evince crashed with SIGSEGV in TextPage::beginWord()

Bug #288440 reported by Graham C
24
Affects Status Importance Assigned to Milestone
Poppler
Fix Released
Medium
poppler (Ubuntu)
Fix Released
Medium
Ubuntu Desktop Bugs

Bug Description

Binary package hint: evince

Crashes consistently when viewing certain pages (e.g. page 2) of http://www.akasa.co.uk/pdf/installation_manuals/installation_manual_P2sata.pdf

ProblemType: Crash
Architecture: i386
DistroRelease: Ubuntu 8.10
ExecutablePath: /usr/bin/evince
Package: evince 2.24.1-0ubuntu1
ProcAttrCurrent: unconfined
ProcCmdline: evince file:///tmp/installation_manual_P2sata.pdf
ProcEnviron:
 PATH=/home/username/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/bin/X11:/usr/games:/usr/lib/kde4/bin
 LANG=en_GB.UTF-8
 SHELL=/bin/bash
Signal: 11
SourcePackage: evince
StacktraceTop:
 TextPage::beginWord () from /usr/lib/libpoppler.so.3
 TextPage::addChar () from /usr/lib/libpoppler.so.3
 TextOutputDev::endMarkedContent ()
 Gfx::opEndMarkedContent () from /usr/lib/libpoppler.so.3
 Gfx::execOp () from /usr/lib/libpoppler.so.3
Title: evince crashed with SIGSEGV in TextPage::beginWord()
Uname: Linux 2.6.27-7-generic i686
UserGroups: adm admin audio cdrom dialout dip floppy fuse lpadmin mythtv plugdev sambashare scanner video voice

Tags: apport-crash
Revision history for this message
Graham C (chckens) wrote :
Revision history for this message
Apport retracing service (apport) wrote : Symbolic stack trace

StacktraceTop:TextPage::addChar (this=0xa3a5d48, state=0xa399300, x=22.012, y=14.327, dx=0,
TextOutputDev::endMarkedContent (this=0xa2067c0, state=0xa399300)
Gfx::opEndMarkedContent (this=0xa183400, args=0xb5dc8f90, numArgs=0) at Gfx.cc:4172
Gfx::execOp (this=0xa183400, cmd=0xb5dc9130, args=0xb5dc8f90, numArgs=0)
Gfx::go (this=0xa183400, topLevel=1) at Gfx.cc:611

Revision history for this message
Apport retracing service (apport) wrote : Symbolic threaded stack trace
Changed in evince:
importance: Undecided → Medium
Revision history for this message
Pedro Villavicencio (pedro) wrote :

that's a poppler crash, re assigning.

Revision history for this message
Pedro Villavicencio (pedro) wrote :

confirming will look upstream, thanks for reporting.

Changed in poppler:
status: New → Confirmed
Revision history for this message
In , Pedro Villavicencio (pedro) wrote :
Download full text (43.0 KiB)

this report has been filed here:

https://bugs.edge.launchpad.net/poppler/+bug/288440

"Crashes consistently when viewing certain pages (e.g. page 2) of http://www.akasa.co.uk/pdf/installation_manuals/installation_manual_P2sata.pdf"

".
Thread 3 (process 26066):
#0 0xb8059430 in __kernel_vsyscall ()
#1 0xb749c3a2 in pthread_cond_timedwait@@GLIBC_2.3.2 () from /lib/tls/i686/cmov/libpthread.so.0
#2 0xb7fdf0bd in g_cond_timed_wait_posix_impl (cond=0xa2b3a50, entered_mutex=0x80, abs_time=0x1)
    at /build/buildd/glib2.0-2.18.2/gthread/gthread-posix.c:242
 result = <value optimized out>
 end_time = {tv_sec = 1224805117, tv_nsec = 105751000}
 timed_out = <value optimized out>
 __PRETTY_FUNCTION__ = "g_cond_timed_wait_posix_impl"
#3 0xb74be269 in g_async_queue_pop_intern_unlocked (queue=0xa190978, try=<value optimized out>,
    end_time=0xb5508334) at /build/buildd/glib2.0-2.18.2/glib/gasyncqueue.c:365
 retval = <value optimized out>
 __PRETTY_FUNCTION__ = "g_async_queue_pop_intern_unlocked"
#4 0xb74be367 in IA__g_async_queue_timed_pop (queue=0xa190978, end_time=0xb5508334)
    at /build/buildd/glib2.0-2.18.2/glib/gasyncqueue.c:491
 retval = <value optimized out>
 __PRETTY_FUNCTION__ = "IA__g_async_queue_timed_pop"
#5 0xb7510633 in g_thread_pool_thread_proxy (data=0xa229aa8)
    at /build/buildd/glib2.0-2.18.2/glib/gthreadpool.c:121
 task = <value optimized out>
 pool = (GRealThreadPool *) 0x0
#6 0xb750f02f in g_thread_create_proxy (data=0xa229b20)
    at /build/buildd/glib2.0-2.18.2/glib/gthread.c:635
 __PRETTY_FUNCTION__ = "g_thread_create_proxy"
#7 0xb749850f in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#8 0xb74157ee in clone () from /lib/tls/i686/cmov/libc.so.6
.
Thread 2 (process 26063):
#0 0xb8059430 in __kernel_vsyscall ()
#1 0xb740dc01 in select () from /lib/tls/i686/cmov/libc.so.6
#2 0xb76e2e5f in _xcb_conn_wait (c=0x9f81f40, cond=0x9f83004, vector=0xbfb59438, count=0xbfb59434)
    at xcb_conn.c:340
 ret = 3
 xlib_locked = 1
 rfds = {__fds_bits = {8, 0 <repeats 31 times>}}
 wfds = {__fds_bits = {8, 0 <repeats 31 times>}}
#3 0xb76e356e in _xcb_out_send (c=0x9f81f40, vector=0xbfb59438, count=0xbfb59434) at xcb_out.c:279
 ret = 1
#4 0xb76e3afb in xcb_send_request (c=0x9f81f40, flags=0, vector=0xbfb594a0, req=0xbfb594b0)
    at xcb_out.c:55
 request = 3263
 prefix = {0, 0, 0}
 veclen = 1
 workaround = WORKAROUND_NONE
 sync = {fields = {major = 43 '+', pad = 0 '\0', len = 1}, packet = 65579}
 __PRETTY_FUNCTION__ = "xcb_send_request"
 pad = "\000\000"
#5 0xb7623166 in _XPutXCBBuffer (dpy=0x9f81a00) at ../../src/xcb_lock.c:148
 padsize = 0
 c = <value optimized out>
 ext = <value optimized out>
 iov = {{iov_base = 0x80ae380, iov_len = 0}, {iov_base = 0x0, iov_len = 0}, {iov_base = 0x0,
    iov_len = 0}, {iov_base = 0x9f83224, iov_len = 0}, {iov_base = 0xb4ad6d34, iov_len = 148428}, {
    iov_base = 0xb76cfe54, iov_len = 0}}
 pad = "\000\000"
 __PRETTY_FUNCTION__ = "_XPutXCBBuffer"
#6 0xb762482f in _XSend (dpy=0x9f81a00, data=0xbfb592ac "\b", size=-1078619348)
    at ../../src/xcb_io.c:233
 c = (xcb_connection_t *) 0x9f81f40
 __PRETTY_FUNCTION__ = "_XSend"
#7 0xb760ffc5 in PutSubImage (dpy=0x9f81a00, d=58720786, gc...

Revision history for this message
Pedro Villavicencio (pedro) wrote :

I've sent this upstream at: https://bugs.freedesktop.org/show_bug.cgi?id=18602 ; thanks for reporting.

Changed in poppler:
importance: Undecided → Unknown
status: New → Unknown
assignee: nobody → desktop-bugs
status: Confirmed → Triaged
Changed in poppler:
status: Unknown → Confirmed
Revision history for this message
In , Sebastien Bacher (seb128) wrote :
Revision history for this message
In , Freedesktop-tevp (freedesktop-tevp) wrote :

Looks similar to http://bugzilla.gnome.org/show_bug.cgi?id=542574 (and duplicates thereof) which so far can be duplicated with poppler 0.8.7 but not any of the 0.10.x series.

Revision history for this message
Graham C (chckens) wrote :

I'm unable to reproduce this now on 9.04's evince with libpoppler4 0.10.5-1ubuntu2

As a comment in the upstream report suggests, this appears to have been fixed in newer poppler versions.

Revision history for this message
In , Sebastien Bacher (seb128) wrote :

the submitter confirmed that's working correctly now

Revision history for this message
Sebastien Bacher (seb128) wrote :

closing the bug since that's fixed with the new version

Changed in poppler (Ubuntu):
status: Triaged → Fix Released
Changed in poppler:
status: Confirmed → Fix Released
Changed in poppler:
importance: Unknown → Medium
Changed in poppler:
importance: Medium → Unknown
Changed in poppler:
importance: Unknown → Medium
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.