Bug 4579

Summary:	evince hangs if a ceritain pdf is loaded
Product:	poppler	Reporter:	Sebastien Bacher <seb128>
Component:	general	Assignee:	Kristian Høgsberg <krh>
Status:	RESOLVED FIXED	QA Contact:
Severity:	normal
Priority:	high
Version:	unspecified
Hardware:	x86 (IA32)
OS:	Linux (All)
Whiteboard:
i915 platform:		i915 features:

Description Sebastien Bacher 2005-09-24 05:26:34 UTC

This bug has been opened here: http://bugzilla.ubuntu.com/show_bug.cgi?id=16155

"typing evince nasty.pdf in a terminal, and then instructiong evince to go to
page 21 (by typing 21 in the box and hitting enter) hangs evince (it stops
responding to any input). In the terminal the following nasty messages are shown:

jorge@jorge06:~/samba_publico/gaga/ele-39$ evince nastybug.pdf
*** glibc detected *** free(): invalid pointer: 0x08306890 ***
Xlib: unexpected async reply (sequence 0xca2)!
Killed

Of course the "Killed" message is shown after I "force quit" evince. 
the same pdf can be read flawlessly (well, except for some error messages in the
terminal, see log file attached) in xpdf. 

This happened in Breezy (which I update daily) , in a Athlon XP 2600+, MSI KT4
Ultra motherboard. The computer's FSB has been underclocked from 133 MHz to 128
MHz to become stable, but, anyway, I don't think this evince problem is a
hardware one.

http://bugzilla.ubuntu.com/attachment.cgi?id=4022
The pdf that hands evince

http://bugzilla.ubuntu.com/attachment.cgi?id=4023
the output of xpdf nastybug.pdf 2> xpdflog.txt"

Comment 1 Sebastien Bacher 2005-09-24 05:27:56 UTC

That's using poppler 0.4.2 or CVS with splash

valdring log:

==7797== Invalid write of size 1
==7797==    at 0x1C3A885F: Splash::drawPixel(int, int, SplashPattern*, int) (in
/usr/lib/libpoppler.so.0.0.0)
==7797==    by 0x1C3A99A7: Splash::strokeNarrow(SplashXPath*) (in
/usr/lib/libpoppler.so.0.0.0)
==7797==    by 0x1C3AA16B: Splash::stroke(SplashPath*) (in
/usr/lib/libpoppler.so.0.0.0)
==7797==    by 0x1C31CB66: SplashOutputDev::stroke(GfxState*) (in
/usr/lib/libpoppler.so.0.0.0)
==7797==    by 0x1C330A23: Gfx::opStroke(Object*, int) (in
/usr/lib/libpoppler.so.0.0.0)
==7797==    by 0x1C32E62C: Gfx::execOp(Object*, Object*, int) (in
/usr/lib/libpoppler.so.0.0.0)
==7797==    by 0x1C32E8D1: Gfx::go(int) (in /usr/lib/libpoppler.so.0.0.0)
==7797==    by 0x1C32F412: Gfx::display(Object*, int) (in
/usr/lib/libpoppler.so.0.0.0)
==7797==    by 0x1C331647: Gfx::doShowText(GooString*) (in
/usr/lib/libpoppler.so.0.0.0)
==7797==    by 0x1C331A50: Gfx::opShowText(Object*, int) (in
/usr/lib/libpoppler.so.0.0.0)
==7797==    by 0x1C32E62C: Gfx::execOp(Object*, Object*, int) (in
/usr/lib/libpoppler.so.0.0.0)
==7797==    by 0x1C32E8D1: Gfx::go(int) (in /usr/lib/libpoppler.so.0.0.0)
==7797==  Address 0x1D1FB4BF is 1 bytes before a block of size 506 alloc'd
==7797==    at 0x1B9008A2: malloc (vg_replace_malloc.c:149)
==7797==    by 0x1C398948: gmalloc (in /usr/lib/libpoppler.so.0.0.0)
==7797==    by 0x1C3ACA98: SplashBitmap::SplashBitmap(int, int, SplashColorMode)
(in /usr/lib/libpoppler.so.0.0.0)
==7797==    by 0x1C31C27A: SplashOutputDev::type3D1(GfxState*, double, double,
double, double, double, double) (in /usr/lib/libpoppler.so.0.0.0)
==7797==    by 0x1C32D348: Gfx::opSetCacheDevice(Object*, int) (in
/usr/lib/libpoppler.so.0.0.0)
==7797==    by 0x1C32E62C: Gfx::execOp(Object*, Object*, int) (in
/usr/lib/libpoppler.so.0.0.0)
==7797==    by 0x1C32E8D1: Gfx::go(int) (in /usr/lib/libpoppler.so.0.0.0)
==7797==    by 0x1C32F412: Gfx::display(Object*, int) (in
/usr/lib/libpoppler.so.0.0.0)
==7797==    by 0x1C331647: Gfx::doShowText(GooString*) (in
/usr/lib/libpoppler.so.0.0.0)
==7797==    by 0x1C331A50: Gfx::opShowText(Object*, int) (in
/usr/lib/libpoppler.so.0.0.0)
==7797==    by 0x1C32E62C: Gfx::execOp(Object*, Object*, int) (in
/usr/lib/libpoppler.so.0.0.0)
==7797==    by 0x1C32E8D1: Gfx::go(int) (in /usr/lib/libpoppler.so.0.0.0)

Comment 2 Sebastien Bacher 2006-03-03 10:04:45 UTC

Works fine with poppler 0.5.0 now

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.