#1073010 Crash on every beamer pdf re-compilation

Package:
evince
Source:
evince
Description:
Document (PostScript, PDF) viewer
Submitter:
Date:
2024-06-25 13:24:04 UTC
Severity:
normal
#1073010#5
Date:
2024-06-11 19:04:30 UTC
From:
To:
Since a few days I noticed (but the problem could be weeks old before I
noticed), evince crashes when it displays a pdf that is being re-
compiled from latex.

It is a beamer in presentation view, in case it matters - but obviously
reproducing the issue would be more efficient.

Setting severity to important because a crash does impact the
usefulness of the software, even though it doesn't make it completely
useless.

Cheers,

J.Puydt

PS: I ran evince in gdb and tried to reproduce the crash ; here is what
the end of the log looks like:

[New Thread 0x7f1b492006c0 (LWP 830981)]

(evince:830951): GLib-GObject-CRITICAL **: 20:55:33.417: instance of
invalid non-instantiatable type 'GEnum'

(evince:830951): GLib-GObject-CRITICAL **: 20:55:33.417:
g_signal_handlers_disconnect_matched: assertion 'G_TYPE_CHECK_INSTANCE
(instance)' failed

(evince:830951): GLib-GObject-CRITICAL **: 20:55:33.417:
g_object_unref: assertion 'G_IS_OBJECT (object)' failed

(evince:830951): GLib-GObject-CRITICAL **: 20:55:33.417: instance of
invalid non-instantiatable type '(null)'

(evince:830951): GLib-GObject-CRITICAL **: 20:55:33.417:
g_signal_handlers_disconnect_matched: assertion 'G_TYPE_CHECK_INSTANCE
(instance)' failed

(evince:830951): GLib-GObject-CRITICAL **: 20:55:33.417:
g_object_unref: assertion 'G_IS_OBJECT (object)' failed

(evince:830951): GLib-GObject-CRITICAL **: 20:55:33.417: instance of
invalid non-instantiatable type '<invalid>'

(evince:830951): GLib-GObject-CRITICAL **: 20:55:33.417:
g_signal_handlers_disconnect_matched: assertion 'G_TYPE_CHECK_INSTANCE
(instance)' failed

(evince:830951): GLib-GObject-CRITICAL **: 20:55:33.417:
g_object_unref: assertion 'G_IS_OBJECT (object)' failed
[Thread 0x7f1b420006c0 (LWP 830967) exited]
[Thread 0x7f1b492006c0 (LWP 830981) exited]
[New Thread 0x7f1b492006c0 (LWP 830988)]
[New Thread 0x7f1b420006c0 (LWP 830989)]

Thread 1 "evince" received signal SIGSEGV, Segmentation fault.
0x00007f1b581d2205 in g_type_check_instance () from /lib/x86_64-linux-
gnu/libgobject-2.0.so.0
(gdb) bt
#0  0x00007f1b581d2205 in g_type_check_instance () at /lib/x86_64-
linux-gnu/libgobject-2.0.so.0
#1  0x00007f1b581c7788 in g_signal_handlers_disconnect_matched () at
/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#2  0x00007f1b5829e0f5 in  () at /lib/x86_64-linux-gnu/libevview3.so.3
#3  0x00007f1b5829e200 in  () at /lib/x86_64-linux-gnu/libevview3.so.3
#4  0x00007f1b581b204b in g_object_unref () at /lib/x86_64-linux-
gnu/libgobject-2.0.so.0
#5  0x000055cee218ba7f in  ()
#6  0x00007f1b581ac730 in g_closure_invoke () at /lib/x86_64-linux-
gnu/libgobject-2.0.so.0
#7  0x00007f1b581c087c in  () at /lib/x86_64-linux-gnu/libgobject-
2.0.so.0
#8  0x00007f1b581c2281 in  () at /lib/x86_64-linux-gnu/libgobject-
2.0.so.0
#9  0x00007f1b581c7f06 in g_signal_emit_valist () at /lib/x86_64-linux-
gnu/libgobject-2.0.so.0
#10 0x00007f1b581c7fc3 in g_signal_emit () at /lib/x86_64-linux-
gnu/libgobject-2.0.so.0
#11 0x00007f1b581b0924 in  () at /lib/x86_64-linux-gnu/libgobject-
2.0.so.0
#12 0x00007f1b581b43b9 in g_object_notify () at /lib/x86_64-linux-
gnu/libgobject-2.0.so.0
#13 0x000055cee2184231 in  ()
#14 0x00007f1b581ac730 in g_closure_invoke () at /lib/x86_64-linux-
gnu/libgobject-2.0.so.0
#15 0x00007f1b581c087c in  () at /lib/x86_64-linux-gnu/libgobject-
2.0.so.0
#16 0x00007f1b581c2281 in  () at /lib/x86_64-linux-gnu/libgobject-
2.0.so.0
#17 0x00007f1b581c7f06 in g_signal_emit_valist () at /lib/x86_64-linux-
gnu/libgobject-2.0.so.0
#18 0x00007f1b581c7fc3 in g_signal_emit () at /lib/x86_64-linux-
gnu/libgobject-2.0.so.0
#19 0x00007f1b582772db in  () at /lib/x86_64-linux-gnu/libevview3.so.3
#20 0x00007f1b580a3dff in  () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#21 0x00007f1b580a5e87 in  () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#22 0x00007f1b580a64a0 in g_main_context_iteration () at /lib/x86_64-
linux-gnu/libglib-2.0.so.0
#23 0x00007f1b5741a43d in g_application_run () at /lib/x86_64-linux-
gnu/libgio-2.0.so.0
#24 0x000055cee2173063 in main ()

#1073010#10
Date:
2024-06-12 08:09:08 UTC
From:
To:
Hi,

I made a few more tests and found out it only happened in fullscreen
mode: no problem in window mode.

Cheers,

J.Puydt

#1073010#15
Date:
2024-06-25 13:22:05 UTC
From:
To:

Hello,
I am not maintainer of evince, just trying to collect some more information about the crash.

I was able to reproduce a crash by following steps inside a minimal test VM:


     man -Tpdf man >man.pdf
     man -Tpdf xterm >xterm.pdf

     export DISPLAY=:0
     export LANG=C

     cat man.pdf > test.pdf

     evince test.pdf
     "Present as slideshow"

     cat xterm.pdf > test.pdf


The backtrace with debug symbols looks like this:

(gdb) bt
#0  g_type_check_instance (type_instance=type_instance@entry=0x561f3f347eb0) at ../../../gobject/gtype.c:4259
#1  0x00007ff235e3b788 in g_signal_handlers_disconnect_matched (instance=instance@entry=0x561f3f347eb0, mask=mask@entry=(G_SIGNAL_MATCH_FUNC | G_SIGNAL_MATCH_DATA), signal_id=signal_id@entry=0, detail=detail@entry=0, closure=closure@entry=0x0, func=func@entry=0x7ff235f11af0 <job_finished_cb>, data=0x561f3f3a6560) at ../../../gobject/gsignal.c:2993
#2  0x00007ff235f120f5 in ev_view_presentation_delete_job (job=0x561f3f347eb0, pview=0x561f3f3a6560) at ../libview/ev-view-presentation.c:405
#3  ev_view_presentation_delete_job (job=0x561f3f347eb0, pview=0x561f3f3a6560) at ../libview/ev-view-presentation.c:399
#4  ev_view_presentation_reset_jobs (pview=pview@entry=0x561f3f3a6560) at ../libview/ev-view-presentation.c:413
#5  0x00007ff235f12200 in ev_view_presentation_dispose (object=0x561f3f3a6560) at ../libview/ev-view-presentation.c:972
#6  0x00007ff235e2604b in g_object_unref (_object=0x561f3f3a6560) at ../../../gobject/gobject.c:4413
#7  0x0000561f3e497a7f in ev_window_set_document (document=0x7ff204408620, ev_window=0x561f3eee8070) at ../shell/ev-window.c:1771
#8  ev_window_document_changed_cb (model=<optimized out>, pspec=<optimized out>, ev_window=0x561f3eee8070) at ../shell/ev-window.c:5251
#9  0x00007ff235e20730 in g_closure_invoke (closure=0x561f3f07f5b0, return_value=0x0, n_param_values=2, param_values=0x7ffd9b668b70, invocation_hint=0x7ffd9b668ac0) at ../../../gobject/gclosure.c:834
#10 0x00007ff235e3487c in signal_emit_unlocked_R (node=node@entry=0x7ffd9b668c40, detail=detail@entry=1305, instance=instance@entry=0x561f3ed617f0, emission_return=emission_return@entry=0x0, instance_and_params=instance_and_params@entry=0x7ffd9b668b70) at ../../../gobject/gsignal.c:3888
#11 0x00007ff235e36281 in signal_emit_valist_unlocked (instance=instance@entry=0x561f3ed617f0, signal_id=signal_id@entry=1, detail=detail@entry=1305, var_args=var_args@entry=0x7ffd9b668da0) at ../../../gobject/gsignal.c:3520
#12 0x00007ff235e3bf06 in g_signal_emit_valist (instance=0x561f3ed617f0, signal_id=1, detail=1305, var_args=0x7ffd9b668da0) at ../../../gobject/gsignal.c:3263
#13 0x00007ff235e3bfc3 in g_signal_emit (instance=instance@entry=0x561f3ed617f0, signal_id=<optimized out>, detail=<optimized out>) at ../../../gobject/gsignal.c:3583
#14 0x00007ff235e24924 in g_object_dispatch_properties_changed (object=0x561f3ed617f0, n_pspecs=<optimized out>, pspecs=<optimized out>) at ../../../gobject/gobject.c:1819
#15 0x00007ff235e283b9 in g_object_notify_by_spec_internal (pspec=<optimized out>, object=0x561f3ed617f0) at ../../../gobject/gobject.c:1924
#16 g_object_notify (object=0x561f3ed617f0, property_name=property_name@entry=0x7ff235f1553a "document") at ../../../gobject/gobject.c:1974
#17 0x00007ff235ee84a2 in ev_document_model_set_document (model=<optimized out>, document=<optimized out>) at ../libview/ev-document-model.c:384
#18 0x0000561f3e490231 in ev_window_reload_job_cb (job=0x561f3efcfef0, ev_window=0x561f3eee8070) at ../shell/ev-window.c:2018
#19 0x00007ff235e20730 in g_closure_invoke (closure=0x561f3f3cbf40, return_value=0x0, n_param_values=1, param_values=0x7ffd9b6690d0, invocation_hint=0x7ffd9b669020) at ../../../gobject/gclosure.c:834
#20 0x00007ff235e3487c in signal_emit_unlocked_R (node=node@entry=0x7ffd9b669180, detail=detail@entry=0, instance=instance@entry=0x561f3efcfef0, emission_return=emission_return@entry=0x0, instance_and_params=instance_and_params@entry=0x7ffd9b6690d0) at ../../../gobject/gsignal.c:3888
#21 0x00007ff235e36281 in signal_emit_valist_unlocked (instance=instance@entry=0x561f3efcfef0, signal_id=signal_id@entry=395, detail=detail@entry=0, var_args=var_args@entry=0x7ffd9b6692e0) at ../../../gobject/gsignal.c:3520
#22 0x00007ff235e3bf06 in g_signal_emit_valist (instance=0x561f3efcfef0, signal_id=395, detail=0, var_args=0x7ffd9b6692e0) at ../../../gobject/gsignal.c:3263
#23 0x00007ff235e3bfc3 in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=detail@entry=0) at ../../../gobject/gsignal.c:3583
#24 0x00007ff235eeb2db in emit_finished (job=<optimized out>) at ../libview/ev-jobs.c:178
#25 emit_finished (job=<optimized out>) at ../libview/ev-jobs.c:168
#26 0x00007ff235d17e3f in g_main_dispatch (context=context@entry=0x561f3ecef130) at ../../../glib/gmain.c:3344
#27 0x00007ff235d19ec7 in g_main_context_dispatch_unlocked (context=0x561f3ecef130) at ../../../glib/gmain.c:4152
#28 g_main_context_iterate_unlocked (context=context@entry=0x561f3ecef130, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../../../glib/gmain.c:4217
#29 0x00007ff235d1a4e0 in g_main_context_iteration (context=context@entry=0x561f3ecef130, may_block=may_block@entry=1) at ../../../glib/gmain.c:4282
#30 0x00007ff23508548d in g_application_run (application=application@entry=0x561f3edc9560, argc=argc@entry=0, argv=argv@entry=0x0) at ../../../gio/gapplication.c:2712
#31 0x0000561f3e47f063 in main (argc=<optimized out>, argv=<optimized out>) at ../shell/main.c:318


Attached file contains more output and
a valgrind run, which points to a use-after-free.


There exists an upstream report which might be related,
at least has a few equal last frames.
That one needs not replacing the pdf,
just rotating in "Present as slideshow" mode e.g. by Ctrl+cursor left/right.


https://gitlab.gnome.org/GNOME/evince/-/issues/2004


Kind regards,
Bernhard