Bug 1314088

Summary: [abrt] evince: active_edges(): evince killed by SIGSEGV
Product: [Fedora] Fedora Reporter: Przemek Klosowski <przemek>
Component: cairoAssignee: Benjamin Otte <otte>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 23CC: feborges, mhatina, mkasik, otte
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
URL: https://retrace.fedoraproject.org/faf/reports/bthash/c9e4cd3e2a0ffcd5260230262a4d8b6cbe915697
Whiteboard: abrt_hash:1024412691c6cc07e1ae2ce9942f3a27155460e9;VARIANT_ID=workstation;
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-11-25 15:00:49 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Attachments:
Description Flags
File: backtrace
none
File: cgroup
none
File: core_backtrace
none
File: dso_list
none
File: environ
none
File: exploitable
none
File: limits
none
File: maps
none
File: mountinfo
none
File: namespaces
none
File: open_fds
none
File: proc_pid_status
none
File: var_log_messages
none
File: bug.pdf none

Description Przemek Klosowski 2016-03-02 21:26:53 UTC
Description of problem:
I have prepared a 200kB one-page PDF file that reliably triggers this bug. I will try to attach it or create another Bugzilla report with it.

Version-Release number of selected component:
evince-3.18.2-3.fc23

Additional info:
reporter:       libreport-2.6.4
backtrace_rating: 4
cmdline:        evince /tmp/mozilla_przemek0/gear_guide.pdf
crash_function: active_edges
executable:     /usr/bin/evince
global_pid:     25870
kernel:         4.3.5-300.fc23.x86_64
runlevel:       N 5
type:           CCpp
uid:            1000

Truncated backtrace:
Thread no. 1 (10 frames)
 #0 active_edges at cairo-polygon-intersect.c:1235
 #1 intersection_sweep at cairo-polygon-intersect.c:1271
 #2 _cairo_polygon_intersect at cairo-polygon-intersect.c:1466
 #3 clip_and_composite_polygon at cairo-spans-compositor.c:946
 #4 _cairo_spans_compositor_stroke at cairo-spans-compositor.c:1083
 #5 _cairo_compositor_stroke at cairo-compositor.c:157
 #6 _cairo_image_surface_stroke at cairo-image-surface.c:964
 #7 _cairo_surface_stroke at cairo-surface.c:2296
 #8 _cairo_gstate_stroke at cairo-gstate.c:1194
 #9 _cairo_default_context_stroke at cairo-default-context.c:1010

Potential duplicate: bug 886677

Comment 1 Przemek Klosowski 2016-03-02 21:27:00 UTC
Created attachment 1132538 [details]
File: backtrace

Comment 2 Przemek Klosowski 2016-03-02 21:27:01 UTC
Created attachment 1132539 [details]
File: cgroup

Comment 3 Przemek Klosowski 2016-03-02 21:27:03 UTC
Created attachment 1132540 [details]
File: core_backtrace

Comment 4 Przemek Klosowski 2016-03-02 21:27:04 UTC
Created attachment 1132541 [details]
File: dso_list

Comment 5 Przemek Klosowski 2016-03-02 21:27:06 UTC
Created attachment 1132542 [details]
File: environ

Comment 6 Przemek Klosowski 2016-03-02 21:27:08 UTC
Created attachment 1132543 [details]
File: exploitable

Comment 7 Przemek Klosowski 2016-03-02 21:27:10 UTC
Created attachment 1132544 [details]
File: limits

Comment 8 Przemek Klosowski 2016-03-02 21:27:12 UTC
Created attachment 1132545 [details]
File: maps

Comment 9 Przemek Klosowski 2016-03-02 21:27:14 UTC
Created attachment 1132546 [details]
File: mountinfo

Comment 10 Przemek Klosowski 2016-03-02 21:27:16 UTC
Created attachment 1132547 [details]
File: namespaces

Comment 11 Przemek Klosowski 2016-03-02 21:27:18 UTC
Created attachment 1132548 [details]
File: open_fds

Comment 12 Przemek Klosowski 2016-03-02 21:27:19 UTC
Created attachment 1132549 [details]
File: proc_pid_status

Comment 13 Przemek Klosowski 2016-03-02 21:27:21 UTC
Created attachment 1132550 [details]
File: var_log_messages

Comment 14 Przemek Klosowski 2016-03-02 21:27:24 UTC
Created attachment 1132551 [details]
File: bug.pdf

Comment 15 Przemek Klosowski 2016-03-02 21:31:54 UTC
Just took a quick look and the proximate cause is a null pointer in _cairo_polygon_intersect (polygon=0x7fffe0b52630, top=2250, left=0x7fffd031c240) at cairo-polygon-intersect.c:1235
1235			if unlikely ((right->deferred.other))

right is initialized from left->next, and right.deferred.other (cairo_bo_edge_t *) is null. I haven't traced the code that sets that structure yet.

Comment 16 Marek Kašík 2016-03-03 11:19:56 UTC
This is a bug in cairo. It has been already fixed in cairo 1.14.4 which is not in Fedora yet.
Thank you for the PDF, it helped me to find the upstream bug.

Comment 17 Fedora End Of Life 2016-11-24 15:53:59 UTC
This message is a reminder that Fedora 23 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 23. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as EOL if it remains open with a Fedora  'version'
of '23'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 23 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.