ubiquity crashed with SIGSEGV in _int_malloc()

This bug has been reported on the Ubuntu ISO testing tracker.

A list of all reports related to this bug can be found here:
http://iso.qa.ubuntu.com/qatracker/reports/bugs/1303516

StacktraceTop:
 _int_malloc (av=0x7f3d8aa5c760 <main_arena>, bytes=1824) at malloc.c:3489
 __GI___libc_malloc (bytes=1824) at malloc.c:2891
 gralloc<float> (n=456) at /build/buildd/graphite2-1.2.4/src/inc/Main.h:88
 graphite2::Font::Font (this=0x1d5bd70, ppm=<optimized out>, f=..., appFontHandle=<optimized out>, ops=<optimized out>) at /build/buildd/graphite2-1.2.4/src/Font.cpp:46
 gr_make_font_with_ops (ppm=15024, appFontHandle=0x67d0d10, font_ops=font_ops@entry=0x7fff72772f50, face=0x2512f20) at /build/buildd/graphite2-1.2.4/src/gr_font.cpp:52

Confirmed with Ubuntu Trusty Desktop 20140407 amd64 by clicking on the 4th language from the bottom of the list in ubiquity-dm

below will modify currently running locale/keyboard be prepared to restore it, e.g. by enabling keyboard indicator to change keyboard back to normal.

$ sudo apt-get install ubiquity-frontend-gtk
$ ubiquity --greeter

scroll to the bottom of the language list, click on 5th or 4th from the bottom, thus causing python3 segmentation fault:
$ ubiquity --greeter
*** Error in `/usr/bin/python3': malloc(): memory corruption: 0x0000000003b33d80 ***
Segmentation fault (core dumped)

Having a look, not sure I'm going to be able to track down a memory corruption in this stack (pango/harfbuzz/graphite2) though, so will forward upstream.

For me, running on my desktop, it's the 5th language from the bottom. We think it's Myanmar (Burmese).

Any ideas how we could run valgrind on this and get useful results?

Status changed to 'Confirmed' because the bug affects multiple users.

A couple of initial queries:

Is there any way we can find out what the font was that was being initialised when the crash occurred? I ask because if the font isn't a graphite font, then what was causing a graphite font to try to be created? Looking at the input text being Burmese, I'll assume it's font linked Padauk.

The ppm value of 15024 being passed here in the source stack trace is suspicious (even if divided by 64 it's still 234pt which is a biiiig font). Not that such a big value alone would cause the crash. But has some corruption occurred earlier?

#4 0x00007f3d808922d2 in gr_make_font_with_ops (ppm=15024, appFontHandle=0x67d0d10, font_ops=font_ops@entry=0x7fff72772f50, face=0x2512f20) at /build/buildd/graphite2-1.2.4/src/gr_font.cpp:52

In the main stack trace, the size value here looks suitably crazy but that could be due to some wandering in the long tall grass (although *how* anyone can get malloc to crash quite so impressively is an interesting question in its own right):

#0 _int_malloc (av=0x7f3d8aa5c760 <main_arena>, bytes=1824) at malloc.c:3489
        iters = <optimized out>
        nb = 1840
        idx = 76
        bin = <optimized out>
        victim = 0x67ec860
        size = 39582418614272

Is this implying a post free memory access to mess up the free list? Are there any other reasons that malloc could go crazy like this? I assume a modern malloc doesn't do anything nice like use the last element on the free list for the next malloc? So the corruption and following usage could be far apart?

In addition. If this is a memory corruption bug, is running the test under valgrind of any use?

When I ran the test, I got not failure. But I did notice that when I ran the test using valgrind (still with no failure) valgrind reported a number of memory problems in python3.4. No errors were reported from anywhere in gtk or lower (pango, graphite, etc.). The command I used to test was:

valgrind --log-file=ubiquity.log ubiquity --greeter

Maybe a fixed python has fixed this bug?
Please retest with newer python3

When this fixed in 14.04 Trusty Tahr for 14.04.1 (24 July)?

Uploaded to Utopic and Trusty, awaiting review in the latter.

This bug was fixed in the package harfbuzz - 0.9.29-1ubuntu2

---------------
harfbuzz (0.9.29-1ubuntu2) utopic; urgency=medium

  * No-change rebuild to drop version of glib2.0-udeb dep
 -- Iain Lane <email address hidden> Mon, 21 Jul 2014 22:30:44 +0100

Hello Hiren, or anyone else affected,

Accepted harfbuzz into trusty-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/harfbuzz/0.9.27-1ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Verified that ubiquity does not crash with libharfbuzz0b 0.9.27-1ubuntu1 from trusty-proposed.

This bug was fixed in the package harfbuzz - 0.9.27-1ubuntu1

---------------
harfbuzz (0.9.27-1ubuntu1) trusty; urgency=medium

  * debian/patches/0001-graphite2-Fix-cluster-mapping.patch: Cherry-pick a
    patch from upstream (in 0.9.30) to fix a crasher in the graphite2 engine
    when rendering some scripts (e.g. happens on Myanmar text). (LP: #1303516)
 -- Iain Lane <email address hidden> Mon, 21 Jul 2014 11:52:19 +0100

The verification of the Stable Release Update for harfbuzz has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.