evince-thumbnailer crashed with SIGSEGV in CairoOutputDev::restoreState()

[Tormod Volden]

Binary package hint: evince

It happened when I opened a folder with PDFs, JPEGs, MS Word and Powerpoint files for the first time.

ProblemType: Crash
Architecture: i386
Date: Fri Oct 16 13:36:14 2009
DistroRelease: Ubuntu 9.10
ExecutablePath: /usr/bin/evince-thumbnailer
InstallationMedia: Ubuntu 9.10 "Karmic Koala" - Alpha i386 (20091015)
Package: evince 2.28.0-0ubuntu4
ProcCmdline: root=/dev/mapper/isw_ececbiichd_osmoraid3 ro quiet splash
ProcEnviron:
 LANG=en_US.UTF-8
 SHELL=/bin/bash
ProcVersionSignature: Ubuntu 2.6.31-14.46-generic
SegvAnalysis:
 Segfault happened at: 0xe1283d <_ZN14CairoOutputDev12restoreStateEP8GfxState+157>: mov (%edi),%eax
 PC (0x00e1283d) ok
 source "(%edi)" (0x00000000) not located in a known VMA region (needed readable region)!
 destination "%eax" ok
SegvReason: reading NULL VMA
Signal: 11
SourcePackage: evince
StacktraceTop:
 CairoOutputDev::restoreState(GfxState*) ()
 Gfx::restoreState() () from /usr/lib/libpoppler.so.5
 Gfx::opRestore(Object*, int) ()
 Gfx::execOp(Object*, Object*, int) ()
 Gfx::go(int) () from /usr/lib/libpoppler.so.5
Title: evince-thumbnailer crashed with SIGSEGV in CairoOutputDev::restoreState()
Uname: Linux 2.6.31-14-generic i686
UserGroups: adm admin cdrom dialout lpadmin plugdev sambashare

[Tormod Volden (tormodvolden)]

Traced it down to one PDF file, and it makes also evince segfault:

Error: PDF file is damaged - attempting to reconstruct xref table...
Error (122382): Too few (5) args to 'cm' operator
Error (122392): Too few (5) args to 'cm' operator
Error (122395): Unknown operator 'Q37'
Error (122404): Too few (5) args to 'cm' operator
Error (122410): Too few (5) args to 'cm' operator
Error: XObject 'I8' is unknown
Error (122413): Unknown operator 'Q5'
Error (122427): Arg #0 to 'Do' operator is wrong type (integer)
Error (122428): Unknown operator 'q350601.0'
Error (122433): Too few (3) args to 'cm' operator
Error (122433): Arg #0 to 'Do' operator is wrong type (integer)
Error (122437): Unknown operator 'q350601.0'
Error (122437): Too few (3) args to 'cm' operator
Error (122448): Arg #0 to 'cm' operator is wrong type (name)
Error: XObject '80' is unknown
Error (122459): Unknown operator 'o'
Segmentation fault (core dumped)

[Pedro Villavicencio (pedro)]

could you attach the pdf file to the report? thanks.

[Tormod Volden (tormodvolden)]

No, but I can try to get a better backtrace.

[Pedro Villavicencio (pedro)]

please do so, thanks.

[Charlie Kravetz (cjkgeek)]

We'd like to figure out what's causing this bug for you, but we haven't heard back from you in a while. Could you please provide the requested information? Thanks!

[Tormod Volden (tormodvolden)]

I am afraid I can not find the offending PDF file (or the bug has gone away) so I will close the bug for now. If I (or someone else, I can see 2 other people have marked it as affecting them) can reproduce again, I will reopen it.