Bug 255704 - okular causes system crash when zooming out in a PDF
Summary: okular causes system crash when zooming out in a PDF
Status: RESOLVED FIXED
Alias: None
Product: okular
Classification: Applications
Component: PDF backend (show other bugs)
Version: 0.11.2
Platform: Fedora RPMs Linux
: NOR major
Target Milestone: ---
Assignee: Okular developers
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-10-30 23:34 UTC by Valentin Villenave
Modified: 2014-05-08 14:31 UTC (History)
3 users (show)

See Also:
Latest Commit:
Version Fixed In:


Attachments
PDF file (233.13 KB, application/pdf)
2010-10-30 23:34 UTC, Valentin Villenave
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Valentin Villenave 2010-10-30 23:34:44 UTC
Created attachment 53003 [details]
PDF file

Version:           0.11.2 (using KDE 4.5.2) 
OS:                Linux

Greetings,
I'm using 0.11.2 on Fedora 14 x86_64.  Sorry if this has been reported before, but I couldn't find anything like it (252559 and 251564 are similar, but not quite as annoying).

Reproducible: Always

Steps to Reproduce:
Open a single PDF document (system has just been rebooted and is perfectly stable, no other application is running except for the KDE environment).  Zoom in, pan, all goes smoothly.  Now zoom out (using the mouse wheel)...

Actual Results:  
... and the system immediately becomes unresponsive.  No tty switch, no Sysctrl combo, no disk activity, nothing.  Hard reboot is the only option.

Expected Results:  
Well, it *shouldn't* make everything crash! :-)

Thanks for having a look, feel free to ask for more details!

- Launching okular with
   --graphicssystem raster
solves the problem (opengl doesn't work, I'm using the free ati driver anyway).

- The only PDF documents I tried are music scores generated with GNU LilyPond.  As such, they include a *lot* of internal links.  (Which has never been a problem in the past, with okular not with any PDF viewing application, poppler-based or not).

- Attached is an example of a music score that reproduces the result here.  I also tried to produce a valgrind log, but it isn't of much help since it stopped writing anything as soon as the system crashed...  Here goes:

==1932== Memcheck, a memory error detector
==1932== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==1932== Using Valgrind-3.5.0 and LibVEX; rerun with -h for copyright info
==1932== Command: okular opus_libre/out/ouverture.pdf
==1932== 
==1932== Conditional jump or move depends on uninitialised value(s)
==1932==    at 0x54109FB: __strcasecmp_l_ssse3 (in /lib64/libc-2.12.90.so)
==1932==    by 0x5302B79: bsearch (in /lib64/libc-2.12.90.so)
==1932==    by 0x52FE136: _nl_expand_alias (in /lib64/libc-2.12.90.so)
==1932==    by 0x52FC027: _nl_find_domain (in /lib64/libc-2.12.90.so)
==1932==    by 0x52FB78D: __dcigettext (in /lib64/libc-2.12.90.so)
==1932==    by 0x534FC37: strerror_r (in /lib64/libc-2.12.90.so)
==1932==    by 0x534FB3D: strerror (in /lib64/libc-2.12.90.so)
==1932==    by 0x5A963F4: dlerror (in /lib64/libdl-2.12.90.so)
==1932==    by 0x34B534B8AA: ??? (in /usr/lib64/libQtCore.so.4.7.0)
==1932==    by 0x34B534C1FE: ??? (in /usr/lib64/libQtCore.so.4.7.0)
==1932==    by 0x34BA02C602: ??? (in /usr/lib64/libQtGui.so.4.7.0)
==1932==    by 0x34B9FBB908: QApplicationPrivate::construct(_XDisplay*, unsigned long, unsigned long) (in /usr/lib64/libQtGui.so.4.7.0)
==1932== 
==1932== Use of uninitialised value of size 8
==1932==    at 0x5412A44: __strcasecmp_l_ssse3 (in /lib64/libc-2.12.90.so)
==1932==    by 0x5302B79: bsearch (in /lib64/libc-2.12.90.so)
==1932==    by 0x52FE136: _nl_expand_alias (in /lib64/libc-2.12.90.so)
==1932==    by 0x52FC027: _nl_find_domain (in /lib64/libc-2.12.90.so)
==1932==    by 0x52FB78D: __dcigettext (in /lib64/libc-2.12.90.so)
==1932==    by 0x534FC37: strerror_r (in /lib64/libc-2.12.90.so)
==1932==    by 0x534FB3D: strerror (in /lib64/libc-2.12.90.so)
==1932==    by 0x5A963F4: dlerror (in /lib64/libdl-2.12.90.so)
==1932==    by 0x34B534B8AA: ??? (in /usr/lib64/libQtCore.so.4.7.0)
==1932==    by 0x34B534C1FE: ??? (in /usr/lib64/libQtCore.so.4.7.0)
==1932==    by 0x34BA02C602: ??? (in /usr/lib64/libQtGui.so.4.7.0)
==1932==    by 0x34B9FBB908: QApplicationPrivate::construct(_XDisplay*, unsigned long, unsigned long) (in /usr/lib64/libQtGui.so.4.7.0)
==1932== 
==1932== Use of uninitialised value of size 8
==1932==    at 0x5412A48: __strcasecmp_l_ssse3 (in /lib64/libc-2.12.90.so)
==1932==    by 0x5302B79: bsearch (in /lib64/libc-2.12.90.so)
==1932==    by 0x52FE136: _nl_expand_alias (in /lib64/libc-2.12.90.so)
==1932==    by 0x52FC027: _nl_find_domain (in /lib64/libc-2.12.90.so)
==1932==    by 0x52FB78D: __dcigettext (in /lib64/libc-2.12.90.so)
==1932==    by 0x534FC37: strerror_r (in /lib64/libc-2.12.90.so)
==1932==    by 0x534FB3D: strerror (in /lib64/libc-2.12.90.so)
==1932==    by 0x5A963F4: dlerror (in /lib64/libdl-2.12.90.so)
==1932==    by 0x34B534B8AA: ??? (in /usr/lib64/libQtCore.so.4.7.0)
==1932==    by 0x34B534C1FE: ??? (in /usr/lib64/libQtCore.so.4.7.0)
==1932==    by 0x34BA02C602: ??? (in /usr/lib64/libQtGui.so.4.7.0)
==1932==    by 0x34B9FBB908: QApplicationPrivate::construct(_XDisplay*, unsigned long, unsigned long) (in /usr/lib64/libQtGui.so.4.7.0)
==1932== 
==1932== Conditional jump or move depends on uninitialised value(s)
==1932==    at 0x535389B: __GI___strcasecmp_l (in /lib64/libc-2.12.90.so)
==1932==    by 0x52ECEE1: __gconv_open (in /lib64/libc-2.12.90.so)
==1932==    by 0x52FB206: _nl_find_msg (in /lib64/libc-2.12.90.so)
==1932==    by 0x52FB947: __dcigettext (in /lib64/libc-2.12.90.so)
==1932==    by 0x534FC37: strerror_r (in /lib64/libc-2.12.90.so)
==1932==    by 0x534FB3D: strerror (in /lib64/libc-2.12.90.so)
==1932==    by 0x5A963F4: dlerror (in /lib64/libdl-2.12.90.so)
==1932==    by 0x34B534B8AA: ??? (in /usr/lib64/libQtCore.so.4.7.0)
==1932==    by 0x34B534C1FE: ??? (in /usr/lib64/libQtCore.so.4.7.0)
==1932==    by 0x34BA02C602: ??? (in /usr/lib64/libQtGui.so.4.7.0)
==1932==    by 0x34B9FBB908: QApplicationPrivate::construct(_XDisplay*, unsigned long, unsigned long) (in /usr/lib64/libQtGui.so.4.7.0)
==1932==    by 0x34B9FBC067: QApplication::QApplication(int&, char**, bool, int) (in /usr/lib64/libQtGui.so.4.7.0)
==1932== 
==1932== Use of uninitialised value of size 8
==1932==    at 0x53559D4: __GI___strcasecmp_l (in /lib64/libc-2.12.90.so)
==1932==    by 0x52ECEE1: __gconv_open (in /lib64/libc-2.12.90.so)
==1932==    by 0x52FB206: _nl_find_msg (in /lib64/libc-2.12.90.so)
==1932==    by 0x52FB947: __dcigettext (in /lib64/libc-2.12.90.so)
==1932==    by 0x534FC37: strerror_r (in /lib64/libc-2.12.90.so)
==1932==    by 0x534FB3D: strerror (in /lib64/libc-2.12.90.so)
==1932==    by 0x5A963F4: dlerror (in /lib64/libdl-2.12.90.so)
==1932==    by 0x34B534B8AA: ??? (in /usr/lib64/libQtCore.so.4.7.0)
==1932==    by 0x34B534C1FE: ??? (in /usr/lib64/libQtCore.so.4.7.0)
==1932==    by 0x34BA02C602: ??? (in /usr/lib64/libQtGui.so.4.7.0)
==1932==    by 0x34B9FBB908: QApplicationPrivate::construct(_XDisplay*, unsigned long, unsigned long) (in /usr/lib64/libQtGui.so.4.7.0)
==1932==    by 0x34B9FBC067: QApplication::QApplication(int&, char**, bool, int) (in /usr/lib64/libQtGui.so.4.7.0)
==1932== 
==1932== Use of uninitialised value of size 8
==1932==    at 0x53559D8: __GI___strcasecmp_l (in /lib64/libc-2.12.90.so)
==1932==    by 0x52ECEE1: __gconv_open (in /lib64/libc-2.12.90.so)
==1932==    by 0x52FB206: _nl_find_msg (in /lib64/libc-2.12.90.so)
==1932==    by 0x52FB947: __dcigettext (in /lib64/libc-2.12.90.so)
==1932==    by 0x534FC37: strerror_r (in /lib64/libc-2.12.90.so)
==1932==    by 0x534FB3D: strerror (in /lib64/libc-2.12.90.so)
==1932==    by 0x5A963F4: dlerror (in /lib64/libdl-2.12.90.so)
==1932==    by 0x34B534B8AA: ??? (in /usr/lib64/libQtCore.so.4.7.0)
==1932==    by 0x34B534C1FE: ??? (in /usr/lib64/libQtCore.so.4.7.0)
==1932==    by 0x34BA02C602: ??? (in /usr/lib64/libQtGui.so.4.7.0)
==1932==    by 0x34B9FBB908: QApplicationPrivate::construct(_XDisplay*, unsigned long, unsigned long) (in /usr/lib64/libQtGui.so.4.7.0)
==1932==    by 0x34B9FBC067: QApplication::QApplication(int&, char**, bool, int) (in /usr/lib64/libQtGui.so.4.7.0)
==1932== 
==1932== Conditional jump or move depends on uninitialised value(s)
==1932==    at 0x535389B: __GI___strcasecmp_l (in /lib64/libc-2.12.90.so)
==1932==    by 0x52ECEE1: __gconv_open (in /lib64/libc-2.12.90.so)
==1932==    by 0x52FB206: _nl_find_msg (in /lib64/libc-2.12.90.so)
==1932==    by 0x52FB7B3: __dcigettext (in /lib64/libc-2.12.90.so)
==1932==    by 0x34B7DB435A: ??? (in /usr/lib64/libkdecore.so.5.5.0)
==1932==    by 0x34B7DB4F8C: ??? (in /usr/lib64/libkdecore.so.5.5.0)
==1932==    by 0x34B7DD75F1: ??? (in /usr/lib64/libkdecore.so.5.5.0)
==1932==    by 0x34B7DD9E4D: ??? (in /usr/lib64/libkdecore.so.5.5.0)
==1932==    by 0x34B7DDE1B1: ??? (in /usr/lib64/libkdecore.so.5.5.0)
==1932==    by 0x34B7DDE220: ??? (in /usr/lib64/libkdecore.so.5.5.0)
==1932==    by 0x34B7DD6737: ??? (in /usr/lib64/libkdecore.so.5.5.0)
==1932==    by 0x34B7DCDE3A: ??? (in /usr/lib64/libkdecore.so.5.5.0)
==1932== 
==1932== Use of uninitialised value of size 8
==1932==    at 0x53559D4: __GI___strcasecmp_l (in /lib64/libc-2.12.90.so)
==1932==    by 0x52ECEE1: __gconv_open (in /lib64/libc-2.12.90.so)
==1932==    by 0x52FB206: _nl_find_msg (in /lib64/libc-2.12.90.so)
==1932==    by 0x52FB7B3: __dcigettext (in /lib64/libc-2.12.90.so)
==1932==    by 0x34B7DB435A: ??? (in /usr/lib64/libkdecore.so.5.5.0)
==1932==    by 0x34B7DB4F8C: ??? (in /usr/lib64/libkdecore.so.5.5.0)
==1932==    by 0x34B7DD75F1: ??? (in /usr/lib64/libkdecore.so.5.5.0)
==1932==    by 0x34B7DD9E4D: ??? (in /usr/lib64/libkdecore.so.5.5.0)
==1932==    by 0x34B7DDE1B1: ??? (in /usr/lib64/libkdecore.so.5.5.0)
==1932==    by 0x34B7DDE220: ??? (in /usr/lib64/libkdecore.so.5.5.0)
==1932==    by 0x34B7DD6737: ??? (in /usr/lib64/libkdecore.so.5.5.0)
==1932==    by 0x34B7DCDE3A: ??? (in /usr/lib64/libkdecore.so.5.5.0)
==1932== 
==1932== Use of uninitialised value of size 8
==1932==    at 0x53559D8: __GI___strcasecmp_l (in /lib64/libc-2.12.90.so)
==1932==    by 0x52ECEE1: __gconv_open (in /lib64/libc-2.12.90.so)
==1932==    by 0x52FB206: _nl_find_msg (in /lib64/libc-2.12.90.so)
==1932==    by 0x52FB7B3: __dcigettext (in /lib64/libc-2.12.90.so)
==1932==    by 0x34B7DB435A: ??? (in /usr/lib64/libkdecore.so.5.5.0)
==1932==    by 0x34B7DB4F8C: ??? (in /usr/lib64/libkdecore.so.5.5.0)
==1932==    by 0x34B7DD75F1: ??? (in /usr/lib64/libkdecore.so.5.5.0)
==1932==    by 0x34B7DD9E4D: ??? (in /usr/lib64/libkdecore.so.5.5.0)
==1932==    by 0x34B7DDE1B1: ??? (in /usr/lib64/libkdecore.so.5.5.0)
==1932==    by 0x34B7DDE220: ??? (in /usr/lib64/libkdecore.so.5.5.0)
==1932==    by 0x34B7DD6737: ??? (in /usr/lib64/libkdecore.so.5.5.0)
==1932==    by 0x34B7DCDE3A: ??? (in /usr/lib64/libkdecore.so.5.5.0)
==1932== 
okular(1932)/kdecore (KConfigSkeleton) KCoreConfigSkeleton::writeConfig:
okular(1932)/kdecore (KConfigSkeleton) KCoreConfigSkeleton::writeConfig:
==1932== Syscall param write(buf) points to uninitialised byte(s)
==1932==    at 0x4E3942D: ??? (in /lib64/libpthread-2.12.90.so)
==1932==    by 0x34B5808F2E: ??? (in /usr/lib64/libICE.so.6.3.0)
==1932==    by 0x34B580D707: _IceWrite (in /usr/lib64/libICE.so.6.3.0)
==1932==    by 0x34B580D7F3: IceFlush (in /usr/lib64/libICE.so.6.3.0)
==1932==    by 0x34BA01EFDC: ??? (in /usr/lib64/libQtGui.so.4.7.0)
==1932==    by 0x34BA01FC7F: ??? (in /usr/lib64/libQtGui.so.4.7.0)
==1932==    by 0x34BA033B8E: ??? (in /usr/lib64/libQtGui.so.4.7.0)
==1932==    by 0x34BA034528: ??? (in /usr/lib64/libQtGui.so.4.7.0)
==1932==    by 0x34B4E0623B: _SmcProcessMessage (in /usr/lib64/libSM.so.6.0.0)
==1932==    by 0x34B5812153: IceProcessMessages (in /usr/lib64/libICE.so.6.3.0)
==1932==    by 0x34BA02253E: ??? (in /usr/lib64/libQtGui.so.4.7.0)
==1932==    by 0x34B537002E: QMetaObject::activate(QObject*, QMetaObject const*, int, void**) (in /usr/lib64/libQtCore.so.4.7.0)
==1932==  Address 0xca9127c is 12 bytes inside a block of size 1,024 alloc'd
==1932==    at 0x4C25481: calloc (vg_replace_malloc.c:418)
==1932==    by 0x34B5805CD8: IceOpenConnection (in /usr/lib64/libICE.so.6.3.0)
==1932==    by 0x34B4E0270A: SmcOpenConnection (in /usr/lib64/libSM.so.6.0.0)
==1932==    by 0x34BA022767: QSessionManager::QSessionManager(QApplication*, QString&, QString&) (in /usr/lib64/libQtGui.so.4.7.0)
==1932==    by 0x34B9FBB769: QApplicationPrivate::initialize() (in /usr/lib64/libQtGui.so.4.7.0)
==1932==    by 0x34B9FBB910: QApplicationPrivate::construct(_XDisplay*, unsigned long, unsigned long) (in /usr/lib64/libQtGui.so.4.7.0)
==1932==    by 0x34B9FBC067: QApplication::QApplication(int&, char**, bool, int) (in /usr/lib64/libQtGui.so.4.7.0)
==1932==    by 0x34BBA22BB6: KApplication::KApplication(bool) (in /usr/lib64/libkdeui.so.5.5.0)
==1932==    by 0x408073: ??? (in /usr/bin/okular)
==1932==    by 0x52EBE7C: (below main) (in /lib64/libc-2.12.90.so)
==1932==
Comment 1 Valentin Villenave 2010-10-30 23:44:17 UTC
Comment on attachment 53003 [details]
PDF file

The bug may be reproduced regardless of the PDF document used.
Comment 2 Valentin Villenave 2010-10-30 23:46:31 UTC
You can disregard the attachment: actually, I have tried several PDF documents (long or short), and could reproduce the bug nearly every time.  It seems to happen mostly with multi-pages documents.
Comment 3 Albert Astals Cid 2010-10-30 23:57:12 UTC
If it crashes switching to raster i very much suspect the bug is somewhere in your X stack
Comment 4 Valentin Villenave 2010-10-31 00:07:37 UTC
The point is, it *doesn't* crash when switching to raster.  Sorry if that wasn't clear.
Comment 5 Pino Toscano 2010-10-31 00:32:41 UTC
The valgrind output is pretty useless, please get:
a) a valgrind carrying suppressions for glibc 2.12
b) debug symbols for okular and qt, at least

Looks also you are using glibc 2.12.90 (which smells as a prerelease), might be the issue although I would not bet on it. Also, if for "sysctrl combo" you mean the magic sysreq keys, then could mean your kernel went panic.
It would greatly help if you could pinpoint what changed in your system (any package, nothing excluded) between the last time you read PDF successfully and now (with the issue).

All in all, this does not look an Okular issue at all.
Comment 6 Kevin Kofler 2010-10-31 01:34:03 UTC
Those reports from Valgrind are only about uninitialized stuff, they don't look like something that'd crash by itself.

But anyway, a Valgrind log is unlikely to carry any useful information if the whole system crashed. If the whole system crashes, that sounds like a bug in the kernel or the graphics drivers. Nothing else on the system has that kind of low-level access. (So I don't think glibc has anything to do with that issue, either.) Unfortunately, Valgrind cannot provide information about crashes in the kernel or kernel modules.
Comment 7 Valentin Villenave 2010-10-31 10:39:22 UTC
Oh, maybe I should have mentioned that on one occasion where the bug happened, I managed to switch to a TTY just before the system became frozen, but then the CapsLock LED started blinking, indicating a kernel panic indeed.

It *does* look like a low-level problem, but although I do use a lot of demanding applications (browser with several multi-MB pages opened in dozens of tabs, plus video player, plus vector graphics, etc.), *only* okular caused a system crash (and it even reproduces it when no other app has been running before).

I do have updated my system recently, and it seems to have caused the bug.  I've reported the bug at Fedora's as well, hopefully they'll have more insight: https://bugzilla.redhat.com/show_bug.cgi?id=648141

I have never used valgrind before, so if you guys could give me a hand and tell me exactly what I'm looking for and how to obtain a helpful log, that would be much appreciated!
Comment 8 Albert Astals Cid 2014-05-08 14:12:29 UTC
Can you please try to update to Okular 0.19.0 (KDE Applications >= 4.13.0) and see if it still happens?

Thanks for caring about Okular :-)
Comment 9 Valentin Villenave 2014-05-08 14:31:21 UTC
Greetings,
I haven’t been able to reproduce it for, well, a few years in fact. (It dates back to 2.6 kernel days, and the X stack has changed a bit since then as well.) It *was* pretty weird while it lasted, though.

I suggest marking it as fixed.