Created attachment 134453 [details] pg_0155.pdf Forwarding from https://bugs.debian.org/876424 The attached PDF, from page 155 of the PDF in https://bugs.debian.org/876424, causes evince and pdftocairo to print 'out of memory' errors when it's rendered with a high resolution and blacks out sections of evince's GUI. $ pdftocairo -r 1000 -png pg_0155.pdf out Internal Error: cairo context error: out of memory<0a> cairo error: out of memory cairo error: out of memory This could be the same as #100868
This PDF is doing a pattern fill under odd coordinates. For some reason having a large offset to the operation makes cairo have an out of memory error. It's doing roughly this: // create pattern cairo_surface_t *surfacep = cairo_image_surface_create (CAIRO_FORMAT_ARGB32, 25, 25); cairo_t *crp = cairo_create (surfacep); cairo_set_source_rgb (crp, 0, 0, 0); cairo_paint (crp); cairo_pattern_t *pattern = cairo_pattern_create_for_surface (surfacep); cairo_matrix_t mat = {2, 0, 0, 2, 0, 0}; cairo_pattern_set_matrix (pattern, &mat); cairo_pattern_set_extend (pattern, CAIRO_EXTEND_REPEAT); // draw pattern to surface cairo_surface_t *surface = cairo_image_surface_create (CAIRO_FORMAT_ARGB32, 100, 100); cairo_t *cr0 = cairo_create (surface); cairo_translate (cr0, 0, -50000); cairo_set_source (cr0, pattern); cairo_rectangle (cr0, 0, 50000, 100, 100); cairo_fill (cr0); cairo_status_t status = cairo_status (cr0); printf ("cairo_status: %s\n", cairo_status_to_string (status));
Created attachment 134570 [details] Reproducing C program The code from comment #1 as a C program. It seems to reproduce the error here. The following gdb session shows backtraces for calls to _cairo_error: > (gdb) break main > Breakpoint 1 at 0xb72: file test.c, line 6. > (gdb) run > Starting program: /tmp/a.out > b[Thread debugging using libthread_db enabled] > Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". > > Breakpoint 1, main () at test.c:6 > 6 cairo_surface_t *surfacep = cairo_image_surface_create (CAIRO_FORMAT_ARGB32, > (gdb) break _cairo_error > Breakpoint 2 at 0x7ffff7aa38e0: file cairo-error.c, line 68. > (gdb) cont > Continuing. > > Breakpoint 2, _cairo_error (status=status@entry=CAIRO_STATUS_INVALID_MATRIX) at cairo-error.c:68 > 68 assert (_cairo_status_is_error (status)); > (gdb) bt > #0 _cairo_error (status=status@entry=CAIRO_STATUS_INVALID_MATRIX) at cairo-error.c:68 > #1 0x00007ffff7ac27da in _cairo_matrix_to_pixman_matrix (yc=50, xc=50, pixman_transform=0x7fffffffda50, matrix=<synthetic pointer>) at cairo-matrix.c:996 > #2 _cairo_matrix_to_pixman_matrix_offset (matrix=matrix@entry=0x7fffffffe3a0, filter=<optimized out>, xc=50, yc=50, out_transform=out_transform@entry=0x7fffffffda50, > x_offset=x_offset@entry=0x7fffffffdc30, y_offset=y_offset@entry=0x7fffffffdc40) at cairo-matrix.c:1210 > #3 0x00007ffff7ab9463 in _pixman_image_set_properties (pixman_image=pixman_image@entry=0x5555557659b0, pattern=pattern@entry=0x7fffffffe360, extents=extents@entry=0x7fffffffe31c, > ix=ix@entry=0x7fffffffdc30, iy=iy@entry=0x7fffffffdc40) at cairo-image-source.c:900 > #4 0x00007ffff7abd424 in _pixman_image_for_surface (iy=0x7fffffffdc40, ix=0x7fffffffdc30, sample=<optimized out>, extents=0x7fffffffe31c, is_mask=<optimized out>, pattern=0x7fffffffe360, > dst=<optimized out>) at cairo-image-source.c:1424 > #5 _pixman_image_for_pattern (ty=0x7fffffffdc40, tx=0x7fffffffdc30, sample=<optimized out>, extents=0x7fffffffe31c, is_mask=<optimized out>, pattern=0x7fffffffe360, dst=<optimized out>) > at cairo-image-source.c:1557 > #6 _cairo_image_source_create_for_pattern (dst=<optimized out>, pattern=0x7fffffffe360, is_mask=<optimized out>, extents=0x7fffffffe31c, sample=<optimized out>, src_x=0x7fffffffdc30, > src_y=0x7fffffffdc40) at cairo-image-source.c:1602 > #7 0x00007ffff7b08e9d in composite_aligned_boxes (boxes=0x7fffffffe060, extents=0x7fffffffe2e0, compositor=0x7ffff7dd7320 <spans>) at cairo-spans-compositor.c:678 > #8 clip_and_composite_boxes (compositor=compositor@entry=0x7ffff7dd7320 <spans>, extents=extents@entry=0x7fffffffe2e0, boxes=boxes@entry=0x7fffffffe060) at cairo-spans-compositor.c:882 > #9 0x00007ffff7b0933e in clip_and_composite_boxes (boxes=0x7fffffffe060, extents=0x7fffffffe2e0, compositor=0x7ffff7dd7320 <spans>) at cairo-spans-compositor.c:1003 > #10 _cairo_spans_compositor_mask (_compositor=0x7ffff7dd7320 <spans>, extents=0x7fffffffe2e0) at cairo-spans-compositor.c:999 > #11 0x00007ffff7a9f8c9 in _cairo_compositor_paint (compositor=0x7ffff7dd7320 <spans>, surface=0x555555765120, op=<optimized out>, source=<optimized out>, clip=<optimized out>) > at cairo-compositor.c:65 > #12 0x00007ffff7b0e391 in _cairo_surface_paint (surface=0x555555765120, op=op@entry=CAIRO_OPERATOR_OVER, source=source@entry=0x7fffffffe640, clip=0x0) at cairo-surface.c:2120 > #13 0x00007ffff7aa9cd9 in _cairo_gstate_fill (gstate=0x5555557652e0, path=path@entry=0x555555765618) at cairo-gstate.c:1313 > #14 0x00007ffff7aa1bd9 in _cairo_default_context_fill (abstract_cr=0x5555557652b0) at cairo-default-context.c:1055 > #15 0x00007ffff7a97c2a in cairo_fill (cr=0x5555557652b0) at cairo.c:2423 > #16 0x0000555555554cc7 in main () at test.c:23 > (gdb) cont > Continuing. > > Breakpoint 2, _cairo_error (status=CAIRO_STATUS_NO_MEMORY) at cairo-error.c:68 > 68 assert (_cairo_status_is_error (status)); > (gdb) bt > #0 _cairo_error (status=CAIRO_STATUS_NO_MEMORY) at cairo-error.c:68 > #1 0x00007ffff7b0e3e8 in _cairo_surface_set_error (status=<optimized out>, surface=0x555555765120) at cairo-surface.c:201 > #2 _cairo_surface_paint (surface=0x555555765120, op=op@entry=CAIRO_OPERATOR_OVER, source=source@entry=0x7fffffffe640, clip=0x0) at cairo-surface.c:2126 > #3 0x00007ffff7aa9cd9 in _cairo_gstate_fill (gstate=0x5555557652e0, path=path@entry=0x555555765618) at cairo-gstate.c:1313 > #4 0x00007ffff7aa1bd9 in _cairo_default_context_fill (abstract_cr=0x5555557652b0) at cairo-default-context.c:1055 > #5 0x00007ffff7a97c2a in cairo_fill (cr=0x5555557652b0) at cairo.c:2423 > #6 0x0000555555554cc7 in main () at test.c:23 > (gdb) cont > Continuing. > > Breakpoint 2, _cairo_error (status=status@entry=CAIRO_STATUS_NO_MEMORY) at cairo-error.c:68 > 68 assert (_cairo_status_is_error (status)); > (gdb) bt > #0 _cairo_error (status=status@entry=CAIRO_STATUS_NO_MEMORY) at cairo-error.c:68 > #1 0x00007ffff7a97c47 in _cairo_set_error (status=CAIRO_STATUS_NO_MEMORY, cr=0x5555557652b0) at cairo.c:400 > #2 cairo_fill (cr=0x5555557652b0) at cairo.c:2425 > #3 0x0000555555554cc7 in main () at test.c:23 > (gdb) cont > Continuing. > > Breakpoint 2, _cairo_error (status=status@entry=CAIRO_STATUS_NO_MEMORY) at cairo-error.c:68 > 68 assert (_cairo_status_is_error (status)); > (gdb) bt > #0 _cairo_error (status=status@entry=CAIRO_STATUS_NO_MEMORY) at cairo-error.c:68 > #1 0x00007ffff7a97c53 in _cairo_set_error (status=CAIRO_STATUS_NO_MEMORY, cr=0x5555557652b0) at cairo.c:400 > #2 cairo_fill (cr=0x5555557652b0) at cairo.c:2425 > #3 0x0000555555554cc7 in main () at test.c:23 > (gdb) cont > Continuing. > cairo_status: out of memory > [Inferior 1 (process 4459) exited normally] I'm not sure how CAIRO_STATUS_INVALID_MATRIX turns into CAIRO_STATUS_NO_MEMORY, but the original error is that the code comes up with a transformation where some value exceeds PIXMAN_MAX_INT. I'm sure that this is a duplicate of some other bug, but right now I don't know which one.
*** Bug 100868 has been marked as a duplicate of this bug. ***
Created attachment 134687 [details] test-100868.c The PDF in bug #100868 is the same. It's also doing a pattern fill under different, but still odd coordinates, making cairo have an invalid matrix and out of memory error. Backtrace is similar. > (gdb) b _cairo_error > Breakpoint 2 at 0x7ffff7a897b2: file cairo-error.c, line 68. > (gdb) run > Starting program: /home/jason/100868/test > [Thread debugging using libthread_db enabled] > Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". > > Breakpoint 2, _cairo_error (status=CAIRO_STATUS_INVALID_MATRIX) at cairo-error.c:68 > 68 assert (_cairo_status_is_error (status)); > (gdb) bt > #0 _cairo_error (status=CAIRO_STATUS_INVALID_MATRIX) at cairo-error.c:68 > #1 0x00007ffff7aa434c in _cairo_matrix_to_pixman_matrix (matrix=0x7fffffffb7f0, pixman_transform=0x7fffffffb8c0, xc=818.5, yc=1123) at cairo-matrix.c:996 > #2 0x00007ffff7aa4b63 in _cairo_matrix_to_pixman_matrix_offset (matrix=0x7fffffffd4c0, filter=CAIRO_FILTER_GOOD, xc=818.5, yc=1123, out_transform=0x7fffffffb8c0, x_offset=0x7fffffffbb70, y_offset=0x7fffffffbb74) > at cairo-matrix.c:1210 > #3 0x00007ffff7a9d628 in _pixman_image_set_properties (pixman_image=0x55555575ed50, pattern=0x7fffffffd480, extents=0x7fffffffd43c, ix=0x7fffffffbb70, iy=0x7fffffffbb74) at cairo-image-source.c:900 > #4 0x00007ffff7a9e821 in _pixman_image_for_surface (dst=0x55555575a920, pattern=0x7fffffffd480, is_mask=0, extents=0x7fffffffd43c, sample=0x7fffffffd460, ix=0x7fffffffbb70, iy=0x7fffffffbb74) at cairo-image-source.c:1424 > #5 0x00007ffff7a9ec12 in _pixman_image_for_pattern (dst=0x55555575a920, pattern=0x7fffffffd480, is_mask=0, extents=0x7fffffffd43c, sample=0x7fffffffd460, tx=0x7fffffffbb70, ty=0x7fffffffbb74) at cairo-image-source.c:1557 > #6 0x00007ffff7a9a36e in inplace_renderer_init (r=0x7fffffffbb20, composite=0x7fffffffd400, antialias=CAIRO_ANTIALIAS_DEFAULT, needs_clip=0) at cairo-image-compositor.c:2904 > #7 0x00007ffff7a9a550 in span_renderer_init (_r=0x7fffffffbb20, composite=0x7fffffffd400, antialias=CAIRO_ANTIALIAS_DEFAULT, needs_clip=0) at cairo-image-compositor.c:2966 > #8 0x00007ffff7aec547 in composite_polygon (compositor=0x7ffff7dd7920 <spans>, extents=0x7fffffffd400, polygon=0x7fffffffcfb0, fill_rule=CAIRO_FILL_RULE_WINDING, antialias=CAIRO_ANTIALIAS_DEFAULT) > at cairo-spans-compositor.c:798 > #9 0x00007ffff7aecb0a in clip_and_composite_polygon (compositor=0x7ffff7dd7920 <spans>, extents=0x7fffffffd400, polygon=0x7fffffffcfb0, fill_rule=CAIRO_FILL_RULE_WINDING, antialias=CAIRO_ANTIALIAS_DEFAULT) > at cairo-spans-compositor.c:967 > #10 0x00007ffff7aed2d7 in _cairo_spans_compositor_fill (_compositor=0x7ffff7dd7920 <spans>, extents=0x7fffffffd400, path=0x55555575ae18, fill_rule=CAIRO_FILL_RULE_WINDING, tolerance=0.10000000000000001, > antialias=CAIRO_ANTIALIAS_DEFAULT) at cairo-spans-compositor.c:1174 > #11 0x00007ffff7a83cba in _cairo_compositor_fill (compositor=0x7ffff7dd7920 <spans>, surface=0x55555575a920, op=CAIRO_OPERATOR_OVER, source=0x7fffffffd7f0, path=0x55555575ae18, fill_rule=CAIRO_FILL_RULE_WINDING, > tolerance=0.10000000000000001, antialias=CAIRO_ANTIALIAS_DEFAULT, clip=0x0) at cairo-compositor.c:203 > #12 0x00007ffff7aa03f8 in _cairo_image_surface_fill (abstract_surface=0x55555575a920, op=CAIRO_OPERATOR_OVER, source=0x7fffffffd7f0, path=0x55555575ae18, fill_rule=CAIRO_FILL_RULE_WINDING, tolerance=0.10000000000000001, > antialias=CAIRO_ANTIALIAS_DEFAULT, clip=0x0) at cairo-image-surface.c:987 > #13 0x00007ffff7af32c4 in _cairo_surface_fill (surface=0x55555575a920, op=CAIRO_OPERATOR_OVER, source=0x7fffffffd7f0, path=0x55555575ae18, fill_rule=CAIRO_FILL_RULE_WINDING, tolerance=0.10000000000000001, > antialias=CAIRO_ANTIALIAS_DEFAULT, clip=0x0) at cairo-surface.c:2343 > #14 0x00007ffff7a90ce7 in _cairo_gstate_fill (gstate=0x55555575aae0, path=0x55555575ae18) at cairo-gstate.c:1318 > #15 0x00007ffff7a88538 in _cairo_default_context_fill (abstract_cr=0x55555575aab0) at cairo-default-context.c:1055 > #16 0x00007ffff7a7b01f in cairo_fill (cr=0x55555575aab0) at cairo.c:2424 > #17 0x0000555555554bdc in main (argc=1, argv=0x7fffffffdb58) at test.c:20 > (gdb) c > Continuing. > > Breakpoint 2, _cairo_error (status=CAIRO_STATUS_NO_MEMORY) at cairo-error.c:68 > 68 assert (_cairo_status_is_error (status)); > (gdb) bt > #0 _cairo_error (status=CAIRO_STATUS_NO_MEMORY) at cairo-error.c:68 > #1 0x00007ffff7a9a394 in inplace_renderer_init (r=0x7fffffffbb20, composite=0x7fffffffd400, antialias=CAIRO_ANTIALIAS_DEFAULT, needs_clip=0) at cairo-image-compositor.c:2909 > #2 0x00007ffff7a9a550 in span_renderer_init (_r=0x7fffffffbb20, composite=0x7fffffffd400, antialias=CAIRO_ANTIALIAS_DEFAULT, needs_clip=0) at cairo-image-compositor.c:2966 > #3 0x00007ffff7aec547 in composite_polygon (compositor=0x7ffff7dd7920 <spans>, extents=0x7fffffffd400, polygon=0x7fffffffcfb0, fill_rule=CAIRO_FILL_RULE_WINDING, antialias=CAIRO_ANTIALIAS_DEFAULT) > at cairo-spans-compositor.c:798 > #4 0x00007ffff7aecb0a in clip_and_composite_polygon (compositor=0x7ffff7dd7920 <spans>, extents=0x7fffffffd400, polygon=0x7fffffffcfb0, fill_rule=CAIRO_FILL_RULE_WINDING, antialias=CAIRO_ANTIALIAS_DEFAULT) > at cairo-spans-compositor.c:967 > #5 0x00007ffff7aed2d7 in _cairo_spans_compositor_fill (_compositor=0x7ffff7dd7920 <spans>, extents=0x7fffffffd400, path=0x55555575ae18, fill_rule=CAIRO_FILL_RULE_WINDING, tolerance=0.10000000000000001, > antialias=CAIRO_ANTIALIAS_DEFAULT) at cairo-spans-compositor.c:1174 > #6 0x00007ffff7a83cba in _cairo_compositor_fill (compositor=0x7ffff7dd7920 <spans>, surface=0x55555575a920, op=CAIRO_OPERATOR_OVER, source=0x7fffffffd7f0, path=0x55555575ae18, fill_rule=CAIRO_FILL_RULE_WINDING, > tolerance=0.10000000000000001, antialias=CAIRO_ANTIALIAS_DEFAULT, clip=0x0) at cairo-compositor.c:203 > #7 0x00007ffff7aa03f8 in _cairo_image_surface_fill (abstract_surface=0x55555575a920, op=CAIRO_OPERATOR_OVER, source=0x7fffffffd7f0, path=0x55555575ae18, fill_rule=CAIRO_FILL_RULE_WINDING, tolerance=0.10000000000000001, > antialias=CAIRO_ANTIALIAS_DEFAULT, clip=0x0) at cairo-image-surface.c:987 > #8 0x00007ffff7af32c4 in _cairo_surface_fill (surface=0x55555575a920, op=CAIRO_OPERATOR_OVER, source=0x7fffffffd7f0, path=0x55555575ae18, fill_rule=CAIRO_FILL_RULE_WINDING, tolerance=0.10000000000000001, > antialias=CAIRO_ANTIALIAS_DEFAULT, clip=0x0) at cairo-surface.c:2343 > #9 0x00007ffff7a90ce7 in _cairo_gstate_fill (gstate=0x55555575aae0, path=0x55555575ae18) at cairo-gstate.c:1318 > #10 0x00007ffff7a88538 in _cairo_default_context_fill (abstract_cr=0x55555575aab0) at cairo-default-context.c:1055 > #11 0x00007ffff7a7b01f in cairo_fill (cr=0x55555575aab0) at cairo.c:2424 > #12 0x0000555555554bdc in main (argc=1, argv=0x7fffffffdb58) at test.c:20 > (gdb) c > Continuing. > > Breakpoint 2, _cairo_error (status=CAIRO_STATUS_NO_MEMORY) at cairo-error.c:68 > 68 assert (_cairo_status_is_error (status)); > (gdb) bt > #0 _cairo_error (status=CAIRO_STATUS_NO_MEMORY) at cairo-error.c:68 > #1 0x00007ffff7af035a in _cairo_surface_set_error (surface=0x55555575a920, status=CAIRO_INT_STATUS_NO_MEMORY) at cairo-surface.c:201 > #2 0x00007ffff7af3301 in _cairo_surface_fill (surface=0x55555575a920, op=CAIRO_OPERATOR_OVER, source=0x7fffffffd7f0, path=0x55555575ae18, fill_rule=CAIRO_FILL_RULE_WINDING, tolerance=0.10000000000000001, > antialias=CAIRO_ANTIALIAS_DEFAULT, clip=0x0) at cairo-surface.c:2352 > #3 0x00007ffff7a90ce7 in _cairo_gstate_fill (gstate=0x55555575aae0, path=0x55555575ae18) at cairo-gstate.c:1318 > #4 0x00007ffff7a88538 in _cairo_default_context_fill (abstract_cr=0x55555575aab0) at cairo-default-context.c:1055 > #5 0x00007ffff7a7b01f in cairo_fill (cr=0x55555575aab0) at cairo.c:2424 > #6 0x0000555555554bdc in main (argc=1, argv=0x7fffffffdb58) at test.c:20 > (gdb) c > Continuing. > > Breakpoint 2, _cairo_error (status=CAIRO_STATUS_NO_MEMORY) at cairo-error.c:68 > 68 assert (_cairo_status_is_error (status)); > (gdb) bt > #0 _cairo_error (status=CAIRO_STATUS_NO_MEMORY) at cairo-error.c:68 > #1 0x00007ffff7a79786 in _cairo_set_error (cr=0x55555575aab0, status=CAIRO_STATUS_NO_MEMORY) at cairo.c:401 > #2 0x00007ffff7a7b039 in cairo_fill (cr=0x55555575aab0) at cairo.c:2426 > #3 0x0000555555554bdc in main (argc=1, argv=0x7fffffffdb58) at test.c:20 > (gdb) c > Continuing. > > Breakpoint 2, _cairo_error (status=CAIRO_STATUS_NO_MEMORY) at cairo-error.c:68 > 68 assert (_cairo_status_is_error (status)); > (gdb) bt > #0 _cairo_error (status=CAIRO_STATUS_NO_MEMORY) at cairo-error.c:68 > #1 0x00007ffff7a797b4 in _cairo_set_error (cr=0x55555575aab0, status=CAIRO_STATUS_NO_MEMORY) at cairo.c:401 > #2 0x00007ffff7a7b039 in cairo_fill (cr=0x55555575aab0) at cairo.c:2426 > #3 0x0000555555554bdc in main (argc=1, argv=0x7fffffffdb58) at test.c:20 > (gdb) c > Continuing. > cairo_status: out of memory > [Inferior 1 (process 15289) exited normally]
Created attachment 138252 [details] Another minimal program reproducing the out of memory with big translation matrix Attaching another minimal program which reproduces the bug. I stumbled upon this bug when developing my SVG rendering library (https://github.com/igagis/svgren), there are real SVG files produced by some software which cause this bug to happen in my SVG rendering library. So, this bug has real world impact.
https://github.com/igagis/svgren/issues/51
Any idea how to workaround this? Like what is the maximum allowed value of a transformation matrix element?
-- GitLab Migration Automatic Message -- This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity. You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/cairo/cairo/issues/238.
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.