Bug 701703 – Random segfault when browsing the index

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 701703 - Random segfault when browsing the index


Summary:	Random segfault when browsing the index


Status:	RESOLVED DUPLICATE of bug 697397

Product:	evince
Classification:	Core
Component:	general
Version:	3.8.x
Hardware:	Other Linux

Importance:	Normal critical
Target Milestone:	---
Assigned To:	Evince Maintainers
QA Contact:	Evince Maintainers

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2013-06-06 10:07 UTC by damienrg
Modified:	2013-06-08 17:53 UTC

See Also:
GNOME target:	---
GNOME version:	---

Attachments
valgrind log (2.13 KB, text/plain) 2013-06-06 10:07 UTC, damienrg	Details
backtrace (9.58 KB, text/plain) 2013-06-06 10:14 UTC, damienrg	Details
another valgrind log (16.12 KB, text/plain) 2013-06-06 11:00 UTC, damienrg	Details
associated backtrace of another valgrind log (13.87 KB, text/plain) 2013-06-06 11:01 UTC, damienrg	Details

Description damienrg 2013-06-06 10:07:27 UTC

Created attachment 246131 [details]
valgrind log

When using evince I got few random crash. unfortunately I did not find a way to always reproduce the bug. Most of the time it happens when I click on a paragraph in the index view of the side pane.

Note: I am using debian sid/experimental but I think it does not count as there is a also a report for fedora (https://bugzilla.redhat.com/show_bug.cgi?id=965626).

Comment 1 damienrg 2013-06-06 10:14:25 UTC

Created attachment 246132 [details]
backtrace

Comment 2 damienrg 2013-06-06 11:00:14 UTC

Created attachment 246141 [details]
another valgrind log

Another valgrind log produced with same steps (browsing page and click on index) which look likes the bug https://bugzilla.redhat.com/show_bug.cgi?id=965626).

Comment 3 damienrg 2013-06-06 11:01:07 UTC

Created attachment 246142 [details]
associated backtrace of another valgrind log

Comment 4 damienrg 2013-06-07 12:30:34 UTC

Step to reproduce:
1. download a pdf which contains index (e.g: http://people.gnome.org/~mccann/shell/design/GNOME_Shell-20090705.pdf)
2. open it with evince
3. in evince side pane select the index view
4. click on paragraph in the index view (so you have the focus on the index view)
5. press key up/down repeatedly
6. segfault

Unfortunately with valgrind the above steps does not necessarily produce the bug because of the big overhead introduced by valgrind.

Comment 5 Germán Poo-Caamaño 2013-06-07 18:56:15 UTC

This is what I get with 3.8.2:

(evince:14071): EvinceDocument-CRITICAL **: ev_link_get_action: assertion `EV_IS_LINK (self)' failed

(evince:14071): EvinceDocument-CRITICAL **: ev_link_action_equal: assertion `EV_IS_LINK_ACTION (a)' failed

(evince:14071): GLib-GObject-CRITICAL **: g_object_unref: assertion `G_IS_OBJECT (object)' failed

Program received signal SIGSEGV, Segmentation fault.
magazine_chain_pop_head (magazine_chunks=0x80ac6d8) at gslice.c:532
532	      (*magazine_chunks)->data = chunk->next;

+ Trace 232024

#0 magazine_chain_pop_head
at gslice.c line 532
#1 thread_memory_magazine1_alloc
at gslice.c line 835
#2 g_slice_alloc
at gslice.c line 994
#3 g_string_sized_new
at gstring.c line 126
#4 g_string_new
at gstring.c line 152
#5 g_log_default_handler
#6 g_logv
at gmessages.c line 949
#7 g_log
at gmessages.c line 1010
#8 g_return_if_fail_warning
#9 g_object_ref
at gobject.c line 2885
#10 g_list_foreach
at glist.c line 949
#11 _gdk_window_process_updates_recurse
at gdkwindow.c line 4032
#12 gdk_x11_window_process_updates_recurse
at gdkwindow-x11.c line 5203
#13 gdk_window_process_updates_internal
at gdkwindow.c line 4194
#14 gdk_window_process_updates_with_mode
at gdkwindow.c line 4374
#15 gdk_window_process_updates_with_mode
at gdkwindow.c line 4351
#16 g_cclosure_marshal_VOID__VOIDv
at gmarshal.c line 115
#17 _g_closure_invoke_va
at gclosure.c line 840
#18 g_signal_emit_valist
at gsignal.c line 3234
#19 g_signal_emit_by_name
at gsignal.c line 3424
#20 gdk_frame_clock_paint_idle
at gdkframeclockidle.c line 419
#21 gdk_threads_dispatch
at gdk.c line 788
#22 g_timeout_dispatch
at gmain.c line 4413
#23 g_main_dispatch
at gmain.c line 3054
#24 g_main_context_dispatch
at gmain.c line 3630
#25 g_main_context_iterate
at gmain.c line 3701
#26 g_main_context_iterate
at gmain.c line 3638
#27 g_main_context_iteration
at gmain.c line 3762
#28 g_application_run
at gapplication.c line 1623
#29 main
at main.c line 332

Comment 6 Germán Poo-Caamaño 2013-06-07 20:33:36 UTC

This is the output I get with master, but it seems a different one.  Anyhow, the output in the screen is:

(evince:4101): EvinceDocument-CRITICAL **: ev_link_get_action: assertion `EV_IS_LINK (self)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_action_equal: assertion `EV_IS_LINK_ACTION (a)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_get_action: assertion `EV_IS_LINK (self)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_action_equal: assertion `EV_IS_LINK_ACTION (a)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_get_action: assertion `EV_IS_LINK (self)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_action_equal: assertion `EV_IS_LINK_ACTION (a)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_get_action: assertion `EV_IS_LINK (self)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_action_equal: assertion `EV_IS_LINK_ACTION (a)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_get_action: assertion `EV_IS_LINK (self)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_action_equal: assertion `EV_IS_LINK_ACTION (a)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_get_action: assertion `EV_IS_LINK (self)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_action_equal: assertion `EV_IS_LINK_ACTION (a)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_get_action: assertion `EV_IS_LINK (self)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_action_equal: assertion `EV_IS_LINK_ACTION (a)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_get_action: assertion `EV_IS_LINK (self)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_action_equal: assertion `EV_IS_LINK_ACTION (a)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_get_action: assertion `EV_IS_LINK (self)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_action_equal: assertion `EV_IS_LINK_ACTION (a)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_get_action: assertion `EV_IS_LINK (self)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_action_equal: assertion `EV_IS_LINK_ACTION (a)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_get_action: assertion `EV_IS_LINK (self)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_action_equal: assertion `EV_IS_LINK_ACTION (a)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_get_action: assertion `EV_IS_LINK (self)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_action_equal: assertion `EV_IS_LINK_ACTION (a)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_get_action: assertion `EV_IS_LINK (self)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_action_equal: assertion `EV_IS_LINK_ACTION (a)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_get_action: assertion `EV_IS_LINK (self)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_action_equal: assertion `EV_IS_LINK_ACTION (a)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_get_action: assertion `EV_IS_LINK (self)' failed

(evince:4101): EvinceDocument-CRITICAL **: ev_link_action_equal: assertion `EV_IS_LINK_ACTION (a)' failed

(evince:4101): Gdk-WARNING **: losing last reference to undestroyed window

evince: cairo-region.c:423: cairo_region_destroy: Assertion `((*&(&region->ref_count)->ref_count) > 0)' failed.

Program received signal SIGABRT, Aborted.
0xb7fdd424 in __kernel_vsyscall ()

The bt full is:

+ Trace 232025

#0 __kernel_vsyscall
#1 __GI_raise
at ../nptl/sysdeps/unix/sysv/linux/raise.c line 64
#2 __GI_abort
at abort.c line 91
#3 __assert_fail_base
#4 __GI___assert_fail
#5 *INT_cairo_region_destroy
at cairo-region.c line 423
#6 *INT_cairo_region_destroy
at cairo-region.c line 418
#7 recompute_visible_regions_internal
at gdkwindow.c line 1047
#8 recompute_visible_regions_internal
at gdkwindow.c line 1129
#9 recompute_visible_regions
at gdkwindow.c line 1169
#10 _gdk_window_destroy_hierarchy
at gdkwindow.c line 2076
#11 _gdk_window_destroy_hierarchy
at gdkwindow.c line 2005
#12 gdk_window_finalize
at gdkwindow.c line 547
#13 g_object_unref
at gobject.c line 3024
#14 g_list_foreach
at glist.c line 949
#15 g_list_free_full
at glist.c line 187
#16 ev_history_add_link
at ev-history.c line 136
#17 view_handle_link_cb
at ev-window.c line 858
#18 g_cclosure_marshal_VOID__OBJECTv
at gmarshal.c line 1312
#19 _g_closure_invoke_va
at gclosure.c line 840
#20 g_signal_emit_valist
at gsignal.c line 3234
#21 g_signal_emit
at gsignal.c line 3384
#22 ev_view_handle_link
at ev-view.c line 1857
#23 g_cclosure_marshal_VOID__OBJECTv
at gmarshal.c line 1312
#24 _g_closure_invoke_va
at gclosure.c line 840
#25 g_signal_emit_valist
at gsignal.c line 3234
#26 g_signal_emit
at gsignal.c line 3384
#27 selection_changed_callback
at ev-sidebar-links.c line 238
#28 g_cclosure_marshal_VOID__VOIDv
at gmarshal.c line 115
#29 _g_closure_invoke_va
at gclosure.c line 840
#30 g_signal_emit_valist
at gsignal.c line 3234
#31 g_signal_emit
at gsignal.c line 3384
#32 _gtk_tree_selection_internal_select_node
at gtktreeselection.c line 1604
#33 gtk_tree_view_real_set_cursor
at gtktreeview.c line 13208
#34 gtk_tree_view_move_cursor_up_down
at gtktreeview.c line 10341
#35 gtk_tree_view_real_move_cursor
at gtktreeview.c line 8605
#36 _gtk_marshal_BOOLEAN__ENUM_INT
at gtkmarshalers.c line 531
#37 g_type_class_meta_marshal
at gclosure.c line 970
#38 g_closure_invoke
at gclosure.c line 777
#39 signal_emit_unlocked_R
at gsignal.c line 3622
#40 g_signal_emitv
at gsignal.c line 3059
#41 gtk_binding_entry_activate
at gtkbindings.c line 651
#42 binding_activate
at gtkbindings.c line 1523
#43 gtk_bindings_activate_list
at gtkbindings.c line 1584
#44 gtk_bindings_activate_event
at gtkbindings.c line 1669
#45 gtk_widget_real_key_press_event
at gtkwidget.c line 6238
#46 gtk_tree_view_key_press
at gtktreeview.c line 5788
#47 gtk_tree_view_key_press
at gtktreeview.c line 5662
#48 _gtk_marshal_BOOLEAN__BOXEDv
at gtkmarshalers.c line 130
#49 g_type_class_meta_marshalv
at gclosure.c line 997
#50 _g_closure_invoke_va
at gclosure.c line 840
#51 g_signal_emit_valist
at gsignal.c line 3234
#52 g_signal_emit
at gsignal.c line 3384
#53 gtk_widget_event_internal
at gtkwidget.c line 6714
#54 gtk_window_propagate_key_event
at gtkwindow.c line 6042
#55 ev_window_key_press_event
at ev-window.c line 5745
#56 _gtk_marshal_BOOLEAN__BOXEDv
at gtkmarshalers.c line 130
#57 g_type_class_meta_marshalv
at gclosure.c line 997
#58 _g_closure_invoke_va
at gclosure.c line 840
#59 g_signal_emit_valist
at gsignal.c line 3234
#60 g_signal_emit
at gsignal.c line 3384
#61 gtk_widget_event_internal
at gtkwidget.c line 6714
#62 propagate_event
at gtkmain.c line 2490
#63 gtk_main_do_event
at gtkmain.c line 1716
#64 _gdk_event_emit
at gdkevents.c line 69
#65 gdk_event_source_dispatch
at gdkeventsource.c line 364
#66 g_main_dispatch
at gmain.c line 3054
#67 g_main_context_dispatch
at gmain.c line 3630
#68 g_main_context_iterate
at gmain.c line 3701
#69 g_main_context_iterate
at gmain.c line 3638
#70 g_main_context_iteration
at gmain.c line 3762
#71 g_application_run
at gapplication.c line 1623
#72 main
at main.c line 332

Comment 7 Germán Poo-Caamaño 2013-06-07 20:39:01 UTC

Because of the previous warnings, I ran --g-fatal-warnings.  This bt is the bt.

+ Trace 232026

#0 magazine_chain_pop_head
at gslice.c line 532
#1 thread_memory_magazine1_alloc
at gslice.c line 835
#2 g_slice_alloc
at gslice.c line 994
#3 pango_attr_list_new
at pango-attributes.c line 1113
#4 pango_markup_parser_new_internal
at pango-markup.c line 579
#5 pango_parse_markup
at pango-markup.c line 662
#6 gtk_cell_renderer_text_set_property
at gtkcellrenderertext.c line 1207
#7 object_set_property
at gobject.c line 1358
#8 g_object_set_property
at gobject.c line 2155
#9 apply_cell_attributes
at gtkcellarea.c line 1277
#10 g_hash_table_foreach
at ghash.c line 1526
#11 gtk_cell_area_real_apply_attributes
at gtkcellarea.c line 1313
#12 gtk_cell_area_box_apply_attributes
at gtkcellareabox.c line 1317
#13 _gtk_marshal_VOID__OBJECT_BOXED_BOOLEAN_BOOLEANv
at gtkmarshalers.c line 4960
#14 g_type_class_meta_marshalv
at gclosure.c line 997
#15 _g_closure_invoke_va
at gclosure.c line 840
#16 g_signal_emit_valist
at gsignal.c line 3234
#17 g_signal_emit
at gsignal.c line 3384
#18 gtk_cell_area_apply_attributes
at gtkcellarea.c line 2362
#19 gtk_tree_view_column_cell_set_cell_data
at gtktreeviewcolumn.c line 2867
#20 gtk_tree_view_bin_draw
at gtktreeview.c line 4984
#21 gtk_tree_view_draw
at gtktreeview.c line 5393
#22 _gtk_marshal_BOOLEAN__BOXEDv
at gtkmarshalers.c line 130
#23 gtk_widget_draw_marshallerv
at gtkwidget.c line 906
#24 g_type_class_meta_marshalv
at gclosure.c line 997
#25 _g_closure_invoke_va
at gclosure.c line 840
#26 g_signal_emit_valist
at gsignal.c line 3234
#27 g_signal_emit
at gsignal.c line 3384
#28 _gtk_widget_draw_internal
at gtkwidget.c line 6165
#29 _gtk_widget_draw_internal
at gtkwidget.c line 6143
#30 gtk_widget_send_expose
at gtkwidget.c line 6545
#31 gtk_main_do_event
at gtkmain.c line 1619
#32 _gdk_event_emit
at gdkevents.c line 69
#33 _gdk_window_process_updates_recurse
at gdkwindow.c line 4006
#34 _gdk_window_process_updates_recurse
at gdkwindow.c line 4051
#35 _gdk_window_process_updates_recurse
at gdkwindow.c line 4051
#36 _gdk_window_process_updates_recurse
at gdkwindow.c line 4051
#37 _gdk_window_process_updates_recurse
at gdkwindow.c line 4051
#38 gdk_x11_window_process_updates_recurse
at gdkwindow-x11.c line 5203
#39 gdk_window_process_updates_internal
at gdkwindow.c line 4194
#40 gdk_window_process_updates_with_mode
at gdkwindow.c line 4374
#41 gdk_window_process_updates_with_mode
at gdkwindow.c line 4351
#42 g_cclosure_marshal_VOID__VOIDv
at gmarshal.c line 115
#43 _g_closure_invoke_va
at gclosure.c line 840
#44 g_signal_emit_valist
at gsignal.c line 3234
#45 g_signal_emit_by_name
at gsignal.c line 3424
#46 gdk_frame_clock_paint_idle
at gdkframeclockidle.c line 419
#47 gdk_threads_dispatch
at gdk.c line 788
#48 g_timeout_dispatch
at gmain.c line 4413
#49 g_main_dispatch
at gmain.c line 3054
#50 g_main_context_dispatch
at gmain.c line 3630
#51 g_main_context_iterate
at gmain.c line 3701
#52 g_main_context_iterate
at gmain.c line 3638
#53 g_main_context_iteration
at gmain.c line 3762
#54 g_application_run
at gapplication.c line 1623
#55 main
at main.c line 332

Comment 8 Germán Poo-Caamaño 2013-06-08 17:53:55 UTC

The stack traces are similar, so I am closing this one as duplicated.

*** This bug has been marked as a duplicate of bug 697397 ***