GNOME Bugzilla – Bug 538179
crash in Document Viewer: opening a pdf
Last modified: 2008-12-11 21:08:13 UTC
Version: 2.22.2 What were you doing when the application crashed? opening a pdf Distribution: Debian lenny/sid Gnome Release: 2.22.2 2008-05-29 (Debian) BugBuddy Version: 2.22.0 System: Linux 2.6.26-rc5-sonne #29 SMP PREEMPT Thu Jun 12 13:48:05 CEST 2008 i686 X Vendor: The X.Org Foundation X Vendor Release: 10400090 Selinux: No Accessibility: Disabled GTK+ Theme: Clearlooks Icon Theme: gnome Memory status: size: 63303680 vsize: 63303680 resident: 34234368 share: 12734464 rss: 34234368 rss_rlim: 4294967295 CPU usage: start_time: 1213381150 rtime: 101 utime: 91 stime: 10 cutime:0 cstime: 0 timeout: 0 it_real_value: 0 frequency: 100 Backtrace was generated from '/usr/bin/evince' [Thread debugging using libthread_db enabled] [New Thread 0xb6c2e940 (LWP 29317)] [New Thread 0xb68d4b90 (LWP 29318)] 0xb80d0424 in __kernel_vsyscall ()
+ Trace 200338
Thread 2 (Thread 0xb68d4b90 (LWP 29318))
----------- .xsession-errors --------------------- evince: ../../src/xcb_lock.c:33: _XCBUnlockDisplay: Assertion `xcb_get_request_sent(dpy->xcb->connection) == dpy->request' failed. Multiple segmentation faults occurred; can't display error dialog Window manager warning: Buggy client sent a _NET_ACTIVE_WINDOW message with a timestamp of 0 for 0x2600003 (Evince Doc) Window manager warning: meta_window_activate called by a pager with a 0 timestamp; the pager needs to be fixed. Cannot access memory at address 0xd Cannot access memory at address 0xd --------------------------------------------------
Is it possible to have a copy of the pdf file ? I had (and fixed) a similar bug yesterday
*** Bug 536216 has been marked as a duplicate of this bug. ***
*** Bug 538721 has been marked as a duplicate of this bug. ***
*** Bug 538759 has been marked as a duplicate of this bug. ***
*** Bug 538761 has been marked as a duplicate of this bug. ***
Dear reporters, could you please post a copy of the PDF file that triggers this crash?
Hi developers, I think I need your help. I've found a file that is causing this segfault. It is the apple human guidelines. After reading carefully backtraces and gdb outputs. I think I've located the segfault. Here is the function causing the bug. OptionalContentGroup* OCGs::findOcgByRef( const Ref &ref) { //TODO: make this more efficient OptionalContentGroup *ocg = NULL; for (int i=0; i < optionalContentGroups->getLength(); ++i) { ocg = (OptionalContentGroup*)optionalContentGroups->get(i); if ( (ocg->ref().num == ref.num) && (ocg->ref().gen == ref.gen) ) { return ocg; } } // not found return NULL; } Indeed the segfault is caused by a null reference of optionalContentGroups. If I had a test around the function to test if this reference is null or not, the bug is obsviously fixed but it is wrong ! I think we need to spot where the problem really come from. Do you have any tips to give to me to find the source of the bug ? Thanks for your help.
Also, you can see http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=484224 for a crashing pdf file.
You can just check that ocg is not NULL befor using it. This will fix the bug.
Created attachment 113098 [details] [review] Patch for poppler library
Here is a proposal of patch. Thanks for reviewing it. (Sorry for the two messages, I saw too late I'm able to put comments on attachment)
Thanks a lot Antoine. But there is one issue, we can't really review this patch since we don't manage poppler. Can you please forward this bug and patch in poppler bugzilla on http://poppler.freedesktop.org
No, please. This crash was already fixed in poppler. I think the problem is in the document itself though, since it doesn't have an OCProperties dictionary in the catalog. At least poppler doesn't crash anymore. Sorry for not answering before, thanks for your help.
In which poppler version has this bug in poppler been fixed?
poppler 0.8.3
*** Bug 539389 has been marked as a duplicate of this bug. ***
*** Bug 539583 has been marked as a duplicate of this bug. ***
*** Bug 540294 has been marked as a duplicate of this bug. ***
*** Bug 540609 has been marked as a duplicate of this bug. ***
*** Bug 540613 has been marked as a duplicate of this bug. ***
*** Bug 540824 has been marked as a duplicate of this bug. ***
*** Bug 541679 has been marked as a duplicate of this bug. ***
*** Bug 541849 has been marked as a duplicate of this bug. ***
*** Bug 542681 has been marked as a duplicate of this bug. ***
*** Bug 543067 has been marked as a duplicate of this bug. ***
*** Bug 543124 has been marked as a duplicate of this bug. ***
*** Bug 543530 has been marked as a duplicate of this bug. ***
*** Bug 544471 has been marked as a duplicate of this bug. ***
*** Bug 545324 has been marked as a duplicate of this bug. ***
*** Bug 564096 has been marked as a duplicate of this bug. ***