Ubuntu
poppler package

evince crashes SIGSEGV in CairoOutputDev::drawImageMaskPrescaled ()

Bug #188079 reported by Rebecca Palmer
14
Affects Status Importance Assigned to Milestone
Poppler
Fix Released
High
poppler (Ubuntu)
Fix Released
Medium
Ubuntu Desktop Bugs

Bug Description

On opening the PDF file http://uk.arxiv.org/pdf/0801.4602 Evince displays it (normally except that the thumbnails are all blank) but crashes shortly afterwards. I think it has sometimes also done so on other PDF documents, but this is the only one I know to do it reproducibly.

amd64 Gutsy with all updates.

This is the same function as bug 183318, but this is a SIGSEGV, that one is assert failure. I haven't tried the test file for that bug.

Where can I get the relevant debugging symbols? There doesn't appear to be a libpoppler-dbg.

Revision history for this message
Rebecca Palmer (rebecca-palmer) wrote :
Revision history for this message
Rebecca Palmer (rebecca-palmer) wrote :

Under Valgrind it doesn't crash, but does display only the first page (the others appear blank), and sometimes hangs.

This one was closed normally.

Revision history for this message
Rebecca Palmer (rebecca-palmer) wrote :

This one hung, requiring Force Quit.

Revision history for this message
Sebastien Bacher (seb128) wrote :

Thank you for your bug. The example doesn't crash on hardy, could you try using the new version? You can read https://wiki.ubuntu.com/DebuggingProgramCrash about how to get a backtrace, the easier way is to use apport to send the bug though

Changed in poppler:
importance: Undecided → Medium
status: New → Incomplete
Revision history for this message
Rebecca Palmer (rebecca-palmer) wrote :

Still crashes in amd64 Hardy alpha2 on my system, if anything faster; the picture at the bottom of page 1 seems to be the trigger.

The window turns grey and unresponsive, then after a while disappears, usually without an error message but on one occasion with "Sorry, the program "evince" closed unexpectedly Your computer does not have enough free memory to automatically analyze the problem and send a report to the developers." System Monitor indicates GB-level memory usage during the unresponsive period, which suggests this may be related to bug 138343.

The text is also sometimes blurred as if excessively antialiased (in Hardy only), but the crash happens with or without this.

Backtrace attached; my Hardy is a liveCD so no valgrind.

Revision history for this message
Marcel Stimberg (marcelstimberg) wrote :

This bug is still present with current hardy:
mst@lifecompi:~$ uname -a
Linux lifecompi 2.6.24-19-generic #1 SMP Wed Jun 4 16:35:01 UTC 2008 i686 GNU/Linux
mst@lifecompi:~$ apt-show-versions evince
evince/hardy uptodate 2.22.2-0ubuntu1
mst@lifecompi:~$ apt-show-versions libcairo2
libcairo2/hardy uptodate 1.6.0-0ubuntu2
mst@lifecompi:~$ apt-show-versions libpoppler2
libpoppler2/hardy uptodate 0.6.4-1ubuntu1

Changed in poppler:
status: Incomplete → Confirmed
Revision history for this message
Marcel Stimberg (marcelstimberg) wrote :
Revision history for this message
Greg Grossmeier (greg.grossmeier) wrote :

Crashed using the 0801.4602 file in the description in Hardy (with -proposed repo enabled).
Apport can not analyze the .crash file on my computer (not enough free memory).
Attached here is the file, only 36 KB in size.

Revision history for this message
Pedro Villavicencio (pedro) wrote :

Please do not attach .crash files to the reports, use apport instead if it doesn't work for you fill a bug or a question, thanks. Anyways the trace that Marcel submitted is good enough, will look upstream, thanks you all.

Revision history for this message
Pedro Villavicencio (pedro) wrote :

I've sent this upstream at https://bugs.freedesktop.org/show_bug.cgi?id=16402 ; thanks all.

Changed in poppler:
assignee: nobody → desktop-bugs
status: Confirmed → Triaged
Bug Watch Updater (bug-watch-updater)
Changed in poppler:
status: Unknown → Confirmed
Revision history for this message
Rebecca Palmer (rebecca-palmer) wrote :

Both this bug (with http://uk.arxiv.org/pdf/0801.4602 , I haven't tried the others) and the supposedly fixed bug 138343 are still present in amd64 Intrepid.

I have not looked at the upstream report as Firefox gives me an "invalid security certificate" error when I try to do so.

Revision history for this message
Rebecca Palmer (rebecca-palmer) wrote :

Still present in amd64 Jaunty: http://uk.arxiv.org/pdf/0801.4602 bottom of page 1 crashes Evince, http://uk.arxiv.org/pdf/0801.4754 top of page 9 takes some time then gives up and shows a blank page, both after using >1GB of memory. (The latter I originally thought to be bug 138343, but as it is a simple vector graphic while all other reported examples of 138343 are large bitmaps, I now suspect it may be more closely related to this bug.)

Since there now is a poppler-dbg, I am now able to provide a backtrace with symbols (of the 0801.4602 crash), which is attached.

Revision history for this message
In , Alexey Spiridonov (snarkmaster) wrote :

Created an attachment (id=26149)
PDF causing the crash

I have reproduced this segmentation fault with xpdf 3.0.2 and evince 2.24.1 / poppler 0.8.7 (cairo). I am using Ubuntu 8.10 on x86 linux.

Revision history for this message
In , Alexey Spiridonov (snarkmaster) wrote :

Also, gv displays all the document's pages correctly, but complains about page 2:
   **** Warning: Pattern stream has imbalanced q/Q operators (too many q's)

Revision history for this message
In , Albert Astals Cid (aacid) wrote :

Using master and splash i don't see any problem, master and cairo seems to loop for a long time on page 2 and gave me a segmentation fault, moving to cairo component.

Revision history for this message
In , Carlos Garcia Campos (carlosgc) wrote :

I see "Error: There's a form with more q than Q, trying to fix" on stdout, but it works for me with current poppler/cairo, so I guess this has been fixed in cairo or poppler.

Revision history for this message
In , Albert Astals Cid (aacid) wrote :

http://cgit.freedesktop.org/poppler/poppler/commit/?id=173451730948c320f16a0f5924a58302603eca0b

Revision history for this message
In , Carlos Garcia Campos (carlosgc) wrote :

*** Bug 16402 has been marked as a duplicate of this bug. ***

Bug Watch Updater (bug-watch-updater)
Changed in poppler:
status: Confirmed → Invalid
Revision history for this message
Sebastien Bacher (seb128) wrote :

the bug is fixed in karmic now

Changed in poppler (Ubuntu):
status: Triaged → Fix Released
Bug Watch Updater (bug-watch-updater)
Changed in poppler:
status: Invalid → Fix Released
Bug Watch Updater (bug-watch-updater)
Changed in poppler:
importance: Unknown → High
Bug Watch Updater (bug-watch-updater)
Changed in poppler:
importance: High → Unknown
Bug Watch Updater (bug-watch-updater)
Changed in poppler:
importance: Unknown → High
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.