Bug 488553

Summary: Evince crashes in JBIG2SymbolDict on JBIG2 based file
Product: [Fedora] Fedora Reporter: Tobias Mueller <fedora-bugs>
Component: evinceAssignee: Jonathan Blandford <jrb>
Status: CLOSED WONTFIX QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: 10CC: ddumas, jrb
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-12-18 08:56:58 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
crashing PDF none

Description Tobias Mueller 2009-03-04 19:55:28 UTC 
Created attachment 334044 [details]
crashing PDF

Description of problem:
Evince crashes on viewing a specially crafted PDF file.

Version-Release number of selected component (if applicable):
muelli@bigbox /tmp $ yum info poppler evince
Loaded plugins: priorities, refresh-packagekit
115 packages excluded due to repository priority protections
Installed Packages
Name       : evince
Arch       : x86_64
Version    : 2.24.2
Release    : 1.fc10
Size       : 3.6 M
Repo       : installed
Summary    : Document viewer
URL        : http://www.gnome.org/projects/evince/
License    : GPLv2+ and GFDL
Description: evince is a GNOME-based document viewer.

Name       : poppler
Arch       : x86_64
Version    : 0.8.7
Release    : 5.fc10
Size       : 13 M
Repo       : installed
Summary    : PDF rendering library
URL        : http://poppler.freedesktop.org/
License    : GPLv2 and Redistributable, no modification permitted
Description: Poppler, a PDF rendering library, is a fork of the xpdf PDF
           : viewer developed by Derek Noonburg of Glyph and Cog, LLC.

Available Packages
Name       : evince
Arch       : i386
Version    : 2.24.2
Release    : 1.fc10
Size       : 1.2 M
Repo       : updates
Summary    : Document viewer
URL        : http://www.gnome.org/projects/evince/
License    : GPLv2+ and GFDL
Description: evince is a GNOME-based document viewer.

Name       : poppler
Arch       : i386
Version    : 0.8.7
Release    : 5.fc10
Size       : 4.5 M
Repo       : updates
Summary    : PDF rendering library
URL        : http://poppler.freedesktop.org/
License    : GPLv2 and Redistributable, no modification permitted
Description: Poppler, a PDF rendering library, is a fork of the xpdf PDF
           : viewer developed by Derek Noonburg of Glyph and Cog, LLC.

muelli@bigbox /tmp $ 


How reproducible:
Open attached PDF file with evince

Steps to Reproduce:
1. Open attached PDF file
2.
3.
  
Actual results:
Crash:
(gdb) r /tmp/2009-41414141.pdf 
The program being debugged has been started already.
Start it from the beginning? (y or n) y

Starting program: /usr/bin/evince /tmp/2009-41414141.pdf
[Thread debugging using libthread_db enabled]
[New Thread 0x7ffff7fc07e0 (LWP 13978)]
[New Thread 0x7ffff1eeb950 (LWP 14177)]
[New Thread 0x7ffff0f0a950 (LWP 14441)]
Error (2845): 318767093 extraneous bytes after segment
Error (2845): 318767093 extraneous bytes after segment

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff1eeb950 (LWP 14177)]
0x00007fffed8c9c70 in ?? ()
(gdb) bt
#0  0x00007fffed8c9c70 in ?? ()
#1  0x00000038b1eda719 in ~JBIG2SymbolDict (this=0x7ffff100d7d0)
    at JBIG2Stream.cc:1032
#2  0x00000038b1edaaa3 in JBIG2Stream::close (this=0x7ffff1012730)
    at JBIG2Stream.cc:1203
#3  0x00000038b1edab5c in ~JBIG2Stream (this=0x3fb476e230)
    at JBIG2Stream.cc:1142
#4  0x00000038b1ef413f in Object::free (this=0x7ffff1eeaa30) at Object.cc:129
#5  0x00000038b1eb9226 in Gfx::opXObject (this=0x7ffff1011ca0, 
    args=<value optimized out>, numArgs=<value optimized out>) at Gfx.cc:3509
#6  0x00000038b1eabbdc in Gfx::go (this=0x7ffff1011ca0, topLevel=1)
    at Gfx.cc:611
#7  0x00000038b1eb22c6 in Gfx::display (this=0x7ffff1011ca0, 
    obj=0x7ffff1eeade0, topLevel=1) at Gfx.cc:580
#8  0x00000038b1ef7da0 in Page::displaySlice (this=0xa1cac0, out=0xa1ee50, 
    hDPI=11.726384364820847, vDPI=11.726384364820847, 
    rotate=<value optimized out>, useMediaBox=<value optimized out>, crop=1, 
    sliceX=0, sliceY=0, sliceW=100, sliceH=128, printing=0, catalog=0x9fd610, 
    abortCheckCbk=0, abortCheckCbkData=0x0, annotDisplayDecideCbk=0, 
    annotDisplayDecideCbkData=0x0) at Page.cc:415
#9  0x0000003ebca15be5 in _poppler_page_render_to_pixbuf (page=0x9a1e30, 
    src_x=0, src_y=0, src_width=100, src_height=128, 
    scale=-nan(0xfffffffffffff), rotation=0, printing=0, pixbuf=0x9a1e80)
---Type <return> to continue, or q <return> to quit---
    at poppler-page.cc:751
#10 0x0000003ebca16797 in poppler_page_render_to_pixbuf (page=0x9a1e30, 
    src_x=0, src_y=0, src_width=100, src_height=128, 
    scale=0.16286644951140064, rotation=0, pixbuf=0x9a1e80)
    at poppler-page.cc:790
#11 0x00007ffff12ceb3e in make_thumbnail_for_page () at ev-poppler.cc:1262
#12 pdf_document_thumbnails_get_thumbnail (
    document_thumbnails=<value optimized out>, rc=0xa14600, border=1)
    at ev-poppler.cc:1312
#13 0x00000000004205f4 in ev_job_thumbnail_run (job=0x9940c0) at ev-jobs.c:665
#14 0x000000000041e130 in ev_job_thread () at ev-job-scheduler.c:183
#15 ev_job_thread_proxy (data=<value optimized out>) at ev-job-scheduler.c:213
#16 0x0000003fb5c60d44 in g_thread_create_proxy (data=0x9def80)
    at gthread.c:635
#17 0x0000003fb50073da in start_thread (arg=<value optimized out>)
    at pthread_create.c:297
#18 0x0000003fb44e62bd in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
(gdb) 
(gdb) t a a bt full

Thread 3 (Thread 0x7ffff0f0a950 (LWP 14441)):
#0  pthread_cond_timedwait@@GLIBC_2.3.2 ()
    at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:217
No locals.
#1  0x0000003fb84023f5 in g_cond_timed_wait_posix_impl (cond=0xb42934, 
    entered_mutex=0x0, abs_time=<value optimized out>) at gthread-posix.c:242
	result = <value optimized out>
	end_time = {tv_sec = 1236196444, tv_nsec = 739986000}
	timed_out = <value optimized out>
	__PRETTY_FUNCTION__ = "g_cond_timed_wait_posix_impl"
#2  0x0000003fb5c142bb in g_async_queue_pop_intern_unlocked (queue=0x9c2f60, 
    try=0, end_time=0x7ffff0f09fb0) at gasyncqueue.c:365
	retval = <value optimized out>
	__PRETTY_FUNCTION__ = "g_async_queue_pop_intern_unlocked"
#3  0x0000003fb5c143b5 in IA__g_async_queue_timed_pop (queue=0x9c2f60, 
    end_time=0x7ffff0f09fb0) at gasyncqueue.c:491
	retval = <value optimized out>
	__PRETTY_FUNCTION__ = "IA__g_async_queue_timed_pop"
#4  0x0000003fb5c62235 in g_thread_pool_wait_for_new_pool ()
    at gthreadpool.c:121
No locals.
#5  g_thread_pool_thread_proxy (data=<value optimized out>)
---Type <return> to continue, or q <return> to quit---
    at gthreadpool.c:324
	task = <value optimized out>
	pool = (GRealThreadPool *) 0x0
#6  0x0000003fb5c60d44 in g_thread_create_proxy (data=0xb44e40)
    at gthread.c:635
	__PRETTY_FUNCTION__ = "g_thread_create_proxy"
#7  0x0000003fb50073da in start_thread (arg=<value optimized out>)
    at pthread_create.c:297
	__res = <value optimized out>
	pd = (struct pthread *) 0x7ffff0f0a950
	unwind_buf = {cancel_jmp_buf = {{jmp_buf = {0, 8066784022139370665, 
        10489856, 140737235691856, 273588289536, 140737488345200, 
        -8066764190422270807, 8038242902942153897}, mask_was_saved = 0}}, 
  priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, 
      canceltype = 0}}}
	not_first_call = <value optimized out>
	robust = <value optimized out>
#8  0x0000003fb44e62bd in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
No locals.

Thread 2 (Thread 0x7ffff1eeb950 (LWP 14177)):
#0  0x00007fffed8c9c70 in ?? ()
---Type <return> to continue, or q <return> to quit---
No symbol table info available.
#1  0x00000038b1eda719 in ~JBIG2SymbolDict (this=0x7ffff100d7d0)
    at JBIG2Stream.cc:1032
No locals.
#2  0x00000038b1edaaa3 in JBIG2Stream::close (this=0x7ffff1012730)
    at JBIG2Stream.cc:1203
	_i = 0
#3  0x00000038b1edab5c in ~JBIG2Stream (this=0x3fb476e230)
    at JBIG2Stream.cc:1142
No locals.
#4  0x00000038b1ef413f in Object::free (this=0x7ffff1eeaa30) at Object.cc:129
No locals.
#5  0x00000038b1eb9226 in Gfx::opXObject (this=0x7ffff1011ca0, 
    args=<value optimized out>, numArgs=<value optimized out>) at Gfx.cc:3509
	name = 0x7fffed72b8e0 "I0"
	obj1 = {type = objStream, {booln = -251582672, intg = -251582672, 
    real = 6.9533433779994719e-310, string = 0x7ffff1012730, 
    name = 0x7ffff1012730 "\2209\033�8", array = 0x7ffff1012730, 
    dict = 0x7ffff1012730, stream = 0x7ffff1012730, ref = {num = -251582672, 
      gen = 32767}, cmd = 0x7ffff1012730 "\2209\033�8"}}
	obj2 = {type = objNone, {booln = -251296032, intg = -251296032, 
    real = 6.9533433921613696e-310, string = 0x7ffff10586e0, 
    name = 0x7ffff10586e0 "@\204\005��\177", array = 0x7ffff10586e0, 
---Type <return> to continue, or q <return> to quit---
    dict = 0x7ffff10586e0, stream = 0x7ffff10586e0, ref = {num = -251296032, 
      gen = 32767}, cmd = 0x7ffff10586e0 "@\204\005��\177"}}
	obj3 = {type = objNone, {booln = 0, intg = 0, real = 0, string = 0x0, 
    name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, 
      gen = 0}, cmd = 0x0}}
	refObj = {type = objNone, {booln = 48, intg = 48, 
    real = 2.3715151000379834e-322, string = 0x30, 
    name = 0x30 <Address 0x30 out of bounds>, array = 0x30, dict = 0x30, 
    stream = 0x30, ref = {num = 48, gen = 0}, 
    cmd = 0x30 <Address 0x30 out of bounds>}}
	opiDict = {type = objNone, {booln = 0, intg = 0, real = 0, 
    string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {
      num = 0, gen = 0}, cmd = 0x0}}
#6  0x00000038b1eabbdc in Gfx::go (this=0x7ffff1011ca0, topLevel=1)
    at Gfx.cc:611
	timer = {start_time = {tv_sec = 1236196434, tv_usec = 179520}, 
  end_time = {tv_sec = 4562254508917369341, tv_usec = 140737236907936}, 
  active = 1}
	obj = {type = objCmd, {booln = -311247792, intg = -311247792, 
    real = 6.9533404301508672e-310, string = 0x7fffed72bc50, 
    name = 0x7fffed72bc50 "Do", array = 0x7fffed72bc50, dict = 0x7fffed72bc50, 
    stream = 0x7fffed72bc50, ref = {num = -311247792, gen = 32767}, 
    cmd = 0x7fffed72bc50 "Do"}}
---Type <return> to continue, or q <return> to quit---
	args = {{type = objName, {booln = -311248672, intg = -311248672, 
      real = 6.9533404301073894e-310, string = 0x7fffed72b8e0, 
      name = 0x7fffed72b8e0 "I0", array = 0x7fffed72b8e0, 
      dict = 0x7fffed72b8e0, stream = 0x7fffed72b8e0, ref = {num = -311248672, 
        gen = 32767}, cmd = 0x7fffed72b8e0 "I0"}}, {type = objNone, {
      booln = 0, intg = 0, real = 0, string = 0x0, name = 0x0, array = 0x0, 
      dict = 0x0, stream = 0x0, ref = {num = 0, gen = 0}, cmd = 0x0}}, {
    type = objNone, {booln = 0, intg = 0, real = 0, string = 0x0, name = 0x0, 
      array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = 0}, 
      cmd = 0x0}}, {type = objNone, {booln = 3300, intg = 3300, 
      real = 1.6304166312761136e-320, string = 0xce4, 
      name = 0xce4 <Address 0xce4 out of bounds>, array = 0xce4, dict = 0xce4, 
      stream = 0xce4, ref = {num = 3300, gen = 0}, 
      cmd = 0xce4 <Address 0xce4 out of bounds>}}, {type = objNone, {
      booln = 0, intg = 0, real = 0, string = 0x0, name = 0x0, array = 0x0, 
      dict = 0x0, stream = 0x0, ref = {num = 0, gen = 0}, cmd = 0x0}}, {
    type = objNone, {booln = 0, intg = 0, real = 0, string = 0x0, name = 0x0, 
      array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = 0}, 
      cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, real = 0, 
      string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {
        num = 0, gen = 0}, cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, 
      real = 0, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, 
      stream = 0x0, ref = {num = 0, gen = 0}, cmd = 0x0}}, {type = objNone, {
---Type <return> to continue, or q <return> to quit---
      booln = 0, intg = 0, real = 0, string = 0x0, name = 0x0, array = 0x0, 
      dict = 0x0, stream = 0x0, ref = {num = 0, gen = 0}, cmd = 0x0}}, {
    type = objNone, {booln = 0, intg = 0, real = 0, string = 0x0, name = 0x0, 
      array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = 0}, 
      cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, real = 0, 
      string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {
        num = 0, gen = 0}, cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, 
      real = 0, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, 
      stream = 0x0, ref = {num = 0, gen = 0}, cmd = 0x0}}, {type = objNone, {
      booln = 0, intg = 0, real = 0, string = 0x0, name = 0x0, array = 0x0, 
      dict = 0x0, stream = 0x0, ref = {num = 0, gen = 0}, cmd = 0x0}}, {
    type = objNone, {booln = 0, intg = 0, real = 0, string = 0x0, name = 0x0, 
      array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = 0}, 
      cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, real = 0, 
      string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {
        num = 0, gen = 0}, cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, 
      real = 0, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, 
      stream = 0x0, ref = {num = 0, gen = 0}, cmd = 0x0}}, {type = objNone, {
      booln = 0, intg = 0, real = 0, string = 0x0, name = 0x0, array = 0x0, 
      dict = 0x0, stream = 0x0, ref = {num = 0, gen = 0}, cmd = 0x0}}, {
    type = objNone, {booln = 0, intg = 0, real = 0, string = 0x0, name = 0x0, 
      array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = 0}, 
      cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, real = 0, 
---Type <return> to continue, or q <return> to quit---
      string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {
        num = 0, gen = 0}, cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, 
      real = 0, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, 
      stream = 0x0, ref = {num = 0, gen = 0}, cmd = 0x0}}, {type = objNone, {
      booln = 0, intg = 0, real = 0, string = 0x0, name = 0x0, array = 0x0, 
      dict = 0x0, stream = 0x0, ref = {num = 0, gen = 0}, cmd = 0x0}}, {
    type = objNone, {booln = 0, intg = 0, real = 0, string = 0x0, name = 0x0, 
      array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = 0}, 
      cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, real = 0, 
      string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {
        num = 0, gen = 0}, cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, 
      real = 0, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, 
      stream = 0x0, ref = {num = 0, gen = 0}, cmd = 0x0}}, {type = objNone, {
      booln = 0, intg = 0, real = 0, string = 0x0, name = 0x0, array = 0x0, 
      dict = 0x0, stream = 0x0, ref = {num = 0, gen = 0}, cmd = 0x0}}, {
    type = objNone, {booln = 0, intg = 0, real = 0, string = 0x0, name = 0x0, 
      array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = 0}, 
      cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, real = 0, 
      string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {
        num = 0, gen = 0}, cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, 
      real = 0, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, 
      stream = 0x0, ref = {num = 0, gen = 0}, cmd = 0x0}}, {type = objNone, {
      booln = 0, intg = 0, real = 0, string = 0x0, name = 0x0, array = 0x0, 
---Type <return> to continue, or q <return> to quit---
      dict = 0x0, stream = 0x0, ref = {num = 0, gen = 0}, cmd = 0x0}}, {
    type = objNone, {booln = 0, intg = 0, real = 0, string = 0x0, name = 0x0, 
      array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = 0}, 
      cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, real = 0, 
      string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {
        num = 0, gen = 0}, cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, 
      real = 0, string = 0x0, name = 0x0, array = 0x0, dict = 0x0, 
      stream = 0x0, ref = {num = 0, gen = 0}, cmd = 0x0}}, {type = objNone, {
      booln = 0, intg = 0, real = 0, string = 0x0, name = 0x0, array = 0x0, 
      dict = 0x0, stream = 0x0, ref = {num = 0, gen = 0}, cmd = 0x0}}}
	numArgs = 1
	i = 6
	lastAbortCheck = 0
#7  0x00000038b1eb22c6 in Gfx::display (this=0x7ffff1011ca0, 
    obj=0x7ffff1eeade0, topLevel=1) at Gfx.cc:580
	obj2 = {type = objNone, {booln = 0, intg = 0, real = 0, string = 0x0, 
    name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, 
      gen = 0}, cmd = 0x0}}
	i = <value optimized out>
#8  0x00000038b1ef7da0 in Page::displaySlice (this=0xa1cac0, out=0xa1ee50, 
    hDPI=11.726384364820847, vDPI=11.726384364820847, 
    rotate=<value optimized out>, useMediaBox=<value optimized out>, crop=1, 
    sliceX=0, sliceY=0, sliceW=100, sliceH=128, printing=0, catalog=0x9fd610, 
---Type <return> to continue, or q <return> to quit---
    abortCheckCbk=0, abortCheckCbkData=0x0, annotDisplayDecideCbk=0, 
    annotDisplayDecideCbkData=0x0) at Page.cc:415
	gfx = (Gfx *) 0x7ffff1011ca0
	obj = {type = objStream, {booln = -310431728, intg = -310431728, 
    real = 6.9533404704697859e-310, string = 0x7fffed7f3010, 
    name = 0x7fffed7f3010 "�J\033�8", array = 0x7fffed7f3010, 
    dict = 0x7fffed7f3010, stream = 0x7fffed7f3010, ref = {num = -310431728, 
      gen = 32767}, cmd = 0x7fffed7f3010 "�J\033�8"}}
	annotList = <value optimized out>
	i = <value optimized out>
#9  0x0000003ebca15be5 in _poppler_page_render_to_pixbuf (page=0x9a1e30, 
    src_x=0, src_y=0, src_width=100, src_height=128, 
    scale=-nan(0xfffffffffffff), rotation=0, printing=0, pixbuf=0x9a1e80)
    at poppler-page.cc:751
	data = {cairo_data = 0x7ffff10233b0 '�' <repeats 200 times>..., 
  surface = 0x7fffed9135d0, cairo = 0x7ffff10118b0}
#10 0x0000003ebca16797 in poppler_page_render_to_pixbuf (page=0x9a1e30, 
    src_x=0, src_y=0, src_width=100, src_height=128, 
    scale=0.16286644951140064, rotation=0, pixbuf=0x9a1e80)
    at poppler-page.cc:790
	__PRETTY_FUNCTION__ = "void poppler_page_render_to_pixbuf(PopplerPage*, int, int, int, int, double, int, GdkPixbuf*)"
#11 0x00007ffff12ceb3e in make_thumbnail_for_page () at ev-poppler.cc:1262
---Type <return> to continue, or q <return> to quit---
	width = 100
	height = 128
#12 pdf_document_thumbnails_get_thumbnail (
    document_thumbnails=<value optimized out>, rc=0xa14600, border=1)
    at ev-poppler.cc:1312
	pixbuf = (GdkPixbuf *) 0x9a1e80
	border_pixbuf = <value optimized out>
#13 0x00000000004205f4 in ev_job_thumbnail_run (job=0x9940c0) at ev-jobs.c:665
	rc = (EvRenderContext *) 0xa14600
	page = (EvPage *) 0xa14590
#14 0x000000000041e130 in ev_job_thread () at ev-job-scheduler.c:183
No locals.
#15 ev_job_thread_proxy (data=<value optimized out>) at ev-job-scheduler.c:213
	job = (EvSchedulerJob *) 0x7fffed7192a0
#16 0x0000003fb5c60d44 in g_thread_create_proxy (data=0x9def80)
    at gthread.c:635
	__PRETTY_FUNCTION__ = "g_thread_create_proxy"
#17 0x0000003fb50073da in start_thread (arg=<value optimized out>)
    at pthread_create.c:297
	__res = <value optimized out>
	pd = (struct pthread *) 0x7ffff1eeb950
	unwind_buf = {cancel_jmp_buf = {{jmp_buf = {0, 8066784022139370665, 
        10489856, 140737252342096, 273588289536, 140737488346608, 
---Type <return> to continue, or q <return> to quit---
        -8066762179840705367, 8038242902942153897}, mask_was_saved = 0}}, 
  priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, 
      canceltype = 0}}}
	not_first_call = <value optimized out>
	robust = <value optimized out>
#18 0x0000003fb44e62bd in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
No locals.
Current language:  auto; currently asm

Thread 1 (Thread 0x7ffff7fc07e0 (LWP 13978)):
#0  0x0000003fb44dc886 in __poll (fds=0x6a6da0, nfds=10, timeout=452)
    at ../sysdeps/unix/sysv/linux/poll.c:87
	oldtype = 0
	result = <value optimized out>
#1  0x0000003fb5c3ae08 in g_main_context_poll () at gmain.c:3091
No locals.
#2  g_main_context_iterate (context=0x6a93c0, block=1, dispatch=1, 
    self=<value optimized out>) at gmain.c:2773
	max_priority = 2147483647
	timeout = 452
	some_ready = <value optimized out>
	nfds = 10
	allocated_nfds = <value optimized out>
---Type <return> to continue, or q <return> to quit---
	fds = (GPollFD *) 0x6a6da0
	__PRETTY_FUNCTION__ = "g_main_context_iterate"
#3  0x0000003fb5c3b49d in IA__g_main_loop_run (loop=0x680bc0) at gmain.c:2986
	self = (GThread *) 0x67b4f0
	__PRETTY_FUNCTION__ = "IA__g_main_loop_run"
#4  0x0000003ebbd238a7 in IA__gtk_main () at gtkmain.c:1200
	tmp_list = (GList *) 0x6efa88
	functions = (GList *) 0x0
	init = (GtkInitFunction *) 0x6fa920
	loop = <value optimized out>
#5  0x000000000044bd27 in main (argc=1, argv=0x7fffffffe198) at main.c:381
	context = <value optimized out>
	args = (GHashTable *) 0x6ef440
	enable_metadata = 1
	error = (GError *) 0x0
#0  0x00007fffed8c9c70 in ?? ()
Current language:  auto; currently c
(gdb) 



Expected results:
I expected evince to not crash.
I also expect that a patch for this is backported to F10

Additional info:
See https://bugs.freedesktop.org/show_bug.cgi?id=19702
Comment 2 Bug Zapper 2009-11-18 11:16:40 UTC 
This message is a reminder that Fedora 10 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 10.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '10'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 10's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 10 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping
Comment 3 Bug Zapper 2009-12-18 08:56:58 UTC 
Fedora 10 changed to end-of-life (EOL) status on 2009-12-17. Fedora 10 is 
no longer maintained, which means that it will not receive any further 
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of 
Fedora please feel free to reopen this bug against that version.

Thank you for reporting this bug and we are sorry it could not be fixed.