee: Olav Vitters <olav>
Status: RESOLVED FIXED QA Contact:
Severity: critical    
Priority: release_blocker CC: boulshet, mageia, olav, shlomif
Version: Cauldron   
Target Milestone: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Source RPM: pango CVE:
Status comment:

Description GG HH 2020-06-15 13:48:06 CEST
Description of problem:
Gnumeric crash 

Version-Release number of selected component (if applicable):
$ rpm -q -i gnumeric
Name        : gnumeric
Version     : 1.12.47
Release     : 1.mga8
Architecture: x86_64


How reproducible:

Steps to Reproduce:
1. start gnumeric
2. type some content in a cell. Eg. 'a" in A1
3. move the cursor to this cell
A crash occurs

output:
$ /usr/bin/gnumeric 
(/usr/bin/gnumeric:225765): GLib-GObject-CRITICAL **: 12:32:42.540: Object class GnmFontButton doesn't implement property 'level' from interface 'GtkFontChooser'
(/usr/bin/gnumeric:225765): GLib-GObject-CRITICAL **: 12:32:42.540: Object class GnmFontButton doesn't implement property 'language' from interface 'GtkFontChooser'
(/usr/bin/gnumeric:225765): GLib-GObject-CRITICAL **: 12:32:42.540: Object class GnmFontButton doesn't implement property 'font-features' from interface 'GtkFontChooser'
Erreur de segmentation (core dumped)

in journalctl:
juin 15 12:32:44 uranus kernel: gnumeric[225765]: segfault at 8 ip 00007f187696897f sp 00007ffda0006d80 error 4 in libpango-1.0.so.0.4502.0[7f187695c000+26000]

actually, it looks like libpango has seen several tries to fix gtk crash in the last days; It might be the root cause. 
$ rpm -q --changelog lib64pango1.0_0 |more
* ven. juin 12 2020 ovitters <ovitters> 1.45.2-2.mga8
+ Revision: 1592795
- drop pango-mga25737.patch; fixed differently in 1.45.2 (upstream commit dd867f41)

* ven. juin 12 2020 tv <tv> 1.45.2-1.mga8
+ Revision: 1592717
- 1.45.2

* jeu. juin 11 2020 shlomif <shlomif> 1.45.1-4.mga8
+ Revision: 1592356
- gtk2 crashes: apply more patches
- gtk2 crashes: apply more patches

* mer. juin 10 2020 shlomif <shlomif> 1.45.1-3.mga8
+ Revision: 1592074
- fix another gtk2 crash

* mer. juin 10 2020 shlomif <shlomif> 1.45.1-2.mga8
+ Revision: 1591986
- fix gtk2 crash
+ ovitters <ovitters>
- update url

* mar. juin 09 2020 ovitters <ovitters> 1.45.1-1.mga8
+ Revision: 1591209
- new version 1.45.1

I saw https://bugs.mageia.org/show_bug.cgi?id=26774 about gimp where pango is also involved.
GG HH 2020-06-15 13:48:22 CEST

CC: (none) => boulshet

Comment 1 Olav Vitters 2020-06-15 15:44:27 CEST
I cannot get to my Mageia machine for a while. Would it be possible for you to run gnumeric under gdb and install the various debug packages?

It's something like:
gdb gnumeric
r
bt


(t = run program)
(b = backtrace.. shows the interesting bits)

First thing, it might be the patch I dropped, there might still be a problem in there. Upstream wasn't too sure about their fix.

CC: (none) => olav

Comment 2 GG HH 2020-06-15 19:39:10 CEST
i am trying. So far, i have something strange. I have to install debuginfo
for both lib64ffi6-3.2.1-8.mga8.x86_64 AND lib64ffi7-3.3-1.mga8.x86_64
The first one is no longer in cauldron, i will try to get it from stable but i wonder is the root cause might be a package which should be rebuilt with libffi7 to be consistent ?

debuginfo-install dconf-0.36.0-1.mga8.x86_64 gvfs-1.45.2-1.mga8.x86_64 lib64atk-bridge2.0_0-2.34.2-1.mga8.x86_64 lib64atk1.0_0-2.36.0-1.mga8.x86_64 lib64atspi0-2.36.0-1.mga8.x86_64 lib64avahi-client3-0.8-4.mga8.x86_64 lib64avahi-common3-0.8-4.mga8.x86_64 lib64blkid1-2.35.2-1.mga8.x86_64 lib64bsd0-0.10.0-2.mga8.x86_64 lib64bz2_1-1.0.8-2.mga8.x86_64 lib64cairo2-1.16.0-3.mga8.x86_64 lib64com_err2-1.45.6-5.mga8.x86_64 lib64cups2-2.3.3-4.mga8.x86_64 lib64datrie1-0.2.12-2.mga8.x86_64 lib64dbus-glib1_2-0.110-3.mga8.x86_64 lib64dbus1_3-1.13.16-1.mga8.x86_64 lib64drm2-2.4.102-1.mga8.x86_64 lib64epoxy0-1.5.4-2.mga8.x86_64 lib64ffi6-3.2.1-8.mga8.x86_64 lib64ffi7-3.3-1.mga8.x86_64 lib64fontconfig1-2.13.92-3.mga8.x86_64 lib64freetype6-2.10.2-1.mga8.tainted.x86_64 lib64fribidi0-1.0.9-1.mga8.x86_64 lib64gbm1-20.1.0-2.mga8.x86_64 lib64gcrypt20-1.8.5-4.mga8.x86_64 lib64gdk_pixbuf2.0_0-2.40.0-2.mga8.x86_64 lib64gio2.0_0-2.64.3-1.mga8.x86_64 lib64glapi0-20.1.0-2.mga8.x86_64 lib64glib2.0_0-2.64.3-1.mga8.x86_64 lib64gnutls30-3.6.14-1.mga8.x86_64 lib64goffice0.10_10-0.10.47-1.mga8.x86_64 lib64gpg-error0-1.36-3.mga8.x86_64 lib64graphite2_3-1.3.14-1.mga8.x86_64 lib64gs9-9.52-1.mga8.x86_64 lib64gsf1_114-1.14.47-2.mga8.x86_64 lib64gtk+3_0-3.24.20-1.mga8.x86_64 lib64harfbuzz0-2.6.7-1.mga8.x86_64 lib64jbig1-2.1-7.mga8.x86_64 lib64jbig2dec0-0.18-2.mga8.x86_64 lib64krb53-1.18.2-1.mga8.x86_64 lib64lcms2_2-2.10-1.mga8.x86_64 lib64lz4_1-1.9.2-2.mga8.x86_64 lib64lzma5-5.2.5-1.mga8.x86_64 lib64mesagl1-20.1.0-2.mga8.x86_64 lib64mount1-2.35.2-1.mga8.x86_64 lib64p11-kit0-0.23.20-8.mga8.x86_64 lib64pango1.0_0-1.45.2-2.mga8.x86_64 lib64pcre1-8.44-1.mga8.x86_64 lib64pixman1_0-0.40.0-1.mga8.x86_64 lib64png16_16-1.6.37-2.mga8.x86_64 lib64rsvg2_2-2.49.2-1.mga8.x86_64 lib64systemd0-245.6-2.mga8.x86_64 lib64tasn1_6-4.16.0-3.mga8.x86_64 lib64thai0-0.1.28-2.mga8.x86_64 lib64tiff5-4.1.0-2.git20200531.1.mga8.x86_64 lib64unistring2-0.9.10-3.mga8.x86_64 lib64wayland-client0-1.18.0-2.mga8.x86_64 lib64wayland-cursor0-1.18.0-2.mga8.x86_64 lib64wayland-server0-1.18.0-2.mga8.x86_64 lib64x11-xcb1-1.6.9-2.mga8.x86_64 lib64x11_6-1.6.9-2.mga8.x86_64 lib64xau6-1.0.9-2.mga8.x86_64 lib64xcb-dri2_0-1.14-1.mga8.x86_64 lib64xcb-dri3_0-1.14-1.mga8.x86_64 lib64xcb-glx0-1.14-1.mga8.x86_64 lib64xcb-present0-1.14-1.mga8.x86_64 lib64xcb-render0-1.14-1.mga8.x86_64 lib64xcb-shm0-1.14-1.mga8.x86_64 lib64xcb1-1.14-1.mga8.x86_64 lib64xcomposite1-0.4.5-2.mga8.x86_64 lib64xcursor1-1.2.0-2.mga8.x86_64 lib64xdamage1-1.1.5-2.mga8.x86_64 lib64xext6-1.3.4-2.mga8.x86_64 lib64xfixes3-5.0.3-3.mga8.x86_64 lib64xi6-1.7.10-2.mga8.x86_64 lib64xinerama1-1.1.4-3.mga8.x86_64 lib64xkbcommon0-0.10.0-2.mga8.x86_64 lib64xml2_2-2.9.10-5.mga8.x86_64 lib64xrandr2-1.5.2-2.mga8.x86_64 lib64xrender1-0.9.10-3.mga8.x86_64 lib64xslt1-1.1.34-2.mga8.x86_64 lib64zlib1-1.2.11-9.mga8.x86_64 lib64zstd1-1.4.5-2.mga8.x86_64 libgcc1-10.1.1-0.20200613.1.mga8.x86_64
Comment 3 GG HH 2020-06-15 19:48:48 CEST
$ ldd /usr/bin/gnumeric|grep ffi
        libgoffice-0.10.so.10 => /lib64/libgoffice-0.10.so.10 (0x00007fad0549b000)
        libffi.so.6 => /lib64/libffi.so.6 (0x00007fad032dd000)
        libffi.so.7 => /lib64/libffi.so.7 (0x00007fad00d20000)
Comment 4 GG HH 2020-06-15 19:50:08 CEST
would it be possible to rebuild gnumeric with libffi 7 ?
i can't make gdb work
Comment 5 GG HH 2020-06-15 19:52:17 CEST
here's what i eventually got :

Thread 1 "gnumeric" received signal SIGSEGV, Segmentation fault.
0x00007ffff6e3997f in pango_attr_list_splice (list=list@entry=0xc0b770, other=other@entry=0xbf1180, pos=pos@entry=8, len=1) at ../pango/pango-attributes.c:1774
1774      for (i = 0, p = list->attributes->len; i < p; i++)
Missing separate debuginfos, use: debuginfo-install lib64ffi6-3.2.1-8.mga8.x86_64 lib64freetype6-2.10.2-1.mga8.tainted.x86_64
Comment 6 GG HH 2020-06-15 21:52:53 CEST
Thread 1 "gnumeric" received signal SIGSEGV, Segmentation fault.
0x00007ffff6b0a97f in pango_attr_list_splice () from /lib64/libpango-1.0.so.0
(gdb) bt
#0  0x00007ffff6b0a97f in pango_attr_list_splice () at /lib64/libpango-1.0.so.0
#1  0x00007ffff7c0ad82 in wbcg_auto_expr_value_changed () at /lib64/libspreadsheet-1.12.47.so
#2  0x00007ffff6fffda2 in g_closure_invoke () at /lib64/libgobject-2.0.so.0
#3  0x00007ffff7011783 in signal_emit_unlocked_R.isra.0 () at /lib64/libgobject-2.0.so.0
#4  0x00007ffff70178a9 in g_signal_emit_valist () at /lib64/libgobject-2.0.so.0
#5  0x00007ffff7017ce2 in g_signal_emit () at /lib64/libgobject-2.0.so.0
#6  0x00007ffff7004184 in g_object_dispatch_properties_changed () at /lib64/libgobject-2.0.so.0
#7  0x00007ffff70039e6 in g_object_notify_queue_thaw () at /lib64/libgobject-2.0.so.0
#8  0x00007ffff70070df in g_object_set_valist () at /lib64/libgobject-2.0.so.0
#9  0x00007ffff7007a3f in g_object_set () at /lib64/libgobject-2.0.so.0
#10 0x00007ffff7c17be7 in wb_view_auto_expr_recalc () at /lib64/libspreadsheet-1.12.47.so
#11 0x00007ffff7be1889 in cb_update_auto_expr () at /lib64/libspreadsheet-1.12.47.so
#12 0x00007ffff6f177bd in g_timeout_dispatch () at /lib64/libglib-2.0.so.0
#13 0x00007ffff6f16c97 in g_main_context_dispatch () at /lib64/libglib-2.0.so.0
#14 0x00007ffff6f16fe8 in g_main_context_iterate.constprop () at /lib64/libglib-2.0.so.0
#15 0x00007ffff6f172cb in g_main_loop_run () at /lib64/libglib-2.0.so.0
#16 0x00007ffff7373455 in gtk_main () at /lib64/libgtk-3.so.0
#17 0x0000000000403d3d in main ()
(gdb)
Comment 7 Olav Vitters 2020-06-16 11:38:22 CEST
Not sure if the two ffi libraries would cause this crash. It's seems more likely to be in pango. But just to rule that out I'll rebuild at least a few.

$ urpmq --whatrequires lib64ffi6-3.2.1-8.mga8.x86_64
firefox
gambas3-runtime
gforth
jffi-native
jna
lib64ffi6
lib64glib2.0_0
lib64gnustep-base1.26
lib64guile2.0_22
lib64llvm10.0
lib64llvm8.08.0
lib64python3.8-stdlib
lib64wayland-client0
lib64wayland-server0
lua-lgi
perl-Glib-Object-Introspection
racket
ruby
ruby-ffi
squeak-vm


Out of this list glib, and wayland is suspicious. Maybe that Perl bit as well. I've triggered a rebuild for a few.

Source RPM: (none) => pnaog
Priority: Normal => release_blocker
Severity: major => critical

Olav Vitters 2020-06-16 11:38:44 CEST

Source RPM: pnaog => pango

Comment 8 GG HH 2020-06-16 12:50:19 CEST
I upgrade glib and it didn't help

$ ldd /usr/lib64/libglib-2.0.so.0 /usr/lib64/libgmodule-2.0.so.0 /usr/lib64/libgobject-2.0.so.0 /usr/lib64/libgthread-2.0.so.0 | grep ffi
        libffi.so.7 => /lib64/libffi.so.7 (0x00007fef083ed000)

$ ldd /usr/bin/gnumeric | grep ffi
        libgoffice-0.10.so.10 => /lib64/libgoffice-0.10.so.10 (0x00007fc3a0ad1000)
        libffi.so.7 => /lib64/libffi.so.7 (0x00007fc39e8ff000)
        libffi.so.6 => /lib64/libffi.so.6 (0x00007fc39d524000)

$ /usr/bin/gnumeric
(/usr/bin/gnumeric:607835): dbind-WARNING **: 12:47:56.299: Couldn't register with accessibility bus: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.
(/usr/bin/gnumeric:607835): GLib-GObject-CRITICAL **: 12:47:56.627: Object class GnmFontButton doesn't implement property 'level' from interface 'GtkFontChooser'
(/usr/bin/gnumeric:607835): GLib-GObject-CRITICAL **: 12:47:56.627: Object class GnmFontButton doesn't implement property 'language' from interface 'GtkFontChooser'
(/usr/bin/gnumeric:607835): GLib-GObject-CRITICAL **: 12:47:56.627: Object class GnmFontButton doesn't implement property 'font-features' from interface 'GtkFontChooser'
Erreur de segmentation (core dumped)
Wayland is installed but still not rebuilt/available on my mirror but I am using X11,
Comment 9 GG HH 2020-06-16 16:02:54 CEST
no progress with perl-Glib-Object-Introspection and wayland updates
Comment 10 GG HH 2020-06-16 17:46:13 CEST
unfortunately, reverting the patch in pango-1.45.2-3.mga8 did not help either
Comment 11 Lewis Smith 2020-06-16 20:56:02 CEST
Olav, thank you for taking this on. Hence assigning it to you.

Assignee: bugsquad => olav

Comment 12 GG HH 2020-06-16 21:07:15 CEST
for the sake of completeness, would you ask for a rebuild of lib64python3.8-stdlib-3.8.3-1.mga8 ?
It's also used by gnumeric


# rpm -e lib64ffi6-3.2.1-8.mga8
erreur : Dépendances requises:
        libffi.so.6()(64bit) est nécessaire pour (déjà installé) lib64python3.8-stdlib-3.8.3-1.mga8.x86_64
        libffi.so.6()(64bit) est nécessaire pour (déjà installé) lib64llvm10.0-10.0.0-4.mga8.x86_64

the second one is not but still use ffi6
Comment 13 GG HH 2020-06-18 19:27:58 CEST
The last pango rpm fixed or workaround the issue

Not closing myself because i wonder if it's a fix or a workaround

Thanks all !
Comment 14 Martin Whitaker 2020-06-19 12:57:09 CEST
I suspect a workaround. Turns out the gtk+2.0 package hadn't been rebuilt against the new version of pango. See also bug 26774.

CC: (none) => mageia, shlomif

Comment 15 GG HH 2020-06-19 13:10:03 CEST
In comment 13, i wondered if the patch in pango was a final fix or a workaround.

The issue _IS_ solved and it looks like the rebuild has not reached my laptop for now.

$ rpm -q --changelog lib64gtk+2.0_0 | head
* dim. avril 12 2020 ovitters <ovitters> 2.24.32-9.mga8
+ Revision: 1566987
- add patch to silence unavailable gtk modules (mga#3536)

* lun. févr. 17 2020 daviddavid <daviddavid> 2.24.32-8.mga8
+ Revision: 1536945
- port gtk2-devel's gtk-builder-convert to Python 3
  * https://gitlab.gnome.org/GNOME/gtk/merge_requests/1080

* dim. févr. 16 2020 tv <tv> 2.24.32-7.mga8

Status: NEW => RESOLVED
Resolution: (none) => FIXED