evince crashes while display LaTeX 'microtype' package documentation

[Nathaniel Smith]

Binary package hint: evince

To reproduce:

1) Download the documentation for the LaTeX package 'microtype': http://mirrors.med.harvard.edu/ctan/macros/latex/contrib/microtype/microtype.pdf
  (also attached)

2) Open it in evince

3) Scroll to page 4

Result: evince segfaults.

Okular and xpdf both display it fine, though there's some 'clever' code on that page that appears to be displaying different things depending on whether the viewer claims PDF 1.5 support. So their ability to display the document may just reflect their being more pessimistic about their own abilities. But it is a real document, that I'd really like to read, and that has legitimate reason to be using these funny features, so it would be nice if evince would stop segfaulting.

(gdb) bt full
#0 OptionalContentGroup::getRef (this=0x0) at OptionalContent.cc:314
No locals.
#1 0xb14fb8da in get_layer_for_ref (document=<value optimized out>,
    layers=<value optimized out>, ref=0xb0f3f100, preserve_rb=1)
    at poppler-action.cc:533
        layer = <value optimized out>
        ocgRef = <value optimized out>
        l = 0xb7e7f3c0
#2 0xb14fc1c7 in build_ocg_state (document=0xb7ec4660, link=0xb5ac2228,
    title=0x0) at poppler-action.cc:586
        layer = <value optimized out>
        list = 0xb5a78f00
        preserve_rb = 1
        i = 0
        layer_state = 0x0
        st_list = 0xb0f94fa0
        j = 1
#3 _poppler_action_new (document=0xb7ec4660, link=0xb5ac2228, title=0x0)
    at poppler-action.cc:645
No locals.
#4 0xb1502f2f in poppler_page_get_link_mapping (page=0xb7e6dac0)
    at poppler-page.cc:1261
        link_action = <value optimized out>
        link = 0xb0f6f718
        i = 0
        obj = {type = objNone, {booln = -1209683048, intg = -1209683048,
            uintg = 3085284248, real = 1.5243329545919447e-314,
            string = 0xb7e5b398, name = 0xb7e5b398 "\030\b淰\263\345\267\b",
            array = 0xb7e5b398, dict = 0xb7e5b398, stream = 0xb7e5b398, ref = {
              num = -1209683048, gen = 0},
            cmd = 0xb7e5b398 "\030\b淰\263\345\267\b"}}
        __PRETTY_FUNCTION__ = "GList* poppler_page_get_link_mapping(PopplerPage*)"
        map_list = <value optimized out>
        width = 595.27600000000007
        height = 841.88999999999999
#5 0xb154be8c in pdf_document_links_get_links (document_links=0xb7d446d0,
    page=0xb5af9830)
    at /build/buildd/evince-2.32.0/./backend/pdf/ev-poppler.cc:1268
        pdf_document = 0xb7d446d0
        retval = 0xb5a00578
        list = <value optimized out>
        mapping_list = 0x0
---Type <return> to continue, or q <return> to quit---
        height = <value optimized out>
#6 0xb768668a in ev_document_links_get_links (document_links=0xb7d446d0,
    page=0xb5af9830)
    at /build/buildd/evince-2.32.0/./libdocument/ev-document-links.c:63
No locals.
#7 0xb764e373 in ev_job_page_data_run (job=0xb7e9cb88)
    at /build/buildd/evince-2.32.0/./libview/ev-jobs.c:692
        job_pd = 0xb7e9cb88
        ev_page = 0xb5af9830
#8 0xb764b371 in ev_job_run (job=0xb7e9cb88)
    at /build/buildd/evince-2.32.0/./libview/ev-jobs.c:214
No locals.
#9 0xb764f368 in ev_job_thread (data=0x0)
    at /build/buildd/evince-2.32.0/./libview/ev-job-scheduler.c:183
        result = <value optimized out>
#10 ev_job_thread_proxy (data=0x0)
    at /build/buildd/evince-2.32.0/./libview/ev-job-scheduler.c:213
        job = 0xb802d238
#11 0xb6b6148f in ?? () from /lib/libglib-2.0.so.0
No symbol table info available.
#12 0xb6aa8cc9 in start_thread (arg=0xb1d52b70) at pthread_create.c:304
        __res = <value optimized out>
        __ignore1 = <value optimized out>
        __ignore2 = <value optimized out>
        pd = 0xb1d52b70
        now = <value optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {-1230266380, 0, 4001536,
                -1311431928, -372923505, 379113857}, mask_was_saved = 0}},
          priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0,
              cleanup = 0x0, canceltype = 0}}}
        not_first_call = <value optimized out>
        robust = <value optimized out>
        freesize = <value optimized out>
        __PRETTY_FUNCTION__ = "start_thread"
#13 0xb6a1669e in clone () at ../sysdeps/unix/sysv/linux/i386/clone.S:130
No locals.
(gdb)

ProblemType: Bug
DistroRelease: Ubuntu 10.10
Package: evince 2.32.0-0ubuntu1.1
ProcVersionSignature: Error: [Errno 2] No such file or directory: '/proc/version_signature'
Uname: Linux 2.6.38-rc4-custom-wl i686
Architecture: i386
Date: Tue Feb 15 23:23:10 2011
ExecutablePath: /usr/bin/evince
InstallationMedia: Ubuntu 9.10 "Karmic Koala" - Release i386 (20091028.5)
ProcEnviron:
 PATH=(custom, user)
 LANG=en_US.utf8
 SHELL=/usr/bin/zsh
SourcePackage: evince

[Marcel Stimberg (marcelstimberg)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. This particular bug has already been reported and is a duplicate of bug 633574, so it is being marked as such. Please look at the other bug report to see if there is any missing information that you can provide, or to see if there is a workaround for the bug. Additionally, any further discussion regarding the bug should occur in the other report. Please continue to report any other bugs you may find.