After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 680094 - Segfault with PDF document
Segfault with PDF document
Status: RESOLVED NOTGNOME
Product: evince
Classification: Core
Component: general
3.4.x
Other Linux
: High critical
: ---
Assigned To: Evince Maintainers
Evince Maintainers
Depends on:
Blocks:
 
 
Reported: 2012-07-17 13:00 UTC by Karol Babioch
Modified: 2013-06-14 01:08 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
A trace log of the segfaulting (4.46 KB, text/x-log)
2012-07-17 13:00 UTC, Karol Babioch
Details
Tracelog with more debug symbols (3.41 KB, text/x-log)
2012-07-17 17:21 UTC, Karol Babioch
Details

Description Karol Babioch 2012-07-17 13:00:11 UTC
Created attachment 219018 [details]
A trace log of the segfaulting

I keep getting segfaults with a PDF document. There seems to be a random factor involved as this happens not every time, and not at a particular page, but whenever scrolling through the document there is a fairly good chance that evince will crash with a segfault.

I've attached a trace log. I'm not sure whether it is useful or not, at least the segfault gets mentioned. Let me know if you need anything else.
Comment 1 André Klapper 2012-07-17 15:55:50 UTC
Thanks for taking the time to report this bug.
Unfortunately, that stack trace is missing some elements that will help a lot to solve the problem, so it will be hard for the developers to fix that crash. Can you get us a stack trace with debugging symbols for (lib)poppler, (lib)cairo, and (lib)glib2? 
Please see http://live.gnome.org/GettingTraces for more information on how to do so and reopen this bug or report a new one. Thanks in advance!
Comment 2 Karol Babioch 2012-07-17 17:21:09 UTC
Created attachment 219042 [details]
Tracelog with more debug symbols
Comment 3 Karol Babioch 2012-07-17 17:26:06 UTC
I've uploaded another trace log. For whatever reason it is even smaller than the first one, although I've recompiled the packages you were talking about with the appropriate debug options.

Hopefully it is more of a help than the first one. Otherwise let me know what else you would like to have. I know that you don't want the document itself, but as a kind of a last resort I can upload it, too. After all I'm not familiar with gdb, so I'm just blindly entering commands I've found somewhere ;).
Comment 4 José Aliste 2012-07-17 17:37:52 UTC
Starting program: /usr/bin/evince 
warning: Could not load shared library symbols for linux-vdso.so.1.
Do you need "set solib-search-path" or "set sysroot"?
Traceback (most recent call last):
  File "/usr/share/gdb/auto-load/usr/lib/libgobject-2.0.so.0.3200.3-gdb.py", line 9, in <module>
    from gobject import register
  File "/usr/share/glib-2.0/gdb/gobject.py", line 3, in <module>
    import gdb.backtrace
ImportError: No module named backtrace
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/libthread_db.so.1".
[New Thread 0x7fffed9e1700 (LWP 24227)]
[New Thread 0x7fffed1e0700 (LWP 24228)]
[New Thread 0x7fffe6e3f700 (LWP 24229)]
[New Thread 0x7fffe663e700 (LWP 24235)]

Program received signal SIGSEGV, Segmentation fault.

Thread 140737058694912 (LWP 24235)

  • #0 INT_cairo_set_source
    at cairo.c line 794
  • #1 CairoOutputDev::setSoftMaskFromImageMask
    at CairoOutputDev.cc line 1864
  • #2 Gfx::doPatternImageMask
    at Gfx.cc line 2036
  • #3 Gfx::doImage
    at Gfx.cc line 4295
  • #4 Gfx::opXObject
    at Gfx.cc line 4119
  • #5 Gfx::execOp
    at Gfx.cc line 857
  • #6 Gfx::go
    at Gfx.cc line 716
  • #7 Gfx::display
    at Gfx.cc line 682
  • #8 Page::display
    at Page.cc line 555
  • #9 poppler_page_get_image_output_dev
    at poppler-page.cc line 928
  • #10 poppler_page_get_image_mapping
    at poppler-page.cc line 953
  • #11 pdf_document_images_get_image_mapping
    at ev-poppler.cc line 1426
  • #12 ev_document_images_get_image_mapping
    at ev-document-images.c line 37
  • #13 ev_job_page_data_run
    at ev-jobs.c line 736
  • #14 ev_job_run
    at ev-jobs.c line 213
  • #15 ev_job_thread
    at ev-job-scheduler.c line 204
  • #16 ev_job_thread_proxy
    at ev-job-scheduler.c line 237
  • #17 g_thread_proxy
    at gthread.c line 801
  • #18 start_thread
    from /lib/libpthread.so.0
  • #19 clone
    from /lib/libc.so.6

Comment 5 José Aliste 2012-07-17 17:41:50 UTC
The second trace is more useful. Could you please provide the pdf file also? My feeling is that this is either a poppler or cairo bug, but we would need the pdf file to confirm that.
Comment 6 Karol Babioch 2012-07-17 17:48:38 UTC
Unfortunately the document is quite big (8,5 MB), so I can't upload it here. Therefore I've uploaded it over at fileconvoy.com. You'll find it here [1].

[1] http://www.fileconvoy.com/dfl.php?id=gb250729c110ebb1b13000129f239e24c4e9150
Comment 7 José Aliste 2012-07-17 18:00:28 UTC
Can you check which versions of poppler, cairo, evince are you using? I can't get evince to crash with the file you uploaded
Comment 8 Karol Babioch 2012-07-17 18:15:17 UTC
I'm running Arch Linux, so probably it is the latest and greatest I'm running:

[root@vpcs ~]# pacman -Q | grep -E "poppler|cairo|evince"
cairo 1.12.2-2
cairomm 1.10.0-2
evince 3.4.0-1
poppler 0.20.2-1
poppler-data 0.4.5-1
poppler-glib 0.20.2-1
poppler-qt 0.20.2-1
python2-cairo 1.10.0-1

Have you scrolled through the document? As said there seems to be a random factor involved. Sometimes it crashes while opening the document. Sometimes I have to scroll through 1-10 pages. Nevertheless I couldn't scroll through the whole document without a crash so far.
Comment 9 José Aliste 2012-07-17 18:30:53 UTC
Yes, I have scrolled, with mouse and keyboard through the whole document, several times, without a crash involved. My guess is still that the bug is in cairo, in my machine, I got 1.10 and no bug... If you have the time to test by downgrading cairo, it would be awesome, if not, I ll try to build cairo in my jhbuild to see if I can get the crash.
Comment 10 Karol Babioch 2012-07-17 18:50:34 UTC
What versions of the above packages do you have? Is it just cairo that is different to my packages? I've downgraded cairo to 1.10.2, but in order to do so, I've also had to downgrade both poppler and poppler-glib to 0.18.4. It does indeed work now. Evince is still 3.4.0, so it is definitely something with poppler and/or cairo.
Comment 11 José Aliste 2012-07-17 19:23:50 UTC
I have evince 3.4.0 and poppler 0.18 with cairo 1.10... Actually, in my jhbuild I have latest evince from git plus poppler from git also. With this, evince actually crashes, but poppler-glib-demo does not crash when I render each page, so it seems to be a threading issue...
Comment 12 Karol Babioch 2012-07-17 19:27:16 UTC
I don't know what exactly the issue is. I'm also not sure how to proceed from here on. Is this something you guys can fix, or at least forward to the right people, or would I have to file another bug report over at the site of poppler and/or cairo?
Comment 13 José Aliste 2012-07-17 19:55:17 UTC
You should file a bug in poppler in the cairo backend, so cairo-poppler devs can take a look at it. Greets and thanks for your responsiveness
Comment 14 James Cloos 2012-07-19 00:05:31 UTC
mupdfclean says:

warning: invalid string length for aes encryption
warning: ... repeated 4 times ...

when working on that pdf.

That might be related to why evince crashes.
Comment 15 Christian Persch 2013-06-09 21:44:03 UTC
Crash in cairo called from poppler ... has this been forwarded to poppler bugzilla?
Comment 16 Germán Poo-Caamaño 2013-06-13 23:33:55 UTC
(In reply to comment #6)
> Unfortunately the document is quite big (8,5 MB), so I can't upload it here.
> Therefore I've uploaded it over at fileconvoy.com. You'll find it here [1].
> 
> [1]
> http://www.fileconvoy.com/dfl.php?id=gb250729c110ebb1b13000129f239e24c4e9150

I am revisiting this bug but the file is not available anymore.  Please, could you re-upload it?
Comment 17 Karol Babioch 2013-06-13 23:57:14 UTC
(In reply to comment #15)
> Crash in cairo called from poppler ... has this been forwarded to poppler
> bugzilla?

Yes, see #52230, [1]. Its been fixed quite some time ago.

[1]: https://bugs.freedesktop.org/show_bug.cgi?id=52230

(In reply to comment #16)
> (In reply to comment #6)
> > Unfortunately the document is quite big (8,5 MB), so I can't upload it here.
> > Therefore I've uploaded it over at fileconvoy.com. You'll find it here [1].
> > 
> > [1]
> > http://www.fileconvoy.com/dfl.php?id=gb250729c110ebb1b13000129f239e24c4e9150
> 
> I am revisiting this bug but the file is not available anymore.  Please, could
> you re-upload it?

No, unfortunately I don't. However it is fixed and Albert Astals Cid over at the cairo bugtracker mentioned to have a copy left - if it is really needed.
Comment 18 Germán Poo-Caamaño 2013-06-14 01:08:16 UTC
(In reply to comment #17)
> (In reply to comment #15)
> > Crash in cairo called from poppler ... has this been forwarded to poppler
> > bugzilla?
> 
> Yes, see #52230, [1]. Its been fixed quite some time ago.
> 
> [1]: https://bugs.freedesktop.org/show_bug.cgi?id=52230

Thanks for the update.  Then, I am closing this bug as NOTGNOME.