After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 755776 - Segmentation fault
Segmentation fault
Status: RESOLVED FIXED
Product: evince
Classification: Core
Component: printing
3.16.x
Other Linux
: Normal normal
: ---
Assigned To: Evince Maintainers
Evince Maintainers
Depends on:
Blocks:
 
 
Reported: 2015-09-29 09:01 UTC by Bob Douglas
Modified: 2016-09-03 06:40 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
A PostScript file. A PDF version of this file works fine (9.37 KB, application/postscript)
2015-09-29 09:01 UTC, Bob Douglas
  Details
Fix scaling calculation (1.61 KB, patch)
2016-05-22 16:01 UTC, Jason Crain
none Details | Review
Sample file to crash Evince after rotating/scaling or scaling/rotating (7.23 KB, image/x-eps)
2016-06-28 07:59 UTC, Paul Menzel
  Details
Fix-scaling-calculation.patch (2.11 KB, patch)
2016-08-04 20:55 UTC, Jason Crain
committed Details | Review

Description Bob Douglas 2015-09-29 09:01:34 UTC
Created attachment 312348 [details]
A PostScript file. A PDF version of this file works fine

(evince:5036): GLib-GObject-WARNING **: The property GtkSettings:gtk-menu-imagesis deprecated and shouldn't be used anymore. It will be removed in a future version
Comment 1 Germán Poo-Caamaño 2015-09-29 21:11:22 UTC
It does not crash with EV_JOBS=1, although it has problems to render a part of the document (like some bits shifted or so).

This is gdb ouput:

(gdb) r /tmp/jamie.ps
Starting program: /home/gpoo/code/evince/install/bin/evince /tmp/jamie.ps
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7fffecb69700 (LWP 3062)]

(evince:3054): GLib-GObject-WARNING **: The property GtkSettings:gtk-menu-images is deprecated and shouldn't be used anymore. It will be removed in a future version.
[New Thread 0x7fffed5f0700 (LWP 3061)]
[New Thread 0x7fffedfee700 (LWP 3060)]
[New Thread 0x7fffee7ef700 (LWP 3059)]
[New Thread 0x7fffeeff0700 (LWP 3058)]

Program received signal SIGSEGV, Segmentation fault.
sse2_blt (src_bits=<optimized out>, dst_bits=<optimized out>, src_stride=<optimized out>, dst_stride=<optimized out>, 
    src_bpp=<optimized out>, src_x=<optimized out>, src_y=108, dest_x=0, dest_y=0, width=1223, height=<optimized out>, 
    dst_bpp=<optimized out>, imp=<optimized out>) at ../../pixman/pixman-sse2.c:4767
4767	../../pixman/pixman-sse2.c: No such file or directory.
(gdb) thread apply all bt

Thread 1 (Thread 0x7ffff7fb8880 (LWP 3054))

  • #0 sse2_blt
    at ../../pixman/pixman-sse2.c line 4767
  • #1 sse2_blt
    at ../../pixman/pixman-sse2.c line 4822
  • #2 sse2_composite_copy_area
    at ../../pixman/pixman-sse2.c line 4815
  • #3 pixman_image_composite32
    at ../../pixman/pixman.c line 707
  • #4 _cairo_xlib_surface_draw_image
    at cairo-xlib-surface.c line 1149
  • #5 surface_source
    at cairo-xlib-source.c line 1025
  • #6 _cairo_xlib_source_create_for_pattern
    at cairo-xlib-source.c line 1152
  • #7 composite_aligned_boxes
    at cairo-traps-compositor.c line 1292
  • #8 clip_and_composite_boxes
    at cairo-traps-compositor.c line 1792
  • #9 clip_and_composite_boxes
    at cairo-traps-compositor.c line 1742
  • #10 _cairo_traps_compositor_paint
    at cairo-traps-compositor.c line 2063
  • #11 _cairo_compositor_paint
    at cairo-compositor.c line 65
  • #12 _cairo_surface_paint
    at cairo-surface.c line 2117
  • #13 _cairo_gstate_paint
    at cairo-gstate.c line 1067
  • #14 INT_cairo_paint
    at cairo.c line 2003
  • #15 draw_surface
    at ev-view.c line 6620
  • #16 draw_one_page
    at ev-view.c line 6731
  • #17 ev_view_draw
    at ev-view.c line 4564
  • #18 _gtk_marshal_BOOLEAN__BOXEDv
    at gtkmarshalers.c line 130
  • #19 gtk_widget_draw_marshallerv
    at gtkwidget.c line 1100
  • #20 _g_closure_invoke_va
    at gclosure.c line 864
  • #21 g_signal_emit_valist
    at gsignal.c line 3216
  • #22 g_signal_emit
    at gsignal.c line 3363
  • #23 _gtk_widget_draw_internal
    at gtkwidget.c line 6976
  • #24 _gtk_widget_draw_internal
  • #25 _gtk_widget_draw_windows
    at gtkwidget.c line 7077
  • #26 _gtk_widget_draw
    at gtkwidget.c line 7148
  • #27 gtk_container_propagate_draw
    at gtkcontainer.c line 3748
  • #28 gtk_container_draw
    at gtkcontainer.c line 3583
  • #29 gtk_scrolled_window_draw
    at gtkscrolledwindow.c line 2232
  • #30 _gtk_marshal_BOOLEAN__BOXEDv
    at gtkmarshalers.c line 130
  • #31 gtk_widget_draw_marshallerv
    at gtkwidget.c line 1100
  • #32 _g_closure_invoke_va
    at gclosure.c line 864
  • #33 g_signal_emit_valist
    at gsignal.c line 3216
  • #34 g_signal_emit
    at gsignal.c line 3363
  • #35 _gtk_widget_draw_internal
    at gtkwidget.c line 6976
  • #36 _gtk_widget_draw_internal
    at gtkwidget.c line 6954
  • #37 _gtk_widget_draw_windows
    at gtkwidget.c line 7077
  • #38 _gtk_widget_draw
    at gtkwidget.c line 7148
  • #39 gtk_container_propagate_draw
    at gtkcontainer.c line 3748
  • #40 gtk_container_draw
    at gtkcontainer.c line 3583
  • #41 _gtk_marshal_BOOLEAN__BOXEDv
    at gtkmarshalers.c line 130
  • #42 gtk_widget_draw_marshallerv
    at gtkwidget.c line 1100
  • #43 _g_closure_invoke_va
    at gclosure.c line 864
  • #44 g_signal_emit_valist
    at gsignal.c line 3216
  • #45 g_signal_emit
    at gsignal.c line 3363
  • #46 _gtk_widget_draw_internal
    at gtkwidget.c line 6976
  • #47 _gtk_widget_draw_internal
    at gtkwidget.c line 7163
  • #48 _gtk_widget_draw
    at gtkwidget.c line 7154
  • #49 gtk_container_propagate_draw
    at gtkcontainer.c line 3748
  • #50 gtk_container_draw
    at gtkcontainer.c line 3583
  • #51 gtk_box_draw
    at gtkbox.c line 448
  • #52 _gtk_marshal_BOOLEAN__BOXEDv
    at gtkmarshalers.c line 130
  • #53 gtk_widget_draw_marshallerv
    at gtkwidget.c line 1100
  • #54 _g_closure_invoke_va
    at gclosure.c line 864
  • #55 g_signal_emit_valist
    at gsignal.c line 3216
  • #56 g_signal_emit
    at gsignal.c line 3363
  • #57 _gtk_widget_draw_internal
    at gtkwidget.c line 6976
  • #58 _gtk_widget_draw_internal
    at gtkwidget.c line 7163
  • #59 _gtk_widget_draw
    at gtkwidget.c line 7154
  • #60 gtk_container_propagate_draw
    at gtkcontainer.c line 3748
  • #61 gtk_container_draw
    at gtkcontainer.c line 3583
  • #62 gtk_paned_draw
    at gtkpaned.c line 1756
  • #63 _gtk_marshal_BOOLEAN__BOXEDv
    at gtkmarshalers.c line 130
  • #64 gtk_widget_draw_marshallerv
    at gtkwidget.c line 1100
  • #65 _g_closure_invoke_va
    at gclosure.c line 864
  • #66 g_signal_emit_valist
    at gsignal.c line 3216
  • #67 g_signal_emit
    at gsignal.c line 3363
  • #68 _gtk_widget_draw_internal
    at gtkwidget.c line 6976
  • #69 _gtk_widget_draw_internal
    at gtkwidget.c line 6954
  • #70 _gtk_widget_draw_windows
    at gtkwidget.c line 7077
  • #71 _gtk_widget_draw
    at gtkwidget.c line 7173
  • #72 gtk_container_propagate_draw
    at gtkcontainer.c line 3748
  • #73 gtk_container_draw
    at gtkcontainer.c line 3583
  • #74 gtk_box_draw
    at gtkbox.c line 448
  • #75 _gtk_marshal_BOOLEAN__BOXEDv
    at gtkmarshalers.c line 130
  • #76 gtk_widget_draw_marshallerv
    at gtkwidget.c line 1100
  • #77 _g_closure_invoke_va
    at gclosure.c line 864
  • #78 g_signal_emit_valist
    at gsignal.c line 3216
  • #79 g_signal_emit
    at gsignal.c line 3363
  • #80 _gtk_widget_draw_internal
    at gtkwidget.c line 6976
  • #81 _gtk_widget_draw_internal
    at gtkwidget.c line 7163
  • #82 _gtk_widget_draw
    at gtkwidget.c line 7154
  • #83 gtk_container_propagate_draw
    at gtkcontainer.c line 3748
  • #84 gtk_container_draw
    at gtkcontainer.c line 3583
  • #85 gtk_window_draw
    at gtkwindow.c line 9812
  • #86 _gtk_marshal_BOOLEAN__BOXEDv
  • #87 gtk_widget_draw_marshallerv
    at gtkwidget.c line 1100
  • #88 _g_closure_invoke_va
    at gclosure.c line 864
  • #89 g_signal_emit_valist
    at gsignal.c line 3216
  • #90 g_signal_emit
    at gsignal.c line 3363
  • #91 _gtk_widget_draw_internal
    at gtkwidget.c line 6976
  • #92 _gtk_widget_draw_internal
    at gtkwidget.c line 6954
  • #93 _gtk_widget_draw_windows
    at gtkwidget.c line 7077
  • #94 _gtk_widget_draw
    at gtkwidget.c line 7148
  • #95 gtk_widget_send_expose
    at gtkwidget.c line 7625
  • #96 gtk_main_do_event
    at gtkmain.c line 1678
  • #97 _gdk_window_process_updates_recurse_helper
    at gdkwindow.c line 3556
  • #98 gdk_window_process_updates_internal
    at gdkwindow.c line 3681
  • #99 gdk_window_process_updates_with_mode
    at gdkwindow.c line 3882
  • #100 _g_closure_invoke_va
    at gclosure.c line 864
  • #101 g_signal_emit_valist
    at gsignal.c line 3216
  • #102 g_signal_emit_by_name
    at gsignal.c line 3403
  • #103 gdk_frame_clock_paint_idle
    at gdkframeclockidle.c line 430
  • #104 gdk_threads_dispatch
    at gdk.c line 717
  • #105 g_timeout_dispatch
    at gmain.c line 4545
  • #106 g_main_dispatch
    at gmain.c line 3122
  • #107 g_main_context_dispatch
    at gmain.c line 3737
  • #108 g_main_context_iterate
    at gmain.c line 3808
  • #109 g_main_context_iteration
    at gmain.c line 3869
  • #110 g_application_run
    at gapplication.c line 2308
  • #111 main
    at main.c line 316

Comment 2 Jason Crain 2016-04-16 20:34:46 UTC
There are other documents that cause this crash in https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=766836 and the several merged bugs.  I found this commit with git bisect:

commit 6b50ba7172d84de19f1215bed289698d82ea4187
Author: Owen W. Taylor <otaylor@fishsoup.net>

    Switch to specifying rendered output in pixels, not as a scale

Adding Owen to CC list to see if he can comment.  It looks kind of like the width and height are getting mixed up.
Comment 3 Jason Crain 2016-05-22 16:01:22 UTC
Created attachment 328351 [details] [review]
Fix scaling calculation

Since the change to specify rendering output in pixels instead of a scale, the scaling passed to spectre_render_context_set_scale has the width and height swapped for rotated documents.  This fixes the scaling calculation.

The rendering will still be wrong because it runs into https://bugs.freedesktop.org/76450 from libspectre (Documents are not rotated correctly), but this fixes the crash, and the rendering works if I test with a patched libspectre.
Comment 4 Carlos Garcia Campos 2016-05-24 11:26:12 UTC
Comment on attachment 328351 [details] [review]
Fix scaling calculation

Thanks!
Comment 5 Paul Menzel 2016-06-28 07:59:32 UTC
Created attachment 330475 [details]
Sample file to crash Evince after rotating/scaling or scaling/rotating

Applying the patch, rebuilding Evince and installing it in `/usr/local/bin`, running it from there, it crashes with the attached file.

You need to rotate the file, and zoom in/out (or have done it before).
Comment 6 Jason Crain 2016-06-28 18:01:05 UTC
(In reply to Paul Menzel from comment #5)
> Applying the patch, rebuilding Evince and installing it in `/usr/local/bin`,
> running it from there, it crashes with the attached file.

I don't see any crashes after patching evince.  I just see some UI glitches and 'matrix not invertable' warning messages and those are fixed by running an updated libspectre.  Does it work if you also use the latest libspectre from git master?
Comment 7 Paul Menzel 2016-06-29 08:50:17 UTC
Did you try the attached EPS file?
Comment 8 Jason Crain 2016-06-29 15:49:04 UTC
(In reply to Paul Menzel from comment #7)
> Did you try the attached EPS file?

Yes, I tried it with your crash-evince.eps file.  With the patch applied, I can't get it to crash, though I do see UI glitches and matrix not invertible warnings.  I would not be too surprised if it did crash because I'm not sure what libspectre does when it does the rotation wrong, but the latest libspectre should fix that.  Have you tried it with both a patched evince and an updated libspectre?
Comment 9 Paul Menzel 2016-07-05 08:27:54 UTC
(In reply to Jason Crain from comment #8)
> (In reply to Paul Menzel from comment #7)
> > Did you try the attached EPS file?
> 
> Yes, I tried it with your crash-evince.eps file.  With the patch applied, I
> can't get it to crash, though I do see UI glitches and matrix not invertible
> warnings.  I would not be too surprised if it did crash because I'm not sure
> what libspectre does when it does the rotation wrong, but the latest
> libspectre should fix that.  Have you tried it with both a patched evince
> and an updated libspectre?

I now installed libspectre 0.2.8 containing the changes, and even unpatched Evince 3.20.1 doesn’t crash when rotating the EPS. So it seems to be a different problem. Sorry f or the noise.
Comment 10 José Aliste 2016-08-01 19:41:31 UTC
Jason, it seems your patch is not yet committed. Is there any reason?
Comment 11 Jason Crain 2016-08-02 15:26:39 UTC
(In reply to José Aliste from comment #10)
> Jason, it seems your patch is not yet committed. Is there any reason?

Um.. hold off on this patch for now.  From looking at this after not having worked on it for a while, I see:

1. The crash and rotation are fixed by the latest libspectre.

2. The width and height calculation in evince is not the cause of the crash, but is still wrong.  The effect is that the aspect ratio of the thumbnails in the sidebar is wrong and resolution in the main window is wrong.  My patch maybe improves it a little but it's still not correct.  Give me a day or two to fix it.
Comment 12 Jason Crain 2016-08-04 20:55:52 UTC
Created attachment 332751 [details] [review]
Fix-scaling-calculation.patch

Improved patch.  Previous version had an interaction between evince's rotation and the document's internal rotation so it got the aspect ratio and scaling wrong for some rotations.
Comment 13 Paul Menzel 2016-08-05 08:09:03 UTC
Should the ticket summary/title be updated or a new ticket be created, as the segmentation fault has been fixed already?
Comment 14 Carlos Garcia Campos 2016-09-03 06:40:34 UTC
Comment on attachment 332751 [details] [review]
Fix-scaling-calculation.patch

Pushed, thanks!