Bug 22315

We need the file, can you attach or link to it?

Created attachment 26879 [details]
file which caused the crash

This attachment is the closest thing I have to the file which caused the crash, but it's not identical to it. The reason is simply that it's produced from a latex document which I'm currently writing. After the crash, I went on writing (and generating the PDF) for a while before reporting the bug, and I truly can't say which parts I added later. If you need to have a file which corresponds exactly to the backtrace, please say so and I'll post a new backtrace with the corresponding file as soon as I get another crash

We need a file that makes okular crash, does this one do that?

Created attachment 26880 [details]
file which caused the new crash

I'm not sure if the file in the previous attachment caused the crash (as I said, they're quite random). However, I just got another crash, with the current version of the same file. Here's the backtrace (which looks similar to the previous one):
Program received signal SIGABRT, Aborted.
[Switching to Thread 0xb2a6bb70 (LWP 3496)]
0xb7fcd430 in __kernel_vsyscall ()
(gdb) bt
#0  0xb7fcd430 in __kernel_vsyscall ()
#1  0xb69f8980 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#2  0xb69fa1c8 in abort () at abort.c:88
#3  0xb6a3a7f3 in malloc_printerr (action=2, str=0xb6af5687 "free(): invalid pointer", ptr=0x8459ac8) at malloc.c:6201
#4  0xb6a3ef2c in __libc_free (mem=0x6) at malloc.c:3677
#5  0xb6bfb5d1 in operator delete (ptr=0x0) at /var/tmp/paludis/sys-devel-gcc-4.3.3-r2/work/gcc-4.3.3/libstdc++-v3/libsupc++/del_op.cc:49
#6  0xb33620d6 in XRef::fetch (this=0x82cb080, num=218, gen=0, obj=0xb2a6acc4) at XRef.cc:961
#7  0xb334d869 in Object::fetch (this=0x6, xref=0x82cb080, obj=0xb2a6acc4) at Object.cc:120
#8  0xb32fdd37 in Dict::lookup (this=0x8411688, key=0x8426590 "a44", obj=0xb2a6acc4) at Dict.cc:137
#9  0xb331caf2 in Gfx8BitFont::getCharProc (this=0x6, code=44, proc=0xb2a6acc4) at Object.h:300
#10 0xb33126df in Gfx::doShowText (this=0x8367540, s=0x83faea0) at Gfx.cc:3407
#11 0xb33157f9 in Gfx::opShowSpaceText (this=0x8367540, args=0xb2a6ae10, numArgs=1) at Gfx.cc:3327
#12 0xb330ad6c in Gfx::execOp (this=0x8367540, cmd=0xb2a6afb0, args=0xb2a6ae10, numArgs=1) at Gfx.cc:772
#13 0xb330b2a7 in Gfx::go (this=0x8367540, topLevel=1) at Gfx.cc:643
#14 0xb330dc97 in Gfx::display (this=0x8367540, obj=0xb2a6b08c, topLevel=1) at Gfx.cc:612
#15 0xb3350f2c in Page::displaySlice (this=0x83ff020, out=0x83fb1d0, hDPI=147.68275556212578, vDPI=147.6107329936215, rotate=0, useMediaBox=0, crop=1, sliceX=-1, sliceY=-1, sliceW=-1, sliceH=-1,
    printing=0, catalog=0x844ec78, abortCheckCbk=0, abortCheckCbkData=0x0, annotDisplayDecideCbk=0, annotDisplayDecideCbkData=0x0) at Page.cc:442
#16 0xb3354425 in PDFDoc::displayPageSlice (this=0x83858c8, out=0x83fb1d0, page=7, hDPI=147.68275556212578, vDPI=147.6107329936215, rotate=0, useMediaBox=0, crop=1, printing=0, sliceX=-1, sliceY=-1,
    sliceW=-1, sliceH=-1, abortCheckCbk=0, abortCheckCbkData=0x0, annotDisplayDecideCbk=0, annotDisplayDecideCbkData=0x0) at PDFDoc.cc:423
#17 0xb34470cd in Poppler::Page::renderToImage (this=0x8461140, xres=147.68275556212578, yres=147.6107329936215, x=-1, y=-1, w=-1, h=-1, rotate=Poppler::Page::Rotate0) at poppler-page.cc:205
#18 0xb34c7c41 in PDFPixmapGeneratorThread::run (this=0x824b500) at /var/tmp/paludis/kde-base-okular-scm/work/okular/okular/generators/poppler/generator_pdf.cpp:1708
#19 0xb74790c0 in QThreadPrivate::start (arg=0x824b500) at thread/qthread_unix.cpp:189
#20 0xb73f7440 in start_thread () from /lib/libpthread.so.0
#21 0xb6a9fa2e in clone () at ../sysdeps/unix/sysv/linux/i386/clone.S:130

In the attachment there's the file which caused this

Your backtraces are quite weird since it's crashing on
delete (ptr=0x0)
gfree (p=0x0)
that are correct functions, could you please run the program through valgrind and attach the output log?

Also are you using some insane gentoo-like optimizations?

Regarding the optimizations, while I do have gentoo, I don't think I use insane settings: -O2 -pipe -march=pentium4

Regarding valgrind, I've never used it before so I'm not exactly sure on how to proceed. I suppose that you need the output when the program crashes, right? If so, it's not going to be easy since, as I said, the crashes are quite random. I tried three or four times, but it never crashed. I'll keep trying and see what happens. Of course, if you want, I can send the output from valgrind when there's no crash.

Can you try with just "-O2"?

Also can you check if your distro does any patching to poppler? Just recently found out that redhat has a patch that makes poppler crash more than usual

I've checked and I don't think gentoo adds patches. As for using -O2, I tried it but still got the crash.

Really can't help you, i'm sorry, but the backtrace tells me there's something wrong in your setup 

This is the glibc bug of the malloc check, see also:
http://sourceware.org/bugzilla/show_bug.cgi?id=10282
Unsetting the "MALLOC_CHECK_" environment variable can temporarly turn off the issue, while the suggested option is to upgrade the version of glibc.