Bug#917034: xterm crashes on certain Unicode characters when font was selected with -fa

[Alexander Meyer]

* Thomas Dickey <dickey at his.com> [2019-01-02 10:46]:

> I verified that the same issue exists in current code, and submitted an
> 
> 	https://gitlab.freedesktop.org/fontconfig/fontconfig/issues/140
> 
> with the attached fix.

As a side note, visiting that particular page causes both Chromium and
Firefox to crash in a manner that looks similar to what I reported for
xterm. Chromium crashes completely, in Firefox it's just a tab crash.

As with the xterm issue, this doesn't occur when I remove either my
fonts.conf file or the package fonts-noto-color-emoji.

These two characters appear on the page:

U+1F44D THUMBS UP SIGN
U+1F44E THUMBS DOWN SIGN

And the CSS stylesheet seems to load the "Noto Color Emoji" font.

In Firefox, the crash doesn't happen when I remove the two offending
characters from the page source /or/ when I remove the CSS file. In
Chromium, only removing the CSS file helps.

So it seems that more packages might be affected? But it's probably best
to wait for the provided patch to make it into fontconfig before taking
more time to look into this?

For the record, here's the crash report from Firefox (probably not
particularly useful due to missing symbols):
https://crash-stats.mozilla.com/report/index/afb14dec-e1f6-43dd-8852-d80670190103

And this is what Chromium outputs on the terminal:

Received signal 11 SEGV_MAPERR 000000000000
#0 0x55ed814cc9d1 <unknown>
#1 0x55ed814cb413 <unknown>
#2 0x55ed814cc945 <unknown>
#3 0x7f59461f86b0 <unknown>
#4 0x7f5942b5c2d1 <unknown>
#5 0x7f5942b5c418 <unknown>
#6 0x7f5942b5d55f FcConfigSubstituteWithPat
#7 0x7f5942b6d9bd FcFontRenderPrepare
#8 0x7f5942b6de44 FcFontMatch
#9 0x55ed81b8ec63 <unknown>
#10 0x55ed8032726f <unknown>
#11 0x55ed7f794bdc <unknown>
#12 0x55ed80326c5c <unknown>
#13 0x55ed8151395b <unknown>
#14 0x55ed81516204 <unknown>
#15 0x55ed81517363 <unknown>
#16 0x55ed81511ba0 <unknown>
#17 0x55ed81511e8a <unknown>
#18 0x55ed8152177f <unknown>
#19 0x55ed8141925d <unknown>
#20 0x55ed81496f61 <unknown>
#21 0x55ed814e1e57 <unknown>
#22 0x55ed814994c3 <unknown>
#23 0x55ed814908b6 <unknown>
#24 0x55ed81490d84 <unknown>
#25 0x55ed814dcec5 <unknown>
#26 0x7f59461edfa3 start_thread
#27 0x7f593def988f clone
  r8: 00007f5900177110  r9: 00007f5900177110 r10: 0000000000000003 r11: 0000000000000020
 r12: 000055ed88462528 r13: 00007f590002cad0 r14: 00007f59000690a0 r15: 0000000000000001
  di: 00007f590002cad0  si: 00007f59000690a0  bp: 000055ed88312ba0  bx: 0000000000000003
  dx: 0000000000000001  ax: 000055ed88312b70  cx: 0000000000000000  sp: 00007f590f7fbb40
  ip: 00007f5942b5c2d1 efl: 0000000000010202 cgf: 002b000000000033 erf: 0000000000000004
 trp: 000000000000000e msk: 0000000000000000 cr2: 0000000000000000
[end of stack trace]
Calling _exit(1). Core file will not be generated.