| Summary: | evince crashed with SIGSEGV in FT_Get_Char_Index() | ||
|---|---|---|---|
| Product: | poppler | Reporter: | Sebastien Bacher <seb128> |
| Component: | cairo backend | Assignee: | Adrian Johnson <ajohnson> |
| Status: | RESOLVED FIXED | QA Contact: | cairo-bugs mailing list <cairo-bugs> |
| Severity: | normal | ||
| Priority: | medium | CC: | danilopiazza |
| Version: | unspecified | ||
| Hardware: | Other | ||
| OS: | All | ||
| Whiteboard: | |||
| i915 platform: | i915 features: | ||
| Attachments: | Patch for 0.6.4 | ||
|
Description
Sebastien Bacher
2008-04-01 07:51:34 UTC
Valgrind lists those errors on the example ==2516== Conditional jump or move depends on uninitialised value(s) ==2516== at 0x4B5E062: (within /usr/lib/libz.so.1.2.3.3) ==2516== by 0x4B5CBE6: deflate (in /usr/lib/libz.so.1.2.3.3) ==2516== by 0x49DAFDE: cairo_deflate_stream_deflate (cairo-deflate-stream.c:57) ==2516== by 0x49DB0A5: _cairo_deflate_stream_close (cairo-deflate-stream.c:108) ==2516== by 0x49C7180: _cairo_output_stream_close (cairo-output-stream.c:192) ==2516== by 0x49C7FFC: _cairo_output_stream_destroy (cairo-output-stream.c:216) ==2516== by 0x49D2D9D: _cairo_pdf_surface_close_stream (cairo-pdf-surface.c:879) ==2516== by 0x49D64E8: _cairo_pdf_surface_emit_pattern (cairo-pdf-surface.c:1453) ==2516== by 0x49D7208: _cairo_pdf_surface_show_page (cairo-pdf-surface.c:3929) ==2516== by 0x49BE9DF: cairo_surface_show_page (cairo-surface.c:1746) ==2516== by 0x49CB492: _cairo_paginated_surface_show_page (cairo-paginated-surface.c:468) ==2516== by 0x49BE9DF: cairo_surface_show_page (cairo-surface.c:1746) ==2516== by 0x49AF187: _cairo_gstate_show_page (cairo-gstate.c:1082) ==2516== by 0x49A7991: cairo_show_page (cairo.c:2207) ==2516== by 0x7FA9F37: (within /usr/lib/evince/backends/libpdfdocument.so) ==2516== by 0x404D6D8: ev_file_exporter_end_page (in /usr/lib/libevbackend.so.0.0.0) ==2516== by 0x80606DC: (within /usr/bin/evince) ==2516== by 0x805F583: (within /usr/bin/evince) ==2516== by 0x805FA4B: (within /usr/bin/evince) ==2516== by 0x4AA09EE: g_thread_create_proxy (gthread.c:635) ==2516== by 0x4CDCFD9: start_thread (pthread_create.c:297) ==2516== by 0x4DB483D: clone (in /usr/lib/debug/libc-2.7.so) ==2516== ==2516== Use of uninitialised value of size 4 ==2516== at 0x4B5F655: (within /usr/lib/libz.so.1.2.3.3) ==2516== by 0x4B61491: (within /usr/lib/libz.so.1.2.3.3) ==2516== by 0x4B5E0A2: (within /usr/lib/libz.so.1.2.3.3) ==2516== by 0x4B5CBE6: deflate (in /usr/lib/libz.so.1.2.3.3) ==2516== by 0x49DAFDE: cairo_deflate_stream_deflate (cairo-deflate-stream.c:57) ==2516== by 0x49DB0A5: _cairo_deflate_stream_close (cairo-deflate-stream.c:108) ==2516== by 0x49C7180: _cairo_output_stream_close (cairo-output-stream.c:192) ==2516== by 0x49C7FFC: _cairo_output_stream_destroy (cairo-output-stream.c:216) ==2516== by 0x49D2D9D: _cairo_pdf_surface_close_stream (cairo-pdf-surface.c:879) ==2516== by 0x49D64E8: _cairo_pdf_surface_emit_pattern (cairo-pdf-surface.c:1453) ==2516== by 0x49D7208: _cairo_pdf_surface_show_page (cairo-pdf-surface.c:3929) ==2516== by 0x49BE9DF: cairo_surface_show_page (cairo-surface.c:1746) ==2516== by 0x49CB492: _cairo_paginated_surface_show_page (cairo-paginated-surface.c:468) ==2516== by 0x49BE9DF: cairo_surface_show_page (cairo-surface.c:1746) ==2516== by 0x49AF187: _cairo_gstate_show_page (cairo-gstate.c:1082) ==2516== by 0x49A7991: cairo_show_page (cairo.c:2207) ==2516== by 0x7FA9F37: (within /usr/lib/evince/backends/libpdfdocument.so) ==2516== by 0x404D6D8: ev_file_exporter_end_page (in /usr/lib/libevbackend.so.0.0.0) ==2516== by 0x80606DC: (within /usr/bin/evince) ==2516== by 0x805F583: (within /usr/bin/evince) ==2516== by 0x805FA4B: (within /usr/bin/evince) ==2516== by 0x4AA09EE: g_thread_create_proxy (gthread.c:635) ==2516== by 0x4CDCFD9: start_thread (pthread_create.c:297) ==2516== by 0x4DB483D: clone (in /usr/lib/debug/libc-2.7.so) Does this bug still occur after updating poppler to include the following bug fix? http://bugs.freedesktop.org/show_bug.cgi?id=15216 yes that's still an issue using the current poppler tarball which has this change I installed Hardy and could reproduce the bug. I then installed poppler 0.8.3. However due to some poppler API changes the evince in Hardy does not link with the updated poppler I installed:
$ LD_LIBRARY_PATH=/home/ajohnson/lib ldd /usr/bin/evince | grep poppler
libpoppler-glib.so.2 => /usr/lib/libpoppler-glib.so.2 (0xb7736000)
libpoppler.so.2 => /usr/lib/libpoppler.so.2 (0xb6ee7000)
Evince still reproduces the bug since it is still using the system installed poppler.
So I applied the patch in bug 15216 to poppler 0.6.4, installed it and evince printed the test case without crashing.
This is the same problem that was reported and fixed in bug 15216.
I am attaching an updated patch for poppler 0.6.4 since the original patch does not apply cleanly to this old version of poppler that Hardy is using.
Created attachment 17119 [details] [review] Patch for 0.6.4 thanks Adrian the change indeed fix the issue, I tried previously on ubuntu intrepid which has poppler 0.8.2 and the bug was still there but maybe the change was not available yet in this version, sorry for the extra work there the change has been backported to hardy but creates a regression, now evince is crashing when reloading documents (gdb) bt #0 FT_Done_Face (face=0xb455dd48) at /build/buildd/freetype-2.3.6/freetype-2.3.6/src/base/ftobjs.c:2020 #1 0xb75ceb0d in _ft_done_face (data=0xb455dd48) at CairoFontEngine.cc:37 #2 0xb74601b0 in _cairo_user_data_array_fini (array=0xb455dc7c) at /build/buildd/cairo-1.6.4/src/cairo-array.c:378 #3 0xb74640b3 in *INT_cairo_font_face_destroy (font_face=0xb455dc70) at /build/buildd/cairo-1.6.4/src/cairo-font-face.c:144 #4 0xb74aa8b0 in _cairo_ft_unscaled_font_destroy (abstract_font=0xb455e010) at /build/buildd/cairo-1.6.4/src/cairo-ft-font.c:495 #5 0xb7463e98 in _cairo_unscaled_font_destroy (unscaled_font=0xb455e010) at /build/buildd/cairo-1.6.4/src/cairo-font-face.c:531 #6 0xb74717e7 in _cairo_scaled_font_fini (scaled_font=0xb4560210) at /build/buildd/cairo-1.6.4/src/cairo-scaled-font.c:587 #7 0xb74718ac in *INT_cairo_scaled_font_destroy (scaled_font=0xb455e0e8) at /build/buildd/cairo-1.6.4/src/cairo-scaled-font.c:843 #8 0xb75ce0ff in CairoFont::getSubstitutionCorrection (this=0xb44046a0, gfxFont=0x83f0870) at CairoFontEngine.cc:307 #9 0xb75d1f4f in CairoOutputDev::updateFont (this=0x8411a60, state=0x84405f8) at CairoOutputDev.cc:390 #10 0xb6d0d0c2 in Gfx::opShowSpaceText () from /usr/lib/libpoppler.so.3 #11 0xb6d08e02 in Gfx::execOp () from /usr/lib/libpoppler.so.3 #12 0xb6d0905f in Gfx::go () from /usr/lib/libpoppler.so.3 #13 0xb6d0c1bf in Gfx::display () from /usr/lib/libpoppler.so.3 #14 0xb6d551cd in Page::displaySlice () from /usr/lib/libpoppler.so.3 #15 0xb75ca01a in _poppler_page_render (page=0x83bd518, cairo=0x83edda0, printing=0) at poppler-page.cc:529 #16 0xb75ca157 in poppler_page_render (page=0x83bd518, cairo=0x83edda0) at poppler-page.cc:550 corresponding valgrind log ==30405== Invalid read of size 4 ==30405== at 0x507AF64: FT_Done_Face (ftobjs.c:2017) ==30405== by 0x494EB0C: _ZL13_ft_done_facePv (CairoFontEngine.cc:37) ==30405== by 0x4A661AF: _cairo_user_data_array_fini (cairo-array.c:378) ==30405== by 0x4A6A0B2: cairo_font_face_destroy (cairo-font-face.c:144) ==30405== by 0x4AB08AF: _cairo_ft_unscaled_font_destroy (cairo-ft-font.c:495) ==30405== by 0x4A69E97: _cairo_unscaled_font_destroy (cairo-font-face.c:531) ==30405== by 0x4A777E6: _cairo_scaled_font_fini (cairo-scaled-font.c:587) ==30405== by 0x4A778AB: cairo_scaled_font_destroy (cairo-scaled-font.c:843) ==30405== by 0x4A6B4E7: _cairo_gstate_unset_scaled_font (cairo-gstate.c:1219) ==30405== by 0x4A6B53D: _cairo_gstate_set_font_face (cairo-gstate.c:1492) ==30405== by 0x4A634CE: cairo_set_font_face (cairo.c:2688) ==30405== by 0x4951F2D: CairoOutputDev::updateFont(GfxState*) (CairoOutputDev.cc:383) ==30405== Address 0x70758d8 is 16 bytes inside a block of size 84 free'd ==30405== at 0x4023B4A: free (vg_replace_malloc.c:323) ==30405== by 0x4B455B5: g_free (gmem.c:190) ==30405== by 0x4A3CFB9: pango_parse_markup (in /usr/lib/libpango-1.0.so.0.2101.2) ==30405== by 0x458C796: (within /usr/lib/libgtk-x11-2.0.so.0.1303.0) ==30405== by 0x4AD34CE: g_object_set_property (gobject.c:697) ==30405== by 0x460A784: (within /usr/lib/libgtk-x11-2.0.so.0.1303.0) ==30405== by 0x4610904: (within /usr/lib/libgtk-x11-2.0.so.0.1303.0) ==30405== by 0x4610F04: (within /usr/lib/libgtk-x11-2.0.so.0.1303.0) ==30405== by 0x49735DA: (within /usr/lib/libgdk-x11-2.0.so.0.1303.0) ==30405== by 0x4B3B540: g_idle_dispatch (gmain.c:4168) ==30405== by 0x4B3D437: g_main_context_dispatch (gmain.c:2063) ==30405== by 0x4B4099A: g_main_context_iterate (gmain.c:2696) ==30405== ==30405== Invalid read of size 4 ==30405== at 0x507A68F: FT_List_Find (ftutil.c:250) ==30405== by 0x507AF88: FT_Done_Face (ftobjs.c:2023) ==30405== by 0x494EB0C: _ZL13_ft_done_facePv (CairoFontEngine.cc:37) ==30405== by 0x4A661AF: _cairo_user_data_array_fini (cairo-array.c:378) ==30405== by 0x4A6A0B2: cairo_font_face_destroy (cairo-font-face.c:144) ==30405== by 0x4AB08AF: _cairo_ft_unscaled_font_destroy (cairo-ft-font.c:495) ==30405== by 0x4A69E97: _cairo_unscaled_font_destroy (cairo-font-face.c:531) ==30405== by 0x4A777E6: _cairo_scaled_font_fini (cairo-scaled-font.c:587) ==30405== by 0x4A778AB: cairo_scaled_font_destroy (cairo-scaled-font.c:843) ==30405== by 0x4A6B4E7: _cairo_gstate_unset_scaled_font (cairo-gstate.c:1219) ==30405== by 0x4A6B53D: _cairo_gstate_set_font_face (cairo-gstate.c:1492) ==30405== by 0x4A634CE: cairo_set_font_face (cairo.c:2688) ==30405== Address 0x5d8928f4 is not stack'd, malloc'd or (recently) free'd ==30405== ==30405== Process terminating with default action of signal 11 (SIGSEGV) ==30405== Access not within mapped region at address 0x5D8928F4 ==30405== at 0x507A68F: FT_List_Find (ftutil.c:250) ==30405== by 0x507AF88: FT_Done_Face (ftobjs.c:2023) ==30405== by 0x494EB0C: _ZL13_ft_done_facePv (CairoFontEngine.cc:37) ==30405== by 0x4A661AF: _cairo_user_data_array_fini (cairo-array.c:378) ==30405== by 0x4A6A0B2: cairo_font_face_destroy (cairo-font-face.c:144) ==30405== by 0x4AB08AF: _cairo_ft_unscaled_font_destroy (cairo-ft-font.c:495) ==30405== by 0x4A69E97: _cairo_unscaled_font_destroy (cairo-font-face.c:531) ==30405== by 0x4A777E6: _cairo_scaled_font_fini (cairo-scaled-font.c:587) ==30405== by 0x4A778AB: cairo_scaled_font_destroy (cairo-scaled-font.c:843) ==30405== by 0x4A6B4E7: _cairo_gstate_unset_scaled_font (cairo-gstate.c:1219) ==30405== by 0x4A6B53D: _cairo_gstate_set_font_face (cairo-gstate.c:1492) ==30405== by 0x4A634CE: cairo_set_font_face (cairo.c:2688) the 0.8.2 version has been used to get the stacktrace and valgrind log There was a recent bug report and patch for this problem posted to the poppler mailing list: http://lists.freedesktop.org/archives/poppler/2008-June/003900.html there is no reply on the list, should I open a new bug about the issue? (In reply to comment #11) > there is no reply on the list, should I open a new bug about the issue? > As it is a different bug to this one, yes open a new bug. bug #16529 opened about the issue |
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.