Bug 19702

Summary:	evince crashed with SIGSEGV in JBIG2SymbolDict::~JBIG2SymbolDict()
Product:	poppler	Reporter:	Pedro Villavicencio <pvillavi>
Component:	general	Assignee:	poppler-bugs <poppler-bugs>
Status:	RESOLVED FIXED	QA Contact:
Severity:	critical
Priority:	medium
Version:	unspecified
Hardware:	Other
OS:	All
Whiteboard:
i915 platform:		i915 features:

Description Pedro Villavicencio 2009-01-23 05:48:01 UTC

this report has been filed here:

https://bugs.edge.launchpad.net/poppler/+bug/320181

"This bug appears reproducible when opening the attached document (maybe you need to switch pages a few times)."

pdf:

http://launchpadlibrarian.net/21544672/01004PT1.pdf

"
Thread 3 (Thread 0xb5cd8b90 (LWP 5814)):
#0  0xb80b3430 in __kernel_vsyscall ()
No symbol table info available.
#1  0xb74f1412 in pthread_cond_timedwait@@GLIBC_2.3.2 () from /lib/tls/i686/cmov/libpthread.so.0
No symbol table info available.
#2  0xb78e613d in g_cond_timed_wait_posix_impl (cond=0x93f9fd0, entered_mutex=0x80, abs_time=0x1) at /build/buildd/glib2.0-2.19.5/gthread/gthread-posix.c:242
	result = <value optimized out>
	end_time = {tv_sec = 1232717905, tv_nsec = 312387000}
	timed_out = <value optimized out>
	__PRETTY_FUNCTION__ = "g_cond_timed_wait_posix_impl"
#3  0xb75132c9 in g_async_queue_pop_intern_unlocked (queue=0x91f0d58, try=<value optimized out>, end_time=0xb5cd82e4) at /build/buildd/glib2.0-2.19.5/glib/gasyncqueue.c:365
	retval = <value optimized out>
	__PRETTY_FUNCTION__ = "g_async_queue_pop_intern_unlocked"
#4  0xb75133c7 in IA__g_async_queue_timed_pop (queue=0x91f0d58, end_time=0xb5cd82e4) at /build/buildd/glib2.0-2.19.5/glib/gasyncqueue.c:491
	retval = <value optimized out>
	__PRETTY_FUNCTION__ = "IA__g_async_queue_timed_pop"
#5  0xb7566103 in g_thread_pool_thread_proxy (data=0x9261a88) at /build/buildd/glib2.0-2.19.5/glib/gthreadpool.c:121
	task = <value optimized out>
	pool = (GRealThreadPool *) 0x0
#6  0xb7564aff in g_thread_create_proxy (data=0x9214168) at /build/buildd/glib2.0-2.19.5/glib/gthread.c:635
	__PRETTY_FUNCTION__ = "g_thread_create_proxy"
#7  0xb74ed4ff in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
No symbol table info available.
#8  0xb74693fe in clone () from /lib/tls/i686/cmov/libc.so.6
No symbol table info available.

Thread 2 (Thread 0xb6746b90 (LWP 5813)):
#0  0xb5e00441 in ?? ()
No symbol table info available.
#1  0xb71c0fd9 in JBIG2Stream::close (this=0xb5e09cb0) at JBIG2Stream.cc:1219
	_i = 0
#2  0xb71c109a in ~JBIG2Stream (this=0xb5e09cb0) at JBIG2Stream.cc:1158
No locals.
#3  0xb71d3897 in Object::free (this=0xb6745e0c) at Object.cc:143
No locals.
#4  0xb719c5ee in Gfx::opXObject (this=0xb5e07f68, args=0xb6745ec0, numArgs=1) at Gfx.cc:3553
	name = 0xb5e08958 "Im0"
	obj1 = {type = objStream, {booln = -1243571024, intg = -1243571024, real = -3.5769132151572728e-49, string = 0xb5e09cb0, name = 0xb5e09cb0 "ÈÇ)·", array = 0xb5e09cb0, 
    dict = 0xb5e09cb0, stream = 0xb5e09cb0, ref = {num = -1243571024, gen = -1243563392}, cmd = 0xb5e09cb0 "ÈÇ)·"}}
	obj2 = {type = objNone, {booln = -1243572360, intg = -1243572360, real = 1.000000677545783, string = 0xb5e09778, name = 0xb5e09778 "\210ºàµe", array = 0xb5e09778, 
    dict = 0xb5e09778, stream = 0xb5e09778, ref = {num = -1243572360, gen = 1072693248}, cmd = 0xb5e09778 "\210ºàµe"}}
	obj3 = {type = objNone, {booln = 0, intg = 0, real = -3.3221892305692148e-43, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, 
      gen = -1222794614}, cmd = 0x0}}
	refObj = {type = objNone, {booln = 9, intg = 9, real = 4.4465908125712189e-323, string = 0x9, name = 0x9 <Address 0x9 out of bounds>, array = 0x9, dict = 0x9, 
    stream = 0x9, ref = {num = 9, gen = 0}, cmd = 0x9 <Address 0x9 out of bounds>}}
	opiDict = {type = objNone, {booln = 0, intg = 0, real = 0, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = 0}, cmd = 0x0}}
#5  0xb718e9ea in Gfx::execOp (this=0xb5e07f68, cmd=0xb6746060, args=0xb6745ec0, numArgs=1) at Gfx.cc:771
	op = (Operator *) 0xb72acb9c
	name = 0xb5e0ba80 "Do"
	argPtr = (Object *) 0xb6745ec0
	i = 1
#6  0xb718efaf in Gfx::go (this=0xb5e07f68, topLevel=1) at Gfx.cc:642
	timer = {start_time = {tv_sec = 1232717891, tv_usec = 287950}, end_time = {tv_sec = -1243561648, tv_usec = -1233887112}, active = 1}
	obj = {type = objCmd, {booln = -1243563392, intg = -1243563392, real = 1.5075938405522611e-314, string = 0xb5e0ba80, name = 0xb5e0ba80 "Do", array = 0xb5e0ba80, 
    dict = 0xb5e0ba80, stream = 0xb5e0ba80, ref = {num = -1243563392, gen = 0}, cmd = 0xb5e0ba80 "Do"}}
	args = {{type = objName, {booln = -1243575976, intg = -1243575976, real = 1.5075876232301738e-314, string = 0xb5e08958, name = 0xb5e08958 "Im0", array = 0xb5e08958, 
      dict = 0xb5e08958, stream = 0xb5e08958, ref = {num = -1243575976, gen = 0}, cmd = 0xb5e08958 "Im0"}}, {type = objNone, {booln = 0, intg = 0, real = 0, string = 0x0, 
      name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = 0}, cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, real = 0, string = 0x0, name = 0x0, 
      array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = 0}, cmd = 0x0}}, {type = objNone, {booln = 592, intg = 592, real = 2.9248686233801795e-321, string = 0x250, 
      name = 0x250 <Address 0x250 out of bounds>, array = 0x250, dict = 0x250, stream = 0x250, ref = {num = 592, gen = 0}, cmd = 0x250 <Address 0x250 out of bounds>}}, {
    type = objNone, {booln = 0, intg = 0, real = 0, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = 0}, cmd = 0x0}}, {type = objNone, {
      booln = 0, intg = 0, real = 0, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = 0}, cmd = 0x0}}, {type = objNone, {booln = 0, 
      intg = 0, real = -3.53816690189933e-49, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = -1243575267}, cmd = 0x0}}, {type = objNone, {
      booln = 0, intg = 0, real = -3.538160376594862e-49, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = -1243575269}, cmd = 0x0}}, {
    type = objNone, {booln = 0, intg = 0, real = -3.538170164551564e-49, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = -1243575266}, 
      cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, real = -3.53815058863816e-49, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, 
        gen = -1243575272}, cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, real = -2.2303620133659602e-46, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, 
      ref = {num = 0, gen = -1233887364}, cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, real = -3.5826923169367179e-49, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, 
      stream = 0x0, ref = {num = 0, gen = -1243561620}, cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, real = -1.4141544198161252e-42, string = 0x0, name = 0x0, 
      array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = -1220572827}, cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, real = -3.5826401145009739e-49, 
      string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = -1243561636}, cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, 
      real = -3.5373936533198721e-49, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = -1243575504}, cmd = 0x0}}, {type = objNone, {
      booln = 0, intg = 0, real = 4.1040188182388927e+31, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = 1182806016}, cmd = 0x0}}, {
    type = objNone, {booln = 0, intg = 0, real = -2.2304622420425886e-46, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = -1233887304}, 
      cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, real = 1.6975966327722179e-313, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, 
        gen = 8}, cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, real = -3.5826009626741659e-49, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {
        num = 0, gen = -1243561648}, cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, real = -5.8013345886387957e-43, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, 
      stream = 0x0, ref = {num = 0, gen = -1221992460}, cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, real = -2.2307295185135979e-46, string = 0x0, name = 0x0, 
      array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = -1233887144}, cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, real = 0, string = 0x0, name = 0x0, 
      array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = 0}, cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, real = 6.3659873728958169e-313, string = 0x0, 
      name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = 30}, cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, real = 4.2439915819305446e-313, 
      string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = 20}, cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, 
      real = -3.4213476386609864e-49, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = -1243611072}, cmd = 0x0}}, {type = objNone, {
      booln = 0, intg = 0, real = 0, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = 0}, cmd = 0x0}}, {type = objNone, {booln = 0, 
      intg = 0, real = -3.5727869047542961e-49, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = -1243564656}, cmd = 0x0}}, {
    type = objNone, {booln = 0, intg = 0, real = -1.4776254407273157e+295, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = -46718254}, 
      cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, real = -2.7072922116091678e-42, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, 
        gen = -1219612684}, cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, real = -2.2307027908664969e-46, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, 
      ref = {num = 0, gen = -1233887160}, cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, real = 8.4879831638610893e-313, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, 
      stream = 0x0, ref = {num = 0, gen = 40}, cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, real = -1.783142032436843e-43, string = 0x0, name = 0x0, array = 0x0, 
      dict = 0x0, stream = 0x0, ref = {num = 0, gen = -1223700492}, cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, real = -3.2207370691670657e-43, string = 0x0, name = 0x0, 
      array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = -1222853923}, cmd = 0x0}}}
	numArgs = 1
	i = 6
	lastAbortCheck = 0
#7  0xb7191a1f in Gfx::display (this=0xb5e07f68, obj=0xb674613c, topLevel=1) at Gfx.cc:611
	obj2 = {type = objNone, {booln = 0, intg = 0, real = 0, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = 0}, cmd = 0x0}}
	i = <value optimized out>
#8  0xb71d77cd in Page::displaySlice (this=0x9207240, out=0xb5e02150, hDPI=72, vDPI=72, rotate=0, useMediaBox=0, crop=1, sliceX=-1, sliceY=-1, sliceW=-1, sliceH=-1, printing=0, 
    catalog=0x9211f98, abortCheckCbk=0, abortCheckCbkData=0x0, annotDisplayDecideCbk=0, annotDisplayDecideCbkData=0x0) at Page.cc:442
	gfx = (Gfx *) 0xb5e07f68
	obj = {type = objStream, {booln = -1243575504, intg = -1243575504, real = -3.5809067014882847e-49, string = 0xb5e08b30, name = 0xb5e08b30 "h¿)·\002", array = 0xb5e08b30, 
    dict = 0xb5e08b30, stream = 0xb5e08b30, ref = {num = -1243575504, gen = -1243562168}, cmd = 0xb5e08b30 "h¿)·\002"}}
	annotList = <value optimized out>
	i = <value optimized out>
#9  0xb78160d6 in _poppler_page_render (page=0xb5e07368, cairo=0xb5e0bdc0, printing=0) at poppler-page.cc:530
	output_dev = (class CairoOutputDev *) 0xb5e02150
	__PRETTY_FUNCTION__ = "void _poppler_page_render(PopplerPage*, cairo_t*, GBool)"
#10 0xb7816227 in poppler_page_render (page=0xb5e07368, cairo=0xb5e0bdc0) at poppler-page.cc:552
	__PRETTY_FUNCTION__ = "void poppler_page_render(PopplerPage*, cairo_t*)"
#11 0xb5f427a8 in pdf_document_render (document=0x91f6c90, rc=0x92bbbc0) at ev-poppler.cc:488
	poppler_page = (PopplerPage *) 0xb5e07368
	width_points = 592
	height_points = 841
	width = 637
	height = 905
#12 0xb806bdd0 in ev_document_render (document=0x91f6c90, rc=0x92bbbc0) at ev-document.c:241
	retval = (cairo_surface_t *) 0x8ce0083c
	__PRETTY_FUNCTION__ = "ev_document_render"
#13 0xb80477b7 in ev_job_render_run (job=0x90d5bf0) at ev-jobs.c:516
	job_render = (EvJobRender *) 0x90d5bf0
	rc = (EvRenderContext *) 0x92bbbc0
#14 0xb8044e91 in ev_job_run (job=0x90d5bf0) at ev-jobs.c:207
No locals.
#15 0xb80485e0 in ev_job_thread_proxy (data=0x0) at ev-job-scheduler.c:183
	job = (EvSchedulerJob *) 0x9229c88
#16 0xb7564aff in g_thread_create_proxy (data=0x9202a30) at /build/buildd/glib2.0-2.19.5/glib/gthread.c:635
	__PRETTY_FUNCTION__ = "g_thread_create_proxy"
#17 0xb74ed4ff in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
No symbol table info available.
#18 0xb74693fe in clone () from /lib/tls/i686/cmov/libc.so.6
No symbol table info available.

Thread 1 (Thread 0xb6f15750 (LWP 5810)):
#0  0xb80b3430 in __kernel_vsyscall ()
No symbol table info available.
#1  0xb745ea77 in poll () from /lib/tls/i686/cmov/libc.so.6
No symbol table info available.
#2  0xb754a89b in IA__g_poll (fds=0x92214c8, nfds=10, timeout=1000) at /build/buildd/glib2.0-2.19.5/glib/gpoll.c:127
No locals.
#3  0xb753d132 in g_main_context_iterate (context=0x8fa2740, block=1, dispatch=1, self=0x8f793e8) at /build/buildd/glib2.0-2.19.5/glib/gmain.c:2761
	max_priority = 2147483647
	timeout = 1000
	some_ready = <value optimized out>
	nfds = 10
	allocated_nfds = <value optimized out>
	fds = (GPollFD *) 0x92214c8
	__PRETTY_FUNCTION__ = "g_main_context_iterate"
#4  0xb753d7c2 in IA__g_main_loop_run (loop=0x8f7b718) at /build/buildd/glib2.0-2.19.5/glib/gmain.c:2656
	self = (GThread *) 0x8f793e8
	__PRETTY_FUNCTION__ = "IA__g_main_loop_run"
#5  0xb7af9319 in IA__gtk_main () at /build/buildd/gtk+2.0-2.14.5/gtk/gtkmain.c:1200
	tmp_list = (GList *) 0x8fddcf0
	functions = (GList *) 0x0
	init = (GtkInitFunction *) 0x0
	loop = (GMainLoop *) 0x8f7b718
#6  0x080800eb in main (argc=0, argv=0xe0001000) at main.c:383
	context = <value optimized out>
	args = (GHashTable *) 0x8fc9d80
	enable_metadata = 1
	error = (GError *) 0x0
#0  0xb5e00441 in ?? ()"

Thanks,

Comment 1 Albert Astals Cid 2009-01-23 14:13:44 UTC

Won't crash in poppler 0.10.4 but still won't render the pages correctly.

I've opened bug 19706 for that issue.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.