This bug has been opened here: http://bugzilla.ubuntu.com/show_bug.cgi?id=16155 "typing evince nasty.pdf in a terminal, and then instructiong evince to go to page 21 (by typing 21 in the box and hitting enter) hangs evince (it stops responding to any input). In the terminal the following nasty messages are shown: jorge@jorge06:~/samba_publico/gaga/ele-39$ evince nastybug.pdf *** glibc detected *** free(): invalid pointer: 0x08306890 *** Xlib: unexpected async reply (sequence 0xca2)! Killed Of course the "Killed" message is shown after I "force quit" evince. the same pdf can be read flawlessly (well, except for some error messages in the terminal, see log file attached) in xpdf. This happened in Breezy (which I update daily) , in a Athlon XP 2600+, MSI KT4 Ultra motherboard. The computer's FSB has been underclocked from 133 MHz to 128 MHz to become stable, but, anyway, I don't think this evince problem is a hardware one. http://bugzilla.ubuntu.com/attachment.cgi?id=4022 The pdf that hands evince http://bugzilla.ubuntu.com/attachment.cgi?id=4023 the output of xpdf nastybug.pdf 2> xpdflog.txt"
That's using poppler 0.4.2 or CVS with splash valdring log: ==7797== Invalid write of size 1 ==7797== at 0x1C3A885F: Splash::drawPixel(int, int, SplashPattern*, int) (in /usr/lib/libpoppler.so.0.0.0) ==7797== by 0x1C3A99A7: Splash::strokeNarrow(SplashXPath*) (in /usr/lib/libpoppler.so.0.0.0) ==7797== by 0x1C3AA16B: Splash::stroke(SplashPath*) (in /usr/lib/libpoppler.so.0.0.0) ==7797== by 0x1C31CB66: SplashOutputDev::stroke(GfxState*) (in /usr/lib/libpoppler.so.0.0.0) ==7797== by 0x1C330A23: Gfx::opStroke(Object*, int) (in /usr/lib/libpoppler.so.0.0.0) ==7797== by 0x1C32E62C: Gfx::execOp(Object*, Object*, int) (in /usr/lib/libpoppler.so.0.0.0) ==7797== by 0x1C32E8D1: Gfx::go(int) (in /usr/lib/libpoppler.so.0.0.0) ==7797== by 0x1C32F412: Gfx::display(Object*, int) (in /usr/lib/libpoppler.so.0.0.0) ==7797== by 0x1C331647: Gfx::doShowText(GooString*) (in /usr/lib/libpoppler.so.0.0.0) ==7797== by 0x1C331A50: Gfx::opShowText(Object*, int) (in /usr/lib/libpoppler.so.0.0.0) ==7797== by 0x1C32E62C: Gfx::execOp(Object*, Object*, int) (in /usr/lib/libpoppler.so.0.0.0) ==7797== by 0x1C32E8D1: Gfx::go(int) (in /usr/lib/libpoppler.so.0.0.0) ==7797== Address 0x1D1FB4BF is 1 bytes before a block of size 506 alloc'd ==7797== at 0x1B9008A2: malloc (vg_replace_malloc.c:149) ==7797== by 0x1C398948: gmalloc (in /usr/lib/libpoppler.so.0.0.0) ==7797== by 0x1C3ACA98: SplashBitmap::SplashBitmap(int, int, SplashColorMode) (in /usr/lib/libpoppler.so.0.0.0) ==7797== by 0x1C31C27A: SplashOutputDev::type3D1(GfxState*, double, double, double, double, double, double) (in /usr/lib/libpoppler.so.0.0.0) ==7797== by 0x1C32D348: Gfx::opSetCacheDevice(Object*, int) (in /usr/lib/libpoppler.so.0.0.0) ==7797== by 0x1C32E62C: Gfx::execOp(Object*, Object*, int) (in /usr/lib/libpoppler.so.0.0.0) ==7797== by 0x1C32E8D1: Gfx::go(int) (in /usr/lib/libpoppler.so.0.0.0) ==7797== by 0x1C32F412: Gfx::display(Object*, int) (in /usr/lib/libpoppler.so.0.0.0) ==7797== by 0x1C331647: Gfx::doShowText(GooString*) (in /usr/lib/libpoppler.so.0.0.0) ==7797== by 0x1C331A50: Gfx::opShowText(Object*, int) (in /usr/lib/libpoppler.so.0.0.0) ==7797== by 0x1C32E62C: Gfx::execOp(Object*, Object*, int) (in /usr/lib/libpoppler.so.0.0.0) ==7797== by 0x1C32E8D1: Gfx::go(int) (in /usr/lib/libpoppler.so.0.0.0)
Works fine with poppler 0.5.0 now
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.