target printer is Epson R220 via CUPS 1.4.1.

Can you reproduce this problem on any other device, for instance:
gs -sDEVICE=nullpage -dNOPAUSE -dBATCH  CityMap.pdf

I cannot reproduce this on 32-bit Windows with rev. 8.70 and 8.71 or
64-bit GNU+Linux eith rev. 8.70 using other devices. I didn't try cups.

Good tip with the command.

I can't reproduce the problem with this command either with the same software
etc, so this must relate to how ghostscript is invoked from CUPS.

Clearly, the output device is different. I'll see what I can find; let me know
if you have any tips.

You can run something like:

:; mkdir -p /tmp/ST
:; strace -v -s8192 -o /tmp/ST/cupsd -p $(pidof cupsd)

then try printing something; then use CTRL-C to quit strace(8).

You’ll find the full list of arguments and the full environment of the call to
gs(1) in the strace(8) output.

I just had to do that to debug a similar problem with a cups driver.

Ghostscript 8.70 completes with the simple command line

gs -sDEVICE=cups -dNOPAUSE -dBATCH -sOutputFile=out  CityMap.pdf

so we need the complete command line, obtained as described in comment #4.

It is perhaps a problem of the "cups" output device, but I do not know whether
such errors can really be caused by the output device. For that I am not
Ghostscript expert enough.

Daniel, please help us to help you.

The correct command line saves the programmer a lot of time
spent on guesswork. So far all attempts to reproduce the problem
were unsuccessful. Without the command line I'd have to close
this bug report.

I have investigated this some more. The original poster has probably printed the
file out of evince (the standard PDF viewer under Ubuntu). evince does not pass
the PDF file through when the user prints it but re-renders the file
unnecessarily. The re-rendered file is attached as CityMap-evince.pdf. Until
reaching Ghostscript, this file passed through pdftopdf (attached as
CityMap-evince-pdftopdf.pdf).

The original Ghostscript command line is

cat CityMap-evince-pdftopdf.pdf | /usr/bin/gs -dQUIET -dPARANOIDSAFER -dNOPAUSE
-dBATCH -sDEVICE=cups -sstdout=%stderr -sOutputFile=%stdout
-I/usr/share/cups/fonts -sMediaClass=Standard -sMediaType=Plain -r720x360
-dDEVICEWIDTHPOINTS=595 -dDEVICEHEIGHTPOINTS=842 -dcupsBitsPerColor=8
-dcupsColorOrder=0 -dcupsColorSpace=6 -dcupsRowFeed=5 -scupsPageSizeName=A4 -c
-f -_ > out.raster

Unfortunately, I do not get the error shown by the original poster when I simply
run this command line. Instead, I get a segmentation fault.

If I really create a print queue for the original poster's printer (Epson Stylus
Photo R220, driver CUPS+Gutenprint), I get the error reported by the original
poster, but I do not get it when running the filters on the command line or via
the "cupsfilter" command.

Created attachment 6020 [details]
CityMap.pdf

Original input file

Created attachment 6021 [details]
CityMap-evince.pdf

PDF file as evince sends it to CUPS

Created attachment 6022 [details]
CityMap-evince-pdftopdf.pdf

PDF file from evince passed through the pdftopdf filter. In this form it
arrives at Ghostscript when printing with CUPS.

I'm experiencing the same execform1 rangecheck with GPL Ghostscript 8.71 in Ubuntu 10.04 x86-64 pre-release as of today.

To confirm, I am printing the PDF from evince.

From the error log, I tried to reproduce directly, but met likely the same issue as Till saw:

# export CUPS_CACHEDIR=/var/cache/cups CUPS_DATADIR=/usr/share/cups CUPS_DOCROOT=/usr/share/cups/doc-root CUPS_FONTPATH=/usr/share/cups/fonts CUPS_REQUESTROOT=/var/spool/cups CUPS_SERVERBIN=/usr/lib/cups CUPS_SERVERROOT=/etc/cups CUPS_STATEDIR=/var/run/cups HOME=/var/spool/cups/tmp PATH=/usr/lib/cups/filter:/usr/bin:/usr/sbin:/bin:/usr/bin SERVER_ADMIN=root@exige SOFTWARE=CUPS/1.4.2 TMPDIR=/var/spool/cups/tmp TZ=Europe/London USER=root CUPS_SERVER=/var/run/cups/cups.sock CUPS_ENCRYPTION=IfRequested IPP_PORT=631 CHARSET=utf-8 LANG=en.UTF-8 PPD=/etc/cups/ppd/Stylus-Photo-R220.ppd RIP_MAX_CACHE=978762k CONTENT_TYPE=application/pdf DEVICE_URI=usb://EPSON/Stylus%20Photo%20R220 PRINTER_INFO="EPSON Stylus Photo R220" PRINTER_LOCATION=exige PRINTER=Stylus-Photo-R220 CUPS_FILETYPE=document FINAL_CONTENT_TYPE=printer/Stylus-Photo-R220

# cat CityMap.pdf | /usr/bin/gs -dQUIET -dPARANOIDSAFER -dNOPAUSE -dBATCH -sDEVICE=cups -sstdout=%stderr -sOutputFile=%stdout -I/usr/share/cups/fonts -sMediaClass=Standard -sMediaType=Plain -r720x360 -dDEVICEWIDTHPOINTS=595 -dDEVICEHEIGHTPOINTS=842 -dcupsBitsPerColor=8 -dcupsColorOrder=0 -dcupsColorSpace=1 -dcupsRowFeed=5 -scupsPageSizeName=A4 -c -f -_

...
DEBUG2: matrix = [ 0.000 5.000 10.000 0.000 -0.000 -0.000 ]
Segmentation fault

BUT, using CityMap-evince.pdf, we see 'rangecheck in --run--':

...
DEBUG2: matrix = [ 10.000 0.000 0.000 -5.000 -0.000 4210.000 ]
Error: /rangecheck in --run--
Operand stack:
   (/var/spool/cups/tmp/gs_EOpM4t)   --nostringval--   --dict:7/16(L)--   3   11
Execution stack:
   %interp_exit   .runexec2   --nostringval--   --nostringval--   --nostringval--   2   %stopped_push   --nostringval--   --nostringval--   --nostringval--   false   1   %stopped_push   1878   1   3   %oparray_pop   1877   1   3   %oparray_pop   1861   1   3   %oparray_pop   --nostringval--   --nostringval--   --nostringval--   2   1   1   --nostringval--   %for_pos_int_continue   --nostringval--   --nostringval--   false   1   %stopped_push   --nostringval--   --nostringval--
Dictionary stack:
   --dict:1165/1684(ro)(G)--   --dict:1/20(G)--   --dict:75/200(L)--   --dict:75/200(L)--   --dict:108/127(ro)(G)--   --dict:288/300(ro)(G)--   --dict:22/25(L)--   --dict:6/8(L)--   --dict:21/40(L)--   --dict:1/1(ro)(G)--   --dict:5/5(L)--   --dict:1/1(ro)(G)--
Current allocation mode is local
Last OS error: 2
GPL Ghostscript 8.71: Unrecoverable error, exit code 1
DEBUG2: cups_close(0x1d45308)

BINGO. When using CityMap-evince-pdftopdf.pdf, we see the execform1 rangecheck:

DEBUG2: matrix = [ 10.000 0.000 0.000 -5.000 -0.000 4210.000 ]
Error: /rangecheck in --.execform1--
Operand stack:
   (/var/spool/cups/tmp/gs_DO4Jwd)   --nostringval--   --dict:7/16(L)--   3   11
Execution stack:
   %interp_exit   .runexec2   --nostringval--   --nostringval--   --nostringval--   2   %stopped_push   --nostringval--   --nostringval--   --nostringval--   false   1   %stopped_push   1878   1   3   %oparray_pop   1877   1   3   %oparray_pop   1861   1   3   %oparray_pop   --nostringval--   --nostringval--   --nostringval--   2   1   1   --nostringval--   %for_pos_int_continue   --nostringval--   --nostringval--   false   1   %stopped_push   --nostringval--   --nostringval--   --nostringval--   %array_continue   --nostringval--   false   1   %stopped_push   --nostringval--   %loop_continue   --nostringval--   334070   --nostringval--   1826   6   12   %oparray_pop   --nostringval--   false   1   %stopped_push   1825   6   12   %oparray_pop   --nostringval--   --nostringval--
Dictionary stack:
   --dict:1165/1684(ro)(G)--   --dict:1/20(G)--   --dict:75/200(L)--   --dict:75/200(L)--   --dict:108/127(ro)(G)--   --dict:288/300(ro)(G)--   --dict:22/25(L)--   --dict:6/8(L)--   --dict:21/40(L)--   --dict:1/1(ro)(G)--   --dict:5/5(L)--   --dict:1/1(ro)(G)--   --dict:4/5(L)--   --dict:5/5(L)--
Current allocation mode is local
Last OS error: 2
GPL Ghostscript 8.71: Unrecoverable error, exit code 1
DEBUG2: cups_close(0xa05308)

Created attachment 6058 [details]
CUPS/GS error log

Rebuilding ghostscript 8.71 with the same configuration options and with -g and not stripping, we are able to get a good stacktrace via running under valgrind for the SEGV case:

# export CUPS_CACHEDIR=/var/cache/cups CUPS_DATADIR=/usr/share/cups
CUPS_DOCROOT=/usr/share/cups/doc-root CUPS_FONTPATH=/usr/share/cups/fonts
CUPS_REQUESTROOT=/var/spool/cups CUPS_SERVERBIN=/usr/lib/cups
CUPS_SERVERROOT=/etc/cups CUPS_STATEDIR=/var/run/cups HOME=/var/spool/cups/tmp
PATH=/usr/lib/cups/filter:/usr/bin:/usr/sbin:/bin:/usr/bin
SERVER_ADMIN=root@exige SOFTWARE=CUPS/1.4.2 TMPDIR=/var/spool/cups/tmp
TZ=Europe/London USER=root CUPS_SERVER=/var/run/cups/cups.sock
CUPS_ENCRYPTION=IfRequested IPP_PORT=631 CHARSET=utf-8 LANG=en.UTF-8
PPD=/etc/cups/ppd/Stylus-Photo-R220.ppd RIP_MAX_CACHE=978762k
CONTENT_TYPE=application/pdf DEVICE_URI=usb://EPSON/Stylus%20Photo%20R220
PRINTER_INFO="EPSON Stylus Photo R220" PRINTER_LOCATION=exige
PRINTER=Stylus-Photo-R220 CUPS_FILETYPE=document
FINAL_CONTENT_TYPE=printer/Stylus-Photo-R220

# cat CityMap.pdf | valgrind ./gs -dQUIET -dPARANOIDSAFER -dNOPAUSE -dBATCH -sDEVICE=cups -sstdout=%stderr -sOutputFile=%stdout -I/usr/share/cups/fonts -sMediaClass=Standard -sMediaType=Plain -r720x360 -dDEVICEWIDTHPOINTS=595 -dDEVICEHEIGHTPOINTS=842 -dcupsBitsPerColor=8 -dcupsColorOrder=0 -dcupsColorSpace=1 -dcupsRowFeed=5 -scupsPageSizeName=A4 -c -f -_
...
==24719== Invalid write of size 4
==24719==    at 0x7B3080: mem_true24_fill_rectangle (gdevm24.c:270)
==24719==    by 0x770EF4: gx_dc_pure_fill_rectangle (gxdcolor.c:414)
==24719==    by 0x462415: image_render_color (gxicolor.c:435)
==24719==    by 0x785F40: gx_image1_plane_data (gxidata.c:208)
==24719==    by 0x56071F: pdf14_put_image (gdevp14.c:1406)
==24719==    by 0x561ECC: gx_update_pdf14_compositor (gdevp14.c:2271)
==24719==    by 0x563851: send_pdf14trans (gdevp14.c:4636)
==24719==    by 0x55669C: gs_state_update_pdf14trans (gstrans.c:160)
==24719==    by 0x556709: gs_pop_pdf14trans_device (gstrans.c:785)
==24719==    by 0x4D78F7: interp (interp.c:1538)
==24719==    by 0x4D845A: gs_interpret (interp.c:496)
==24719==    by 0x4CCDA4: gs_main_run_string_end (imain.c:214)
==24719==  Address 0xffffffffffffffff is not stack'd, malloc'd or (recently) free'd

In the full transcript, we see potential non-deterministic behaviour from invalid (eg uninitialised) memory reads. The output covers all three PDF cases here.

Created attachment 6059 [details]
Execution of GS for three testcases under valgrind

Whether you can reproduce this bug or not, especially whether you get an error or a segfault dpends much on the bitmap buffer size. See bug #691170.

This Ubuntu bug report is probably the same bug:

https://bugs.launchpad.net/gs-gpl/+bug/539708

The segfault problem is now solved (bug #691170), so all files will error out decently now. Please re-run all your tests with the current SVN of Ghostscript so that we get the correct error messages. Re-run also the tests which did not segfault as the error can have changed. Redo also the Valgrind tests, as some of the Valgrind alerts can come from the segfault problem and not from this bug.

Checking out and configuring with: 

$ svn co http://svn.ghostscript.com/ghostscript/trunk/gs
$ ./autogen.sh; CFLAGS="-g -Wall -O2 -g -O2  -fPIC" LDFLAGS="-lpaper " ./configure --build=x86_64-linux-gnu --prefix=/usr --includedir="/usr/include" --mandir="/usr/share/man" --infodir="/usr/share/info" --sysconfdir=/etc --localstatedir=/var --libexecdir="/usr/lib/ghostscript" --srcdir=.  --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --with-ijs --with-jbig2dec --with-jasper --with-x --disable-gtk --enable-dynamic --with-omni --enable-cups --disable-compile-inits --disable-cairo --with-drivers=ALL --with-fontpath=/var/lib/defoma/gs.d/dirs/fonts:/usr/share/cups/fonts:/usr/share/ghostscript/fonts:/usr/local/lib/ghostscript/fonts:/usr/share/fonts

...gs still gets hit with a SEGV with CityMap.pdf and we now hit GS '/unknownerror in --showpage--'. Since the valgrind logs are a superset of the normal logs, I've only included these.

GS developers: let me know if you can't reproduce this in your environment and I'll see what is missing.

Created attachment 6109 [details]
SVN ghostscript with CityMap.pdf

Created attachment 6110 [details]
SVN ghostscript with CityMap-evince.pdf

Created attachment 6111 [details]
SVN ghostscript with CityMap-evince-pdftopdf.pdf

CityMap-evince.pdf seems to be really broken.

This command line

cat ~/ghostscript/gpl/testfiles/CityMap-evince.pdf | PPD=/etc/cups/ppd/R220.ppd RIP_MAX_CACHE=8m /usr/bin/gs -dQUIET -dPARANOIDSAFER -dNOPAUSE -dBATCH -sDEVICE=cups -sstdout=%stderr -sOutputFile=%stdout -I/usr/share/cups/fonts -sMediaClass=Standard -sMediaType=Plain -r720x360 -dDEVICEWIDTHPOINTS=595 -dDEVICEHEIGHTPOINTS=842 -dcupsBitsPerColor=8 -dcupsColorOrder=0 -dcupsColorSpace=6 -dcupsRowFeed=5 -scupsPageSizeName=A4 -c -f -_ > out.raster 2> log

renders only the legend of the map, not the map itself. As soon as the map begins, GS errors out with "Error: /unknownerror in --showpage--". If you replace "-sDEVICE=cups" by "-sDEVICE=png16m", "-sDEVICE=pnggray", or "-sDEVICE=jpeg", GS also stops rendering when the map begins (rest of the image is white and sometimes has some black stripes). Difference is that these devices do not error out, but this is perhaps due to a worse error handling.

Also screen display of all the three CityMap*.pdf files with Ghostscript (simply call "gs <file>" under Linux) does not work. It always ends up with "Error: /rangecheck in --run--" or "Error: /unknownerror in --run--".

Running the file at a lower resolution (eg 150 dpi) works for me, whereas 720x360 or even just 360 doesn't, so its most probably a memory exhaustion error of some kind.

The error I'm seeing is unknownerror in showpage.

I see the file contains 10 transparency groups, it seems that there are several images, each is drawn in a Pattern object, and each seems to have its own transparency group. In addition there are several Form XObjects which seem to do not a lot useful except draw a flat fill, and some of these also contain transparency groups.

I'd guess the rather deranged use of transparency may be the reason for the problem, GS is simply running out of memory at higher resolutions. I thought that a banding device would help here, but it doesn't seem to. Possibly we are caching the patterns, and since they involve large images and transparency this is a problem ?

The observations of the last comment make the impression that something is
wrong with the PDF interpreter. The rendering breaks somehow and certain
graphical elements (like the map here) get lost and probably due to this the
output device (like "cups") does not get some scanlines when outputting a page
(I have found out by adding some debug lines to the code that the "cups" output
device errors out on the gdev_prn_get_bits() call in cups_print_chunked().

The segmentation fault of comment #13 and comment #18 is not the same as of bug
#691170, as it happens before the first scanline is put out.

Created attachment 6112 [details]
org_chromium_ANn03F.pdf

This PDF file has similar problems, with the PNG or JPG backends you get an image containing only the separator lines and all text and the Google Mail logo are dropped, the CUPS backend errors out due to not getting some of the scanlines.

gs org_chromium_ANn03F.pdf

gives correct output though.

Now I have rebuilt GS with "./configure ... --enable-debug" and "make sodebug". Then I have run the following command line:

cat CityMap-evince.pdf | PPD=/etc/cups/ppd/R220.ppd RIP_MAX_CACHE=8m /usr/bin/gs -K256000 -Za -dQUIET -dPARANOIDSAFER -dNOPAUSE -dBATCH -sDEVICE=cups -sstdout=%stderr -sOutputFile=%stdout -I/usr/share/cups/fonts -sMediaClass=Standard -sMediaType=Plain -r720x360 -dDEVICEWIDTHPOINTS=595 -dDEVICEHEIGHTPOINTS=842 -dcupsBitsPerColor=8 -dcupsColorOrder=0 -dcupsColorSpace=6 -dcupsRowFeed=5 -scupsPageSizeName=A4 -c -f -_ > out.raster 2> debuglog

and I attach the last 5000 lines of the file debuglog

Created attachment 6114 [details]
debuglog

Last 5000 lines of debuglog of last comment.

I have a segfault in the clist playback:

debugobj/gs  -r720x360 -sDEVICE=cups -dBATCH -sOutputFile=/tmp/a.out \ 
~/private-dev/bugs.ghostscript.com/attachment.cgi\?id\=6022\&action\=view

Program received signal SIGSEGV, Segmentation fault.
0x00000000004b0370 in gx_pattern_accum_alloc (mem=0x17b7dc8, storage_memory=0x17b7dc8, pinst=0x24d0000000000, cname=0x8ffe49 "gx_pattern_load") at ./base/gxpcmap.c:190
190	    gx_device *tdev = pinst->saved->device;

(gdb) bt
#0  0x00000000004b0370 in gx_pattern_accum_alloc (mem=0x17b7dc8, storage_memory=0x17b7dc8, pinst=0x24d0000000000, cname=0x8ffe49 "gx_pattern_load") at ./base/gxpcmap.c:190
#1  0x00000000004b23a9 in gx_pattern_load (pdc=0x7fffffff6ba0, pis=0x7fffffff6ea0, dev=0x1abbb08, select=gs_color_select_texture) at ./base/gxpcmap.c:1026
#2  0x00000000004aab0f in gx_dc_pattern_load (pdevc=0x7fffffff6ba0, pis=0x7fffffff6ea0, dev=0x1abbb08, select=gs_color_select_texture) at ./base/gsptype1.c:1152
#3  0x00000000006348e4 in clist_playback_band (playback_action=playback_action_render, cdev=0x183f218, s=0x7fffffffa390, target=0x1abbb08, x0=0, y0=0, mem=0x17b7dc8)
    at ./base/gxclrast.c:1671
#4  0x000000000063c354 in clist_playback_file_bands (action=playback_action_render, crdev=0x183f218, page_info=0x7fffffffb1d8, target=0x1a20130, band_first=0, band_last=0, 
    x0=0, y0=0) at ./base/gxclread.c:698
#5  0x000000000063bf69 in clist_render_rectangle (cldev=0x183f218, prect=0x7fffffffb7f0, bdev=0x1a20130, render_plane=0x7fffffffb9c0, clear=1) at ./base/gxclread.c:627
#6  0x000000000063bc6f in clist_rasterize_lines (dev=0x183f218, y=0, line_count=1, bdev=0x1a20130, render_plane=0x7fffffffb9c0, pmy=0x7fffffffb9bc) at ./base/gxclread.c:539
#7  0x000000000063b74c in clist_get_bits_rectangle (dev=0x183f218, prect=0x7fffffffbd80, params=0x7fffffffbc60, unread=0x0) at ./base/gxclread.c:430
#8  0x0000000000651269 in clist_get_bits_rect_mt (dev=0x183f218, prect=0x7fffffffbd80, params=0x7fffffffbc60, unread=0x0) at ./base/gxclthrd.c:472
#9  0x00000000008c959e in gx_default_get_bits (dev=0x183f218, y=0, data=0x1971780 "\340\212\256\001", actual_data=0x7fffffffbe48) at ./base/gdevdgbr.c:51
#10 0x000000000062afc2 in gdev_prn_get_bits (pdev=0x183f218, y=0, str=0x1971780 "\340\212\256\001", actual_data=0x7fffffffbe48) at ./base/gdevprn.c:1225
#11 0x0000000000818576 in cups_print_chunked (pdev=0x183f218, src=0x1971780 "\340\212\256\001", dst=0x1bc2510 "", srcbytes=745) at cups/gdevcups.c:3804
#12 0x0000000000813ba8 in cups_print_pages (pdev=0x183f218, fp=0x19d0bf0, num_copies=1) at cups/gdevcups.c:2644
#13 0x0000000000629f49 in gdev_prn_output_page (pdev=0x183f218, num_copies=1, flush=1) at ./base/gdevprn.c:770
#14 0x00000000008cc6b1 in gx_forward_output_page (dev=0x196ff98, num_copies=1, flush=1) at ./base/gdevnfwd.c:168
#15 0x0000000000837c2c in gs_output_page (pgs=0x17d8f38, num_copies=1, flush=1) at ./base/gsdevice.c:144
#16 0x00000000005073af in zoutputpage (i_ctx_p=0x17f4ff0) at ./psi/zdevice.c:354
#17 0x00000000004bfc27 in call_operator (op_proc=0x5072c1 <zoutputpage>, i_ctx_p=0x17f4ff0) at ./psi/interp.c:118
...

I find rastering these various PDFs with the CUPS filter causes various SEGVs in week-old ghostscript SVN trunk - reproducible with the environment and command above:

http://cimg.sourceforge.net/CImg_flyer.pdf   
ftp://ftp.numerical.rl.ac.uk/pub/talks/Arioli-NAG-Warwick.pdf
http://www.stdout.org/~winston/latex/latexsheet-a4.pdf
http://www.brunel200.com/downloads/launch_leaflet.pdf 
http://www.cambridgeaudio.com/assets/documents/AP227921Azur540RV3SerialControlProtocolV1.pdf

Handy tip to locate PDF/PS files which catch out ghostscript:

echo 'core-%e-%p' >/proc/sys/kernel/core_pattern
ulimit -c unlimited

find ~ -iname '*.eps' -o -iname '*.ps' -o -iname '*.pdf' -print -exec ./gs -dQUIET -dPARANOIDSAFER -dNOPAUSE -dBATCH -sDEVICE=cups -sstdout=%stderr -sOutputFile=/dev/null -I/usr/share/cups/fonts -sMediaClass=Standard -sMediaType=Plain -r720x360 -dDEVICEWIDTHPOINTS=595 -dDEVICEHEIGHTPOINTS=842 -dcupsBitsPerColor=8 -dcupsColorOrder=0 -dcupsColorSpace=1 -dcupsRowFeed=5 -scupsPageSizeName=A4 -c -f -_ {} \; </dev/null >/dev/null 2>&1

I am currently trying to collect examples using the method of comment #32. Let us see what I will have tomorrow ... (note that my computer is all the time responsive while doing this. There is no file eating up all memory, but already one file has segfaulted)

Now trying the examples from comment #31, starting with the file which looks like being the simplest of them: latexsheet-a4.pdf.


Using this command line


PPD=/etc/cups/ppd/R220.ppd /usr/bin/gs -dQUIET -dPARANOIDSAFER -dNOPAUSE -dBATCH -sDEVICE=cups -sstdout=%stderr -sOutputFile=%stdout -I/usr/share/cups/fonts -sMediaClass=Standard -sMediaType=Plain -r720x360 -dDEVICEWIDTHPOINTS=595 -dDEVICEHEIGHTPOINTS=842 -dcupsBitsPerColor=8 -dcupsColorOrder=0 -dcupsColorSpace=1 -dcupsRowFeed=5 -scupsPageSizeName=A4 -c -f latexsheet-a4.pdf > x 2>log


I get the following stack trace:


till@till:~/ghostscript/gpl/testfiles$ gdb -c core-gs-24722 /usr/bin/gs
GNU gdb (GDB) 7.1-ubuntu
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/bin/gs...(no debugging symbols found)...done.
[New Thread 24722]

warning: Can't read pathname for load map: Input/output error.
Reading symbols from /usr/lib/libgs.so.8...done.
Loaded symbols for /usr/lib/libgs.so.8
Reading symbols from /lib/libc.so.6...(no debugging symbols found)...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /usr/lib/libpaper.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libpaper.so.1
Reading symbols from /usr/lib/libtiff.so.4...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libtiff.so.4
Reading symbols from /usr/lib/libcupsimage.so.2...Reading symbols from /usr/lib/debug/usr/lib/libcupsimage.so.2...(no debugging symbols found)...done.
(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libcupsimage.so.2
Reading symbols from /usr/lib/libcups.so.2...Reading symbols from /usr/lib/debug/usr/lib/libcups.so.2...(no debugging symbols found)...done.
(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libcups.so.2
Reading symbols from /usr/lib/libgssapi_krb5.so.2...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libgssapi_krb5.so.2
Reading symbols from /usr/lib/libgnutls.so.26...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libgnutls.so.26
Reading symbols from /lib/libz.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libz.so.1
Reading symbols from /lib/libpthread.so.0...(no debugging symbols found)...done.
Loaded symbols for /lib/libpthread.so.0
Reading symbols from /lib/libm.so.6...(no debugging symbols found)...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /lib/libcrypt.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libcrypt.so.1
Reading symbols from /lib/libdl.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /usr/lib/libstdc++.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libstdc++.so.6
Reading symbols from /usr/lib/libfontconfig.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libfontconfig.so.1
Reading symbols from /lib64/ld-linux-x86-64.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib64/ld-linux-x86-64.so.2
Reading symbols from /usr/lib/libjpeg.so.62...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libjpeg.so.62
Reading symbols from /lib/libpng12.so.0...(no debugging symbols found)...done.
Loaded symbols for /lib/libpng12.so.0
Reading symbols from /usr/lib/libavahi-common.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libavahi-common.so.3
Reading symbols from /usr/lib/libavahi-client.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libavahi-client.so.3
Reading symbols from /usr/lib/libkrb5.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libkrb5.so.3
Reading symbols from /usr/lib/libk5crypto.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libk5crypto.so.3
Reading symbols from /lib/libcom_err.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/libcom_err.so.2
Reading symbols from /usr/lib/libkrb5support.so.0...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libkrb5support.so.0
Reading symbols from /lib/libkeyutils.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libkeyutils.so.1
Reading symbols from /lib/libresolv.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/libresolv.so.2
Reading symbols from /usr/lib/libtasn1.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libtasn1.so.3
Reading symbols from /lib/libgcrypt.so.11...(no debugging symbols found)...done.
Loaded symbols for /lib/libgcrypt.so.11
Reading symbols from /lib/libgcc_s.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libgcc_s.so.1
Reading symbols from /usr/lib/libfreetype.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libfreetype.so.6
Reading symbols from /lib/libexpat.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libexpat.so.1
Reading symbols from /lib/libdbus-1.so.3...(no debugging symbols found)...done.
Loaded symbols for /lib/libdbus-1.so.3
Reading symbols from /lib/librt.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/librt.so.1
Reading symbols from /lib/libgpg-error.so.0...(no debugging symbols found)...done.
Loaded symbols for /lib/libgpg-error.so.0
Reading symbols from /usr/lib/ghostscript/8.71/X11.so...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/ghostscript/8.71/X11.so
Reading symbols from /usr/lib/libXt.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libXt.so.6
Reading symbols from /usr/lib/libSM.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libSM.so.6
Reading symbols from /usr/lib/libICE.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libICE.so.6
Reading symbols from /usr/lib/libXext.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libXext.so.6
Reading symbols from /usr/lib/libX11.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libX11.so.6
Reading symbols from /lib/libuuid.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libuuid.so.1
Reading symbols from /usr/lib/libxcb.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libxcb.so.1
Reading symbols from /usr/lib/libXau.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libXau.so.6
Reading symbols from /usr/lib/libXdmcp.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libXdmcp.so.6
Core was generated by `/usr/bin/gs -dQUIET -dPARANOIDSAFER -dNOPAUSE -dBATCH -sDEVICE=cups -sstdout=%s'.
Program terminated with signal 11, Segmentation fault.
#0  cmd_put_list_op (cldev=0x99f298, pcl=0x7f713554e620, size=15)
    at ./base/gxclutil.c:269
269		    pcl->tail->next = cp;
(gdb) bt
#0  cmd_put_list_op (cldev=0x99f298, pcl=0x7f713554e620, size=15)
    at ./base/gxclutil.c:269
#1  0x00007f7134a8e2b8 in cmd_write_unknown (cldev=0x99f298, 
    pcls=0x7f713554e468, must_know=<value optimized out>)
    at ./base/gxclpath.c:479
#2  0x00007f7134a8fd2d in clist_stroke_path (dev=0x99f298, pis=0x939e88, 
    ppath=0x956670, params=<value optimized out>, pdcolor=0xfc4470, 
    pcpath=0xfc42f0) at ./base/gxclpath.c:899
#3  0x00007f7134c4ad1f in gx_stroke_fill (ppath=0x956670, pgs=0x939e88)
    at ./base/gxpaint.c:65
#4  0x00007f7134c0ce62 in gs_stroke (pgs=0x939e88) at ./base/gspaint.c:458
#5  0x00007f713495d9bd in call_operator (pi_ctx_p=<value optimized out>, 
    pref=<value optimized out>, perror_object=<value optimized out>)
    at ./psi/interp.c:111
#6  interp (pi_ctx_p=<value optimized out>, pref=<value optimized out>, 
    perror_object=<value optimized out>) at ./psi/interp.c:1275
#7  0x00007f713495eb4b in gs_call_interp (pi_ctx_p=0x913348, 
    pref=<value optimized out>, user_errors=<value optimized out>, 
    pexit_code=<value optimized out>, perror_object=0x7fff34281400)
    at ./psi/interp.c:496
#8  gs_interpret (pi_ctx_p=0x913348, pref=<value optimized out>, 
    user_errors=<value optimized out>, pexit_code=<value optimized out>, 
    perror_object=0x7fff34281400) at ./psi/interp.c:454
#9  0x00007f7134951b55 in gs_main_interpret (minst=<value optimized out>, 
---Type <return> to continue, or q <return> to quit---
    user_errors=1324941725, pexit_code=<value optimized out>, 
    perror_object=0x7f71355f0740) at ./psi/imain.c:214
#10 gs_main_run_string_end (minst=<value optimized out>, 
    user_errors=1324941725, pexit_code=<value optimized out>, 
    perror_object=0x7f71355f0740) at ./psi/imain.c:526
#11 0x00007f7134952fbe in run_string (minst=0x7f71347df860, str=0x0, options=3)
    at ./psi/imainarg.c:814
#12 0x00007f71349537da in runarg (minst=0x9132b0, pre=0x7f7134ccb1c7 "", 
    arg=<value optimized out>, post=0x7f7134c8549a ".runfile", options=3)
    at ./psi/imainarg.c:805
#13 0x00007f71349552cc in gs_main_init_with_args (minst=0x9132b0, argc=22, 
    argv=0x7fff34281ff8) at ./psi/imainarg.c:215
#14 0x0000000000400b1c in main ()
(gdb) quit
till@till:~/ghostscript/gpl/testfiles$ 


The end of the stderr output (file "log") looks like this:


[...]
DEBUG2: cups_map_cmyk(0x99f298, 0, 0, 0, 32760, 0x7fff34280300)
DEBUG2:   \=== COLOR 0, 0, 0
DEBUG2: cv[0]=0 -> 0
DEBUG2: cups_map_cmyk(0x99f298, 0, 0, 0, 32760, 0x7fff34280350)
DEBUG2:   \=== COLOR 0, 0, 0
DEBUG2: cv[0]=0 -> 0
GPL Ghostscript 8.71: ./base/gxclutil.c(266): cmd_put_list_op error at 0x6320e4184ef9019d


latexshhet-a4.pdf renders correctly with Hin-Tak's command line from comment #30.

Next file: AP227921Azur540RV3SerialControlProtocolV1.pdf

till@till:~/ghostscript/gpl/testfiles$ PPD=/etc/cups/ppd/R220.ppd /usr/bin/gs -dQUIET -dPARANOIDSAFER -dNOPAUSE -dBATCH -sDEVICE=cups -sstdout=%stderr -sOutputFile=%stdout -I/usr/share/cups/fonts -sMediaClass=Standard -sMediaType=Plain -r720x360 -dDEVICEWIDTHPOINTS=595 -dDEVICEHEIGHTPOINTS=842 -dcupsBitsPerColor=8 -dcupsColorOrder=0 -dcupsColorSpace=1 -dcupsRowFeed=5 -scupsPageSizeName=A4 -c -f AP227921Azur540RV3SerialControlProtocolV1.pdf > x 2>log
Segmentation fault (core dumped)
till@till:~/ghostscript/gpl/testfiles$ gdb -c core-gs-24974 /usr/bin/gs
GNU gdb (GDB) 7.1-ubuntu
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/bin/gs...(no debugging symbols found)...done.
[New Thread 24974]

warning: Can't read pathname for load map: Input/output error.
Reading symbols from /usr/lib/libgs.so.8...done.
Loaded symbols for /usr/lib/libgs.so.8
Reading symbols from /lib/libc.so.6...(no debugging symbols found)...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /usr/lib/libpaper.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libpaper.so.1
Reading symbols from /usr/lib/libtiff.so.4...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libtiff.so.4
Reading symbols from /usr/lib/libcupsimage.so.2...Reading symbols from /usr/lib/debug/usr/lib/libcupsimage.so.2...(no debugging symbols found)...done.
(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libcupsimage.so.2
Reading symbols from /usr/lib/libcups.so.2...Reading symbols from /usr/lib/debug/usr/lib/libcups.so.2...(no debugging symbols found)...done.
(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libcups.so.2
Reading symbols from /usr/lib/libgssapi_krb5.so.2...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libgssapi_krb5.so.2
Reading symbols from /usr/lib/libgnutls.so.26...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libgnutls.so.26
Reading symbols from /lib/libz.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libz.so.1
Reading symbols from /lib/libpthread.so.0...(no debugging symbols found)...done.
Loaded symbols for /lib/libpthread.so.0
Reading symbols from /lib/libm.so.6...(no debugging symbols found)...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /lib/libcrypt.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libcrypt.so.1
Reading symbols from /lib/libdl.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /usr/lib/libstdc++.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libstdc++.so.6
Reading symbols from /usr/lib/libfontconfig.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libfontconfig.so.1
Reading symbols from /lib64/ld-linux-x86-64.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib64/ld-linux-x86-64.so.2
Reading symbols from /usr/lib/libjpeg.so.62...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libjpeg.so.62
Reading symbols from /lib/libpng12.so.0...(no debugging symbols found)...done.
Loaded symbols for /lib/libpng12.so.0
Reading symbols from /usr/lib/libavahi-common.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libavahi-common.so.3
Reading symbols from /usr/lib/libavahi-client.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libavahi-client.so.3
Reading symbols from /usr/lib/libkrb5.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libkrb5.so.3
Reading symbols from /usr/lib/libk5crypto.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libk5crypto.so.3
Reading symbols from /lib/libcom_err.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/libcom_err.so.2
Reading symbols from /usr/lib/libkrb5support.so.0...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libkrb5support.so.0
Reading symbols from /lib/libkeyutils.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libkeyutils.so.1
Reading symbols from /lib/libresolv.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/libresolv.so.2
Reading symbols from /usr/lib/libtasn1.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libtasn1.so.3
Reading symbols from /lib/libgcrypt.so.11...(no debugging symbols found)...done.
Loaded symbols for /lib/libgcrypt.so.11
Reading symbols from /lib/libgcc_s.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libgcc_s.so.1
Reading symbols from /usr/lib/libfreetype.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libfreetype.so.6
Reading symbols from /lib/libexpat.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libexpat.so.1
Reading symbols from /lib/libdbus-1.so.3...(no debugging symbols found)...done.
Loaded symbols for /lib/libdbus-1.so.3
Reading symbols from /lib/librt.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/librt.so.1
Reading symbols from /lib/libgpg-error.so.0...(no debugging symbols found)...done.
Loaded symbols for /lib/libgpg-error.so.0
Reading symbols from /usr/lib/ghostscript/8.71/X11.so...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/ghostscript/8.71/X11.so
Reading symbols from /usr/lib/libXt.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libXt.so.6
Reading symbols from /usr/lib/libSM.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libSM.so.6
Reading symbols from /usr/lib/libICE.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libICE.so.6
Reading symbols from /usr/lib/libXext.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libXext.so.6
Reading symbols from /usr/lib/libX11.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libX11.so.6
Reading symbols from /lib/libuuid.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libuuid.so.1
Reading symbols from /usr/lib/libxcb.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libxcb.so.1
Reading symbols from /usr/lib/libXau.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libXau.so.6
Reading symbols from /usr/lib/libXdmcp.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libXdmcp.so.6
Core was generated by `/usr/bin/gs -dQUIET -dPARANOIDSAFER -dNOPAUSE -dBATCH -sDEVICE=cups -sstdout=%s'.
Program terminated with signal 11, Segmentation fault.
#0  ialloc_validate_chunk (cp=<value optimized out>, gcst=0x7fff182f4bc0)
    at ./psi/ilocate.c:322
322		struct_proc_enum_ptrs((*proc)) = pre->o_type->enum_ptrs;
(gdb) bt
#0  ialloc_validate_chunk (cp=<value optimized out>, gcst=0x7fff182f4bc0)
    at ./psi/ilocate.c:322
#1  0x00007fb4014b4da1 in ialloc_validate_memory (mem=0x1ef8de8, 
    gcst=0x7fff182f4bc0) at ./psi/ilocate.c:248
#2  0x00007fb4014b0ac5 in gc_validate_spaces (pspaces=<value optimized out>, 
    global=<value optimized out>) at ./psi/igc.c:145
#3  gs_gc_reclaim (pspaces=<value optimized out>, global=<value optimized out>)
    at ./psi/igc.c:246
#4  0x00007fb40153abe3 in context_reclaim (pspaces=0x1f39d70, 
    global=<value optimized out>) at ./psi/zcontext.c:283
#5  0x00007fb4014756b4 in gs_vmreclaim (dmem=0x1f39d68, space=-1)
    at ./psi/ireclaim.c:153
#6  ireclaim (dmem=0x1f39d68, space=-1) at ./psi/ireclaim.c:75
#7  0x00007fb401470771 in interp_reclaim (pi_ctx_p=0x1ef7348, space=-1)
    at ./psi/interp.c:427
#8  0x00007fb401471e7e in interp (pi_ctx_p=<value optimized out>, 
    pref=<value optimized out>, perror_object=<value optimized out>)
    at ./psi/interp.c:1690
#9  0x00007fb401472b4b in gs_call_interp (pi_ctx_p=0x1ef7348, 
    pref=<value optimized out>, user_errors=<value optimized out>, 
    pexit_code=<value optimized out>, perror_object=0x7fff182f5d60)
    at ./psi/interp.c:496
#10 gs_interpret (pi_ctx_p=0x1ef7348, pref=<value optimized out>, 
    user_errors=<value optimized out>, pexit_code=<value optimized out>, 
---Type <return> to continue, or q <return> to quit---
    perror_object=0x7fff182f5d60) at ./psi/interp.c:454
#11 0x00007fb401465b55 in gs_main_interpret (minst=<value optimized out>, 
    user_errors=0, pexit_code=<value optimized out>, 
    perror_object=0x7fff182f4300) at ./psi/imain.c:214
#12 gs_main_run_string_end (minst=<value optimized out>, user_errors=0, 
    pexit_code=<value optimized out>, perror_object=0x7fff182f4300)
    at ./psi/imain.c:526
#13 0x00007fb401466fbe in run_string (minst=0x37, str=0x2ca89f0 "`A\204\002", 
    options=3) at ./psi/imainarg.c:814
#14 0x00007fb4014677da in runarg (minst=0x1ef72b0, pre=0x7fb4017df1c7 "", 
    arg=<value optimized out>, post=0x7fb40179949a ".runfile", options=3)
    at ./psi/imainarg.c:805
#15 0x00007fb4014692cc in gs_main_init_with_args (minst=0x1ef72b0, argc=22, 
    argv=0x7fff182f6958) at ./psi/imainarg.c:215
#16 0x0000000000400b1c in main ()
(gdb) quit
till@till:~/ghostscript/gpl/testfiles$ 

Hin-Tak's command line works.

Next file: Arioli-NAG-Warwick.pdf

till@till:~/ghostscript/gpl/testfiles$ PPD=/etc/cups/ppd/R220.ppd /usr/bin/gs -dQUIET -dPARANOIDSAFER -dNOPAUSE -dBATCH -sDEVICE=cups -sstdout=%stderr -sOutputFile=%stdout -I/usr/share/cups/fonts -sMediaClass=Standard -sMediaType=Plain -r720x360 -dDEVICEWIDTHPOINTS=595 -dDEVICEHEIGHTPOINTS=842 -dcupsBitsPerColor=8 -dcupsColorOrder=0 -dcupsColorSpace=1 -dcupsRowFeed=5 -scupsPageSizeName=A4 -c -f Arioli-NAG-Warwick.pdf > x 2>log
Segmentation fault (core dumped)
till@till:~/ghostscript/gpl/testfiles$ gdb -c core-gs-25757 /usr/bin/gsGNU gdb (GDB) 7.1-ubuntu
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/bin/gs...(no debugging symbols found)...done.
[New Thread 25757]

warning: Can't read pathname for load map: Input/output error.
Reading symbols from /usr/lib/libgs.so.8...done.
Loaded symbols for /usr/lib/libgs.so.8
Reading symbols from /lib/libc.so.6...(no debugging symbols found)...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /usr/lib/libpaper.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libpaper.so.1
Reading symbols from /usr/lib/libtiff.so.4...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libtiff.so.4
Reading symbols from /usr/lib/libcupsimage.so.2...Reading symbols from /usr/lib/debug/usr/lib/libcupsimage.so.2...(no debugging symbols found)...done.
(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libcupsimage.so.2
Reading symbols from /usr/lib/libcups.so.2...Reading symbols from /usr/lib/debug/usr/lib/libcups.so.2...(no debugging symbols found)...done.
(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libcups.so.2
Reading symbols from /usr/lib/libgssapi_krb5.so.2...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libgssapi_krb5.so.2
Reading symbols from /usr/lib/libgnutls.so.26...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libgnutls.so.26
Reading symbols from /lib/libz.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libz.so.1
Reading symbols from /lib/libpthread.so.0...(no debugging symbols found)...done.
Loaded symbols for /lib/libpthread.so.0
Reading symbols from /lib/libm.so.6...(no debugging symbols found)...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /lib/libcrypt.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libcrypt.so.1
Reading symbols from /lib/libdl.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /usr/lib/libstdc++.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libstdc++.so.6
Reading symbols from /usr/lib/libfontconfig.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libfontconfig.so.1
Reading symbols from /lib64/ld-linux-x86-64.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib64/ld-linux-x86-64.so.2
Reading symbols from /usr/lib/libjpeg.so.62...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libjpeg.so.62
Reading symbols from /lib/libpng12.so.0...(no debugging symbols found)...done.
Loaded symbols for /lib/libpng12.so.0
Reading symbols from /usr/lib/libavahi-common.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libavahi-common.so.3
Reading symbols from /usr/lib/libavahi-client.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libavahi-client.so.3
Reading symbols from /usr/lib/libkrb5.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libkrb5.so.3
Reading symbols from /usr/lib/libk5crypto.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libk5crypto.so.3
Reading symbols from /lib/libcom_err.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/libcom_err.so.2
Reading symbols from /usr/lib/libkrb5support.so.0...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libkrb5support.so.0
Reading symbols from /lib/libkeyutils.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libkeyutils.so.1
Reading symbols from /lib/libresolv.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/libresolv.so.2
Reading symbols from /usr/lib/libtasn1.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libtasn1.so.3
Reading symbols from /lib/libgcrypt.so.11...(no debugging symbols found)...done.
Loaded symbols for /lib/libgcrypt.so.11
Reading symbols from /lib/libgcc_s.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libgcc_s.so.1
Reading symbols from /usr/lib/libfreetype.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libfreetype.so.6
Reading symbols from /lib/libexpat.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libexpat.so.1
Reading symbols from /lib/libdbus-1.so.3...(no debugging symbols found)...done.
Loaded symbols for /lib/libdbus-1.so.3
Reading symbols from /lib/librt.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/librt.so.1
Reading symbols from /lib/libgpg-error.so.0...(no debugging symbols found)...done.
Loaded symbols for /lib/libgpg-error.so.0
Reading symbols from /usr/lib/ghostscript/8.71/X11.so...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/ghostscript/8.71/X11.so
Reading symbols from /usr/lib/libXt.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libXt.so.6
Reading symbols from /usr/lib/libSM.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libSM.so.6
Reading symbols from /usr/lib/libICE.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libICE.so.6
Reading symbols from /usr/lib/libXext.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libXext.so.6
Reading symbols from /usr/lib/libX11.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libX11.so.6
Reading symbols from /lib/libuuid.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libuuid.so.1
Reading symbols from /usr/lib/libxcb.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libxcb.so.1
Reading symbols from /usr/lib/libXau.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libXau.so.6
Reading symbols from /usr/lib/libXdmcp.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libXdmcp.so.6
Core was generated by `/usr/bin/gs -dQUIET -dPARANOIDSAFER -dNOPAUSE -dBATCH -sDEVICE=cups -sstdout=%s'.
Program terminated with signal 11, Segmentation fault.
#0  cmd_put_list_op (cldev=0x8a6298, pcl=0x7f3749fc6620, size=28)
    at ./base/gxclutil.c:263
263			pcl->tail->size > dp - (byte *) (pcl->tail + 1)
(gdb) bt
#0  cmd_put_list_op (cldev=0x8a6298, pcl=0x7f3749fc6620, size=28)
    at ./base/gxclutil.c:263
#1  0x00007f37495062b8 in cmd_write_unknown (cldev=0x8a6298, 
    pcls=0x7f3749fc6468, must_know=<value optimized out>)
    at ./base/gxclpath.c:479
#2  0x00007f3749507d2d in clist_stroke_path (dev=0x8a6298, pis=0x840e88, 
    ppath=0x85d7e0, params=<value optimized out>, pdcolor=0x9fff60, 
    pcpath=0x9ffde0) at ./base/gxclpath.c:899
#3  0x00007f37496c2d1f in gx_stroke_fill (ppath=0x85d7e0, pgs=0x840e88)
    at ./base/gxpaint.c:65
#4  0x00007f3749684e62 in gs_stroke (pgs=0x840e88) at ./base/gspaint.c:458
#5  0x00007f37493d59bd in call_operator (pi_ctx_p=<value optimized out>, 
    pref=<value optimized out>, perror_object=<value optimized out>)
    at ./psi/interp.c:111
#6  interp (pi_ctx_p=<value optimized out>, pref=<value optimized out>, 
    perror_object=<value optimized out>) at ./psi/interp.c:1275
#7  0x00007f37493d6b4b in gs_call_interp (pi_ctx_p=0x81a348, 
    pref=<value optimized out>, user_errors=<value optimized out>, 
    pexit_code=<value optimized out>, perror_object=0x7fff04d29280)
    at ./psi/interp.c:496
#8  gs_interpret (pi_ctx_p=0x81a348, pref=<value optimized out>, 
    user_errors=<value optimized out>, pexit_code=<value optimized out>, 
    perror_object=0x7fff04d29280) at ./psi/interp.c:454
#9  0x00007f37493c9b55 in gs_main_interpret (minst=<value optimized out>, 
---Type <return> to continue, or q <return> to quit---
    user_errors=110300060, pexit_code=<value optimized out>, 
    perror_object=0x380) at ./psi/imain.c:214
#10 gs_main_run_string_end (minst=<value optimized out>, 
    user_errors=110300060, pexit_code=<value optimized out>, 
    perror_object=0x380) at ./psi/imain.c:526
#11 0x00007f37493cafbe in run_string (minst=0x8a6298, 
    str=0x7f3749fc6620 "\325\"\002\004\331\060\307'\234\v\223\006\232\025\332\337\004\002\t", options=3) at ./psi/imainarg.c:814
#12 0x00007f37493cb7da in runarg (minst=0x81a2b0, pre=0x7f37497431c7 "", 
    arg=<value optimized out>, post=0x7f37496fd49a ".runfile", options=3)
    at ./psi/imainarg.c:805
#13 0x00007f37493cd2cc in gs_main_init_with_args (minst=0x81a2b0, argc=22, 
    argv=0x7fff04d29e78) at ./psi/imainarg.c:215
#14 0x0000000000400b1c in main ()
(gdb) quit
till@till:~/ghostscript/gpl/testfiles$ 

End of "log"/stderr:

[...]
DEBUG2: cups_map_cmyk(0x8a6298, 0, 0, 0, 0, 0x7fff04d28270)
DEBUG2:   \=== COLOR 32760, 32760, 32760
DEBUG2: cv[0]=65535 -> ffffff
DEBUG2: cups_map_cmyk(0x8a6298, 0, 0, 0, 0, 0x7fff04d28270)
DEBUG2:   \=== COLOR 32760, 32760, 32760
DEBUG2: cv[0]=65535 -> ffffff
DEBUG2: cups_map_cmyk(0x8a6298, 3279, 15068, 0, 22906, 0x7fff04d281b0)
DEBUG2:   \=== COLOR 6575, 0, 9854
DEBUG2: cv[0]=13153 -> 33004d

Hin-Tak's command line seems also to work for this file.

Next file: launch_leaflet.pdf


till@till:~/ghostscript/gpl/testfiles$ PPD=/etc/cups/ppd/R220.ppd /usr/bin/gs -dQUIET -dPARANOIDSAFER -dNOPAUSE -dBATCH -sDEVICE=cups -sstdout=%stderr -sOutputFile=%stdout -I/usr/share/cups/fonts -sMediaClass=Standard -sMediaType=Plain -r720x360 -dDEVICEWIDTHPOINTS=595 -dDEVICEHEIGHTPOINTS=842 -dcupsBitsPerColor=8 -dcupsColorOrder=0 -dcupsColorSpace=1 -dcupsRowFeed=5 -scupsPageSizeName=A4 -c -f launch_leaflet.pdf > x 2>log
Segmentation fault (core dumped)
till@till:~/ghostscript/gpl/testfiles$ rasterview x
till@till:~/ghostscript/gpl/testfiles$ ll ~/tmp/gs
total 38012
-rw------- 1 till till 38916096 2010-03-30 23:37 core-gs-23760
till@till:~/ghostscript/gpl/testfiles$ ll core*
-rw------- 1 till till 26857472 2010-03-11 13:51 core
-rw------- 1 till till 33660928 2010-03-30 23:29 core-gs-23496
-rw------- 1 till till 33693696 2010-03-30 23:38 core-gs-23960
-rw------- 1 till till 33579008 2010-03-30 23:59 core-gs-24722
-rw------- 1 till till 42926080 2010-03-31 00:11 core-gs-24974
-rw------- 1 till till 32354304 2010-03-31 00:24 core-gs-25757
-rw------- 1 till till 32010240 2010-03-31 00:38 core-gs-26186
till@till:~/ghostscript/gpl/testfiles$ gdb -c core-gs-26186 /usr/bin/gs
GNU gdb (GDB) 7.1-ubuntu
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/bin/gs...(no debugging symbols found)...done.
[New Thread 26186]

warning: Can't read pathname for load map: Input/output error.
Reading symbols from /usr/lib/libgs.so.8...done.
Loaded symbols for /usr/lib/libgs.so.8
Reading symbols from /lib/libc.so.6...(no debugging symbols found)...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /usr/lib/libpaper.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libpaper.so.1
Reading symbols from /usr/lib/libtiff.so.4...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libtiff.so.4
Reading symbols from /usr/lib/libcupsimage.so.2...Reading symbols from /usr/lib/debug/usr/lib/libcupsimage.so.2...(no debugging symbols found)...done.
(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libcupsimage.so.2
Reading symbols from /usr/lib/libcups.so.2...Reading symbols from /usr/lib/debug/usr/lib/libcups.so.2...(no debugging symbols found)...done.
(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libcups.so.2
Reading symbols from /usr/lib/libgssapi_krb5.so.2...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libgssapi_krb5.so.2
Reading symbols from /usr/lib/libgnutls.so.26...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libgnutls.so.26
Reading symbols from /lib/libz.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libz.so.1
Reading symbols from /lib/libpthread.so.0...(no debugging symbols found)...done.
Loaded symbols for /lib/libpthread.so.0
Reading symbols from /lib/libm.so.6...(no debugging symbols found)...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /lib/libcrypt.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libcrypt.so.1
Reading symbols from /lib/libdl.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /usr/lib/libstdc++.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libstdc++.so.6
Reading symbols from /usr/lib/libfontconfig.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libfontconfig.so.1
Reading symbols from /lib64/ld-linux-x86-64.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib64/ld-linux-x86-64.so.2
Reading symbols from /usr/lib/libjpeg.so.62...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libjpeg.so.62
Reading symbols from /lib/libpng12.so.0...(no debugging symbols found)...done.
Loaded symbols for /lib/libpng12.so.0
Reading symbols from /usr/lib/libavahi-common.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libavahi-common.so.3
Reading symbols from /usr/lib/libavahi-client.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libavahi-client.so.3
Reading symbols from /usr/lib/libkrb5.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libkrb5.so.3
Reading symbols from /usr/lib/libk5crypto.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libk5crypto.so.3
Reading symbols from /lib/libcom_err.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/libcom_err.so.2
Reading symbols from /usr/lib/libkrb5support.so.0...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libkrb5support.so.0
Reading symbols from /lib/libkeyutils.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libkeyutils.so.1
Reading symbols from /lib/libresolv.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/libresolv.so.2
Reading symbols from /usr/lib/libtasn1.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libtasn1.so.3
Reading symbols from /lib/libgcrypt.so.11...(no debugging symbols found)...done.
Loaded symbols for /lib/libgcrypt.so.11
Reading symbols from /lib/libgcc_s.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libgcc_s.so.1
Reading symbols from /usr/lib/libfreetype.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libfreetype.so.6
Reading symbols from /lib/libexpat.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libexpat.so.1
Reading symbols from /lib/libdbus-1.so.3...(no debugging symbols found)...done.
Loaded symbols for /lib/libdbus-1.so.3
Reading symbols from /lib/librt.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/librt.so.1
Reading symbols from /lib/libgpg-error.so.0...(no debugging symbols found)...done.
Loaded symbols for /lib/libgpg-error.so.0
Reading symbols from /usr/lib/ghostscript/8.71/X11.so...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/ghostscript/8.71/X11.so
Reading symbols from /usr/lib/libXt.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libXt.so.6
Reading symbols from /usr/lib/libSM.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libSM.so.6
Reading symbols from /usr/lib/libICE.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libICE.so.6
Reading symbols from /usr/lib/libXext.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libXext.so.6
Reading symbols from /usr/lib/libX11.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libX11.so.6
Reading symbols from /lib/libuuid.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libuuid.so.1
Reading symbols from /usr/lib/libxcb.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libxcb.so.1
Reading symbols from /usr/lib/libXau.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libXau.so.6
Reading symbols from /usr/lib/libXdmcp.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libXdmcp.so.6
Core was generated by `/usr/bin/gs -dQUIET -dPARANOIDSAFER -dNOPAUSE -dBATCH -sDEVICE=cups -sstdout=%s'.
Program terminated with signal 11, Segmentation fault.
#0  ialloc_validate_chunk (cp=<value optimized out>, gcst=0x7fff81b6d340)
    at ./psi/ilocate.c:322
322		struct_proc_enum_ptrs((*proc)) = pre->o_type->enum_ptrs;
(gdb) bt
#0  ialloc_validate_chunk (cp=<value optimized out>, gcst=0x7fff81b6d340)
    at ./psi/ilocate.c:322
#1  0x00007fc8caaabda1 in ialloc_validate_memory (mem=0x1e81de8, 
    gcst=0x7fff81b6d340) at ./psi/ilocate.c:248
#2  0x00007fc8caaa7ac5 in gc_validate_spaces (pspaces=<value optimized out>, 
    global=<value optimized out>) at ./psi/igc.c:145
#3  gs_gc_reclaim (pspaces=<value optimized out>, global=<value optimized out>)
    at ./psi/igc.c:246
#4  0x00007fc8cab31be3 in context_reclaim (pspaces=0x1ec2d70, 
    global=<value optimized out>) at ./psi/zcontext.c:283
#5  0x00007fc8caa6c6b4 in gs_vmreclaim (dmem=0x1ec2d68, space=-1)
    at ./psi/ireclaim.c:153
#6  ireclaim (dmem=0x1ec2d68, space=-1) at ./psi/ireclaim.c:75
#7  0x00007fc8caa67771 in interp_reclaim (pi_ctx_p=0x1e80348, space=-1)
    at ./psi/interp.c:427
#8  0x00007fc8caa68e7e in interp (pi_ctx_p=<value optimized out>, 
    pref=<value optimized out>, perror_object=<value optimized out>)
    at ./psi/interp.c:1690
#9  0x00007fc8caa69b4b in gs_call_interp (pi_ctx_p=0x1e80348, 
    pref=<value optimized out>, user_errors=<value optimized out>, 
    pexit_code=<value optimized out>, perror_object=0x7fff81b6e4e0)
    at ./psi/interp.c:496
#10 gs_interpret (pi_ctx_p=0x1e80348, pref=<value optimized out>, 
    user_errors=<value optimized out>, pexit_code=<value optimized out>, 
---Type <return> to continue, or q <return> to quit---
    perror_object=0x7fff81b6e4e0) at ./psi/interp.c:454
#11 0x00007fc8caa5cb55 in gs_main_interpret (minst=<value optimized out>, 
    user_errors=0, pexit_code=<value optimized out>, 
    perror_object=0x7fff81b6ca80) at ./psi/imain.c:214
#12 gs_main_run_string_end (minst=<value optimized out>, user_errors=0, 
    pexit_code=<value optimized out>, perror_object=0x7fff81b6ca80)
    at ./psi/imain.c:526
#13 0x00007fc8caa5dfbe in run_string (minst=0x37, 
    str=0x2009890 "\030\275\361\001", options=3) at ./psi/imainarg.c:814
#14 0x00007fc8caa5e7da in runarg (minst=0x1e802b0, pre=0x7fc8cadd61c7 "", 
    arg=<value optimized out>, post=0x7fc8cad9049a ".runfile", options=3)
    at ./psi/imainarg.c:805
#15 0x00007fc8caa602cc in gs_main_init_with_args (minst=0x1e802b0, argc=22, 
    argv=0x7fff81b6f0d8) at ./psi/imainarg.c:215
#16 0x0000000000400b1c in main ()
(gdb) quit
till@till:~/ghostscript/gpl/testfiles$ 


end of "log"/stderr:


DEBUG2: Scanline 4208; src 0x2565d90; srcptr 0x7fc8cb66f9c2; procs: 0x7fc8cb371b
60 0x1f0c6c0
DEBUG2: XXX50 0x1f0c298
DEBUG2: cv[0]=0 -> 0
DEBUG2: cv[0]=65535 -> ff0000
DEBUG2: cv[0]=0 -> ffff
DEBUG2: cv[0]=0 -> ff00
DEBUG2: cv[0]=65535 -> ff00ff
DEBUG2: cv[0]=0 -> ff
DEBUG2: cv[0]=65535 -> ffff00
DEBUG2: cups_get_matrix(0x1f0c298, 0x2037e50)
DEBUG2: Landscape matrix: XX=0 XY=+1 YX=+1 YY=0
DEBUG2: width = 5950, height = 4210
DEBUG2: PageSize = [ 842 595 ], HWResolution = [ 720 360 ]
DEBUG2: HWMargins = [ 0.000 0.000 0.000 0.000 ]
DEBUG2: matrix = [ 0.000 5.000 10.000 0.000 -0.000 -0.000 ]
ERROR: XXX1 code 0 dev 0x1f0c298 dev->procs 0x7fc8cab9cc50 dev->procs.get_bits_rectangle 0x7fc8cad723e0  gx_default_get_bits_rectangle 0x7fc8cad70b60 gx_no_get_bits_rectangle 0x7fc8cab7ff00
DEBUG2: Scanline 4209; src 0x2565d90; srcptr 0x7fc8cb673f82; procs: 0x7fc8cb371b60 0x1f0c6c0
INFO: Processing page 2...
DEBUG2: cv[0]=0 -> 0
DEBUG2: cv[0]=65535 -> ff0000
DEBUG2: cv[0]=0 -> ffff
DEBUG2: cv[0]=0 -> ff00
DEBUG2: cv[0]=65535 -> ff00ff
DEBUG2: cv[0]=0 -> ff
DEBUG2: cv[0]=65535 -> ffff00
DEBUG2: cups_get_matrix(0x1f0c298, 0x7fff81b6d430)
DEBUG2: Landscape matrix: XX=0 XY=+1 YX=+1 YY=0
DEBUG2: width = 5950, height = 4210
DEBUG2: PageSize = [ 842 595 ], HWResolution = [ 720 360 ]
DEBUG2: HWMargins = [ 0.000 0.000 0.000 0.000 ]
DEBUG2: matrix = [ 0.000 5.000 10.000 0.000 -0.000 -0.000 ]


Hin-Tak's command line renders the file completely.

Next file: CImg_flyer.pdf


till@till:~/ghostscript/gpl/testfiles$ PPD=/etc/cups/ppd/R220.ppd /usr/bin/gs -dQUIET -dPARANOIDSAFER -dNOPAUSE -dBATCH -sDEVICE=cups -sstdout=%stderr -sOutputFile=%stdout -I/usr/share/cups/fonts -sMediaClass=Standard -sMediaType=Plain -r720x360 -dDEVICEWIDTHPOINTS=595 -dDEVICEHEIGHTPOINTS=842 -dcupsBitsPerColor=8 -dcupsColorOrder=0 -dcupsColorSpace=1 -dcupsRowFeed=5 -scupsPageSizeName=A4 -c -f CImg_flyer.pdf > x 2>log
Segmentation fault (core dumped)
till@till:~/ghostscript/gpl/testfiles$ ll core*
-rw------- 1 till till 26857472 2010-03-11 13:51 core
-rw------- 1 till till 33660928 2010-03-30 23:29 core-gs-23496
-rw------- 1 till till 33693696 2010-03-30 23:38 core-gs-23960
-rw------- 1 till till 33579008 2010-03-30 23:59 core-gs-24722
-rw------- 1 till till 42926080 2010-03-31 00:11 core-gs-24974
-rw------- 1 till till 32354304 2010-03-31 00:24 core-gs-25757
-rw------- 1 till till 32010240 2010-03-31 00:38 core-gs-26186
-rw------- 1 till till 32800768 2010-03-31 00:52 core-gs-27320
till@till:~/ghostscript/gpl/testfiles$ gdb -c core-gs-27320 /usr/bin/gs
GNU gdb (GDB) 7.1-ubuntu
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/bin/gs...(no debugging symbols found)...done.
[New Thread 27320]

warning: Can't read pathname for load map: Input/output error.
Reading symbols from /usr/lib/libgs.so.8...done.
Loaded symbols for /usr/lib/libgs.so.8
Reading symbols from /lib/libc.so.6...(no debugging symbols found)...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /usr/lib/libpaper.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libpaper.so.1
Reading symbols from /usr/lib/libtiff.so.4...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libtiff.so.4
Reading symbols from /usr/lib/libcupsimage.so.2...Reading symbols from /usr/lib/debug/usr/lib/libcupsimage.so.2...(no debugging symbols found)...done.
(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libcupsimage.so.2
Reading symbols from /usr/lib/libcups.so.2...Reading symbols from /usr/lib/debug/usr/lib/libcups.so.2...(no debugging symbols found)...done.
(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libcups.so.2
Reading symbols from /usr/lib/libgssapi_krb5.so.2...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libgssapi_krb5.so.2
Reading symbols from /usr/lib/libgnutls.so.26...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libgnutls.so.26
Reading symbols from /lib/libz.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libz.so.1
Reading symbols from /lib/libpthread.so.0...(no debugging symbols found)...done.
Loaded symbols for /lib/libpthread.so.0
Reading symbols from /lib/libm.so.6...(no debugging symbols found)...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /lib/libcrypt.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libcrypt.so.1
Reading symbols from /lib/libdl.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /usr/lib/libstdc++.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libstdc++.so.6
Reading symbols from /usr/lib/libfontconfig.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libfontconfig.so.1
Reading symbols from /lib64/ld-linux-x86-64.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib64/ld-linux-x86-64.so.2
Reading symbols from /usr/lib/libjpeg.so.62...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libjpeg.so.62
Reading symbols from /lib/libpng12.so.0...(no debugging symbols found)...done.
Loaded symbols for /lib/libpng12.so.0
Reading symbols from /usr/lib/libavahi-common.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libavahi-common.so.3
Reading symbols from /usr/lib/libavahi-client.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libavahi-client.so.3
Reading symbols from /usr/lib/libkrb5.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libkrb5.so.3
Reading symbols from /usr/lib/libk5crypto.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libk5crypto.so.3
Reading symbols from /lib/libcom_err.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/libcom_err.so.2
Reading symbols from /usr/lib/libkrb5support.so.0...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libkrb5support.so.0
Reading symbols from /lib/libkeyutils.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libkeyutils.so.1
Reading symbols from /lib/libresolv.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/libresolv.so.2
Reading symbols from /usr/lib/libtasn1.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libtasn1.so.3
Reading symbols from /lib/libgcrypt.so.11...(no debugging symbols found)...done.
Loaded symbols for /lib/libgcrypt.so.11
Reading symbols from /lib/libgcc_s.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libgcc_s.so.1
Reading symbols from /usr/lib/libfreetype.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libfreetype.so.6
Reading symbols from /lib/libexpat.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libexpat.so.1
Reading symbols from /lib/libdbus-1.so.3...(no debugging symbols found)...done.
Loaded symbols for /lib/libdbus-1.so.3
Reading symbols from /lib/librt.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/librt.so.1
Reading symbols from /lib/libgpg-error.so.0...(no debugging symbols found)...done.
Loaded symbols for /lib/libgpg-error.so.0
Reading symbols from /usr/lib/ghostscript/8.71/X11.so...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/ghostscript/8.71/X11.so
Reading symbols from /usr/lib/libXt.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libXt.so.6
Reading symbols from /usr/lib/libSM.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libSM.so.6
Reading symbols from /usr/lib/libICE.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libICE.so.6
Reading symbols from /usr/lib/libXext.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libXext.so.6
Reading symbols from /usr/lib/libX11.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libX11.so.6
Reading symbols from /lib/libuuid.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libuuid.so.1
Reading symbols from /usr/lib/libxcb.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libxcb.so.1
Reading symbols from /usr/lib/libXau.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libXau.so.6
Reading symbols from /usr/lib/libXdmcp.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libXdmcp.so.6
Core was generated by `/usr/bin/gs -dQUIET -dPARANOIDSAFER -dNOPAUSE -dBATCH -sDEVICE=cups -sstdout=%s'.
Program terminated with signal 11, Segmentation fault.
#0  cmd_put_list_op (cldev=0x1af3298, pcl=0x7f9e67558620, size=28)
    at ./base/gxclutil.c:263
263			pcl->tail->size > dp - (byte *) (pcl->tail + 1)
(gdb) bt
#0  cmd_put_list_op (cldev=0x1af3298, pcl=0x7f9e67558620, size=28)
    at ./base/gxclutil.c:263
#1  0x00007f9e66a982b8 in cmd_write_unknown (cldev=0x1af3298, 
    pcls=0x7f9e67558468, must_know=<value optimized out>)
    at ./base/gxclpath.c:479
#2  0x00007f9e66a99d2d in clist_stroke_path (dev=0x1af3298, pis=0x1a8de88, 
    ppath=0x1aaa8e0, params=<value optimized out>, pdcolor=0x1c55438, 
    pcpath=0x1c552b8) at ./base/gxclpath.c:899
#3  0x00007f9e66c54d1f in gx_stroke_fill (ppath=0x1aaa8e0, pgs=0x1a8de88)
    at ./base/gxpaint.c:65
#4  0x00007f9e66c16e62 in gs_stroke (pgs=0x1a8de88) at ./base/gspaint.c:458
#5  0x00007f9e669679bd in call_operator (pi_ctx_p=<value optimized out>, 
    pref=<value optimized out>, perror_object=<value optimized out>)
    at ./psi/interp.c:111
#6  interp (pi_ctx_p=<value optimized out>, pref=<value optimized out>, 
    perror_object=<value optimized out>) at ./psi/interp.c:1275
#7  0x00007f9e66968b4b in gs_call_interp (pi_ctx_p=0x1a67348, 
    pref=<value optimized out>, user_errors=<value optimized out>, 
    pexit_code=<value optimized out>, perror_object=0x7fff0e11c980)
    at ./psi/interp.c:496
#8  gs_interpret (pi_ctx_p=0x1a67348, pref=<value optimized out>, 
    user_errors=<value optimized out>, pexit_code=<value optimized out>, 
    perror_object=0x7fff0e11c980) at ./psi/interp.c:454
#9  0x00007f9e6695bb55 in gs_main_interpret (minst=<value optimized out>, 
---Type <return> to continue, or q <return> to quit---
    user_errors=-1041891328, pexit_code=<value optimized out>, 
    perror_object=0x380) at ./psi/imain.c:214
#10 gs_main_run_string_end (minst=<value optimized out>, 
    user_errors=-1041891328, pexit_code=<value optimized out>, 
    perror_object=0x380) at ./psi/imain.c:526
#11 0x00007f9e6695cfbe in run_string (minst=0x1af3298, 
    str=0x7f9e67558620 "\337\004\002\t", options=3) at ./psi/imainarg.c:814
#12 0x00007f9e6695d7da in runarg (minst=0x1a672b0, pre=0x7f9e66cd51c7 "", 
    arg=<value optimized out>, post=0x7f9e66c8f49a ".runfile", options=3)
    at ./psi/imainarg.c:805
#13 0x00007f9e6695f2cc in gs_main_init_with_args (minst=0x1a672b0, argc=22, 
    argv=0x7fff0e11d578) at ./psi/imainarg.c:215
#14 0x0000000000400b1c in main ()
(gdb) quit
till@till:~/ghostscript/gpl/testfiles$ 


End of "log"/stderr:

[...]
DEBUG2: cups_map_rgb(0x1af3298, 0x1a8de88, 0, 0, 0, 0x7fff0e11b860)
DEBUG2: cups_map_cmyk(0x1af3298, 0, 0, 0, 32760, 0x7fff0e11b860)
DEBUG2:   \=== COLOR 0, 0, 0
DEBUG2: cv[0]=0 -> 0
DEBUG2: cups_map_rgb(0x1af3298, 0x1a8de88, 0, 0, 0, 0x7fff0e11b860)
DEBUG2: cups_map_cmyk(0x1af3298, 0, 0, 0, 32760, 0x7fff0e11b860)
DEBUG2:   \=== COLOR 0, 0, 0
DEBUG2: cv[0]=0 -> 0
DEBUG2: cups_map_rgb(0x1af3298, 0x1a8de88, 28906, 23253, 3340, 0x7fff0e11b8b0)
DEBUG2: cups_map_cmyk(0x1af3298, 3788, 9441, 29354, 66, 0x7fff0e11b8b0)
DEBUG2:   \=== COLOR 28906, 23253, 3340
DEBUG2: cv[0]=57826 -> e1b51a


Hin-Tak's command line works (needing several minutes for this one page).

Summary of the five example files:

One of them (launch_leaflet.pdf) shows an stderr output like the other files on which this bug was originally reported. It most probably fails due to the same problem.

The other four files seem to fail for another reason, but all for the same reason. Even if this is another bug, this probalem also needs to get fixed so that reliable printing gets possible.

Alex, Ken, Ray - let me know if there is anything else that can be done from this end, eg testing an updated subversion revision, or if it would help for some bug analysis here.

If the fix makes it out in the next couple of weeks and can be backported to ghostscript 7.71, there is fair chance we can get it into the late April release of Ubuntu 10.04 LTS, which would be a huge benefit. Thanks - Daniel

Here is some background info. I hope this helps to fix the bug.

This driver (cups/gdevcups.c, "cups" output device) is for creating the CUPS Raster format (http://www.cups.org/documentation.php/doc-1.4/spec-raster.html) which is a printing-oriented, device-independent bitmap format and serves as input data format for many printer drivers for CUPS, like Gutenprint, HPLIP, ...

The driver generates the CUPS Raster format using libcupsimage, a library which is part of CUPS. To use this library it uses the CUPS Raster API (http://www.cups.org/documentation.php/doc-1.4/api-raster.html, see also the installed file /usr/include/cups/raster.h).

The CUPS Raster output device reads the PPD file whose path is supplied by the PPD environment variable. It uses the PPD for reading some constant, printer-specific parameters (not settings of user-settable options). These parameters are

*cupsManualCopies:  -->  cupsPPD->manual_copies
   Tells whether the driver has to do multiple copies
   "manually" by repeatedly sending the page bitmaps

*cupsBackSide:  --> ppdFindAttr(cupsPPD, "cupsBackSide", NULL)
   Orientation of the back side bitmaps when printing duplex, some
   drivers need them mirrored or upside-down.

*cupsFlipDuplex:  -->  cupsPPD->flip_duplex
   Predecessor of *cupsBackSide:, tells whether the backside bitmaps for duplex 
   jobs have to be sent upside-down.

*APDuplexRequiresFlippedMargin: -->
   ppdFindAttr(cupsPPD, "APDuplexRequiresFlippedMargin", NULL)
   Tells whether the unprintable margins need to get swapped for the
   back sides of Duplex jobs

*ImageableArea:/*PaperDimension:  -->
   cupsPPD->num_sizes/cupsPPD->sizes
   Actual paper sizes and unprintable margins

*HWMargins:  -->  cupsPPD->custom_margins
   Unprintable margins for custom paper sizes

*cupsColorProfile  -->
   cupsPPD->num_profiles/cupsPPD->profiles
   Simple color correction scheme, consisting of brightness, gamma, and
   a 3x3 matrix which transforms incoming RGB to the RGB sent to the printer.
   The data can be easily generated with the cups-calibrate command line
   utility.

After the "-->" you can always see the way how this parameter is accessed in cups/gdevcups.c

More info you find on

http://www.cups.org/documentation.php/doc-1.4/spec-ppd.html

In addition, several PostScript variables are set to control the driver based on the settings of the user-settable options. If PDF is the input, the filter cups/pdftoraster.c is used which sets the PostScript variables via the Ghostscript command line. If PostScript is the input format CUPS calls pstops at first which sets the variable by inserting appropriate PostScript code into the PostScript input. After that Ghostscript is called via the cups/pstoraster wrapper.

A list of these variables you find as

Table 2: Supported Page Device Attributes

in

http://www.cups.org/documentation.php/doc-1.4/spec-ppd.html

With:

gs -r720x360 -sDEVICE=cups -dBATCH -dNOPAUSE \
-sOutputFile=/tmp/a.out 'bugs.ghostscript.com/attachment.cgi?id=6022&action=view' 

It segfaults as in comment 30, with these message hidding among all the DEBUG...:

No encode_color proc defined for device.
No get_color_comp_index proc defined for device.
GPL Ghostscript SVN PRE-RELEASE 8.72: pdf14_compressed_encode_color devn_params not from pdf14 device, device = 'cups'

Adding "-dcupsBitsPerColor=8", gives a postscript error:

No get_color_comp_index proc defined for device.
GPL Ghostscript SVN PRE-RELEASE 8.72: pdf14_compressed_encode_color devn_params not from pdf14 device, device = 'cups'
No get_color_comp_index proc defined for device.
ERROR: Unable to get scanline 1225!
Error: /unknownerror in --showpage--

cupsBitsPerColor defaults to 1, I think.

The segfault I got in comment 30 is apparently because the pattern is null in gx_pattern_load(). Now why would pdc->ccolor.pattern not initialized?


/* Reload a (non-null) Pattern color into the cache. */
/* *pdc is already set, except for colors.pattern.p_tile and mask.m_tile. */

gx_pattern_load(gx_device_color * pdc, ...):
gs_pattern1_instance_t *pinst =
        (gs_pattern1_instance_t *)pdc->ccolor.pattern;

I see a segmentation fault using the command line Hin-Tak suggested in comment
30.

Firstly, pinst does not appear to contain a fully filled in pattern instance
object - it appears that the data is not being transfered to the pattern
instance once it's read from the clist.

Secondly, the primary cause of the segmentation fault is that when called
(through a couple of intermediate functions) from clist_playback_band(),
gx_pattern_accum_alloc() pinst->saved is unintialised but is expected to be a
graphics state object, since this is post-clist, however, there isn't a
graphics state available (there is an imager state, however).

It looks like a similar problem (lacking a graphics state) has been addressed
before, around line 1819 in gsptype1.c - gx_dc_pattern_read().

My naive attempts to implement a similar solution result in other problems, but
the above might of use.

(In reply to comment #43)
> It looks like a similar problem (lacking a graphics state) has been addressed
> before, around line 1819 in gsptype1.c - gx_dc_pattern_read().

Argh, I came across that part as well, while grep'ping through the source for other uses of pattern_load() and have tried something along the line of faking the graphic state somewhat blindly immitating what that few lines do, without success. Unfortunately the commit which introduces the workaround in line 1819 is extremely large (r8655) and not the easiest to understand, and its author isn't with Artifex anymore for consultation about how he decide what he did and how he did it.

Maybe somebody more familiar with the graphic state can populate a made-up one more properly?

(In reply to comment #42)
> The segfault I got in comment 30 is apparently because the pattern is null in
> gx_pattern_load(). Now why would pdc->ccolor.pattern not initialized?
>

As I understand it the band playback code expects the pattern to be in the
cache.  There is a pattern in the cache (with the same id) when the problem
occurs.  But the cache lookup fails because it thinks it looking for an 8 bit
pattern and in fact a 1 bit pattern was put in the pattern cache.

The issue is reproducible in an artifex device by forcing the pdf14 device to custom. 
Have pdf14_determine_default_blend_cs() return PDF14_DeviceCustom and use a one
bit monochrome device:

./gs -r600 -sDEVICE=bit -sOutputFile=foo.ppm
~/Downloads/CityMap-evince-pdftopdf.pdf

That will produce exactly the same problem.


As for the full color problem that can be reproduced without changing the code
at all:

./gs -r600 -sDEVICE=ppmraw -sOutputFile=foo.ppm
~/Downloads/CityMap-evince-pdftopdf.pdf 

produces an error just like cups, once again there is a problem band playback easily seen with -Z#.  This doesn't seem to be cups issue at all.

That's a question from Henry on IRC - where it crashes for me, pinst is not gabbage but null:

    at ./base/gxpcmap.c:190
190	    gx_device *tdev = pinst->saved->device;

(gdb) p pinst
$1 = (gs_pattern1_instance_t *) 0x0

Created attachment 6210 [details]
CityMap-evince.simplified.pdf

I simplified CityMap-evince.pdf.
The error I am seeing is "/unknownerror in --showpage--", and this file still produces it for me.  Please tell me if this is not what you are looking for.

The command line used:

bin/gs -r600 -sDEVICE=ppmraw -sOutputFile=foo.pbm CityMap-evince.simplified.pdf

Tracked down the source of the error in the ppmraw case in the simplified file.  Need someone to test CUPs printing case to see if this fixes the issue.  Problem was caused by the fact that we had a soft mask present and a pattern with no transparency.  This means the PDF14 device is installed and more importantly that transparency state pushes and pops occur to keep the softmask in sync with the graphic state.  This particular files pattern is installed as a clist, which happens to not have any transparency.  The transparency state pushes and pops were getting placed into the pattern clist when the Q and q operations occurred in the pattern, which was causing problems since the pattern clist device had no pdf14 device installed to handle such commands.  

The solution was to check when a transparency state push or pop occurs if the current device is a pattern accumulator or a pattern-clist device.  If it is, then the pattern instance is checked to see if it has transparency.  If it does not, then the transparency state chance is ignored.  Attaching a patch for testing.

Created attachment 6221 [details]
A patch for testing

Here is the patch if someone will test the CUPS device with this.

(In reply to comment #49)
> Created an attachment (id=6221) [details]
> A patch for testing
> 
> Here is the patch if someone will test the CUPS device with this.

Thanks for catching this Michael, I certainly would have struggled a long time to find it, it seems to work okay in cups for the simplified test case but the original file still fails, the line in your patch that sets is_patt_acum is not correct - you just duplicated the the string above: "pattern-clist".  I'm fairly sure that is the source of the remaining problem.

Created attachment 6222 [details]
Updated patch

New patch to fix goof pointed out by Henry is previous patch.  Thanks Henry.

After applying the patch and going out to a ppmraw device at -r360 with  CityMap-evince.pdf (2nd attachment), there is an access violation in zfapi.c at line 1342,  pdata->BuildChar is bogus.  This happens RIGHT before the clist writing phase is about to finish.  Faking the debugger through this access violation and pushing on through the reading phase, the file now has a begin transparency group command that is getting put into the pattern clist.  This is causing an error since that pattern has no transparency.  

Kens,  if you can replicate the font issue and fix that, I can figure out why the begin group is ending up in the pattern clist, though off the top of my head I can't think of why. Maybe after a nights rest.....

Michael I think Henry mentioned on IRC that he'd had a FAPI problem with this file but didn't elaborate. There has been an issue reported by Marcos about a crash using FAPI that neither Chris nor I has been able to reproduce to date, this could well be related.

I'll look into it, but in the meantime I suggest running with -dDisableFAPI=true which will restore the Ghostscript internal font rendering and should allow you to check the result without worrying about FreeType.

Look encouraging - I'll give it a try in about 14 hours' time.

I'm afraid I'm unable to reproduce either the working result or the zfapi.c failure. I've updated my copy of GS trunk, applied Michael's patch (attachment 10 [details], "Updated patch"), cleaned and rebuilt.

Ran the Windows debug (GUI) version with -sDEVICE=ppmraw -r360 and I don't get an access violation, but I do still get an unknownerror in showpage.

Also tried release version GUI and command line with the same result. All on Windows so far, all using the file CityMap-evince.pdf, attachment 2 [details], 217Kb.

Hmm, and I can't get my Linux Ghostscript to build, keeps falling over on FreeType compilation. I'll get back to this on Monday.

(In reply to comment #56)
> Hmm, and I can't get my Linux Ghostscript to build, keeps falling over on
> FreeType compilation. I'll get back to this on Monday.

I have a linux debug binary with timestamp '2010-04-23 02:35' and I keep my tree in sysn so it should be r11102 . the only change after that which might break is r11113 . Anyway, I'll the patch a try in about 12 hours, so whenever doesn't build will get looked at about then.

(In reply to comment #56)
> Hmm, and I can't get my Linux Ghostscript to build, keeps falling over on
> FreeType compilation. I'll get back to this on Monday.

I tried the file (both 32 and 64 bit Linux builds) and I could not reproduce a crash in the FAPI code. However, valgrind lists "Conditional jump or move depends on uninitialised value(s)" in zFAPIrebuildfont() and then use of an unitialised value in names_index() after a call from zFAPIrebuildfont(). This seems to be around where we decide whether we've already replaced the BuildChar/BuildGlyph procedure(s) with the FAPI one.

A bit of a guess, but I'd hazard this is related to the crash Michael saw. It is also hopefully the source of Bug 691257 which Marcos reported, but neither Ken nor I could reproduce with that file.

I've got a couple of ideas how to fix this, so I'll probably have something to commit on Monday.

Created attachment 6224 [details]
A new and improved patch.

With this patch CityMap-envice.pdf should work fine.  The only hiccup I have is the access violation issue in the font code.  Very repeatable on my 32 bit Windows build.

Created attachment 6225 [details]
Yet more changes to the patch

For subtractive devices that do not have cmyk process colorants the custompdf14 device is installed.  This pdf14 device was obtaining its color_info from the target device.  The pdf14 device must be continuous tone even if the target device is not.  This should fix the remaining error / seg fault issues related to transparency/patterns/clist.

One last comment.  Ran the cluster regression with the current patch.  No differences.

(In reply to comment #61)
> One last comment.  Ran the cluster regression with the current patch.  No
> differences.

Patch looks good go ahead and commit or I can do it, let me know.  The cups device will not work properly without changing the initialization of device's get_color_comp_index method:


Index: gdevcups.c
===================================================================
--- gdevcups.c	(revision 11115)
+++ gdevcups.c	(working copy)
@@ -257,7 +257,7 @@
    NULL,				/* discard_transparency_layer */
 #ifdef dev_t_proc_encode_color
    cups_get_color_mapping_procs,
-   gx_error_get_color_comp_index,	/* Dummy to avoid segfault */
+   NULL,
    cups_encode_color,
    cups_decode_color,
 #else


According to the logs Till changed the method to workaround a problem, but clearly the fix is wrong, so I guess we need to unearth the problem files that motivated Till's fix and continue.  Till will you comment about this please?  Thank you.

CityMap*.pdf renders for me correctly now with the "cups" device. I have used Michael Vrhel's last patch.

(In reply to comment #62)
> Index: gdevcups.c
> ===================================================================
> --- gdevcups.c    (revision 11115)
> +++ gdevcups.c    (working copy)
> @@ -257,7 +257,7 @@
>     NULL,                /* discard_transparency_layer */
>  #ifdef dev_t_proc_encode_color
>     cups_get_color_mapping_procs,
> -   gx_error_get_color_comp_index,    /* Dummy to avoid segfault */
> +   NULL,
>     cups_encode_color,
>     cups_decode_color,
>  #else
> 
> 
> According to the logs Till changed the method to workaround a problem, but
> clearly the fix is wrong, so I guess we need to unearth the problem files that
> motivated Till's fix and continue.  Till will you comment about this please? 
> Thank you.

Taking back this change fixes a problem of wrong color reproduction of the CityMap*.pdf files. Now all works perfectly for these files.

org_chromium_ANn03F.pdf still errors out directly at scanline 0 though.

(In reply to comment #62)
> Index: gdevcups.c
> ===================================================================
> --- gdevcups.c    (revision 11115)
> +++ gdevcups.c    (working copy)
> @@ -257,7 +257,7 @@
>     NULL,                /* discard_transparency_layer */
>  #ifdef dev_t_proc_encode_color
>     cups_get_color_mapping_procs,
> -   gx_error_get_color_comp_index,    /* Dummy to avoid segfault */
> +   NULL,
>     cups_encode_color,
>     cups_decode_color,
>  #else
> 
> 
> According to the logs Till changed the method to workaround a problem, but
> clearly the fix is wrong, so I guess we need to unearth the problem files that
> motivated Till's fix and continue.  Till will you comment about this please? 
> Thank you.

Taking back this re-introduces bug 690338 (segmentation fault when printing Ubuntu test page), which means that the CUPS test page coming with Ubuntu gets unprintable with all CUPS Raster drivers.

Looks like that a NULL check is needed before the get_color_comp_index function gets called.

Tried r11113 patched and unpatched - attachment 6112 [details], is still a problem, the City*pdf shows unknownerror in showpage with unpatched r11113 which is fixed by Michael's patch. Some of the files in comment 31 may be interested for re-test.

(In reply to comment #56)
> Hmm, and I can't get my Linux Ghostscript to build, keeps falling over on
> FreeType compilation. I'll get back to this on Monday.

works here with r11113.

(In reply to comment #66)
> (In reply to comment #62)
> > Index: gdevcups.c
> > ===================================================================
> > --- gdevcups.c    (revision 11115)
> > +++ gdevcups.c    (working copy)
> > @@ -257,7 +257,7 @@
> >     NULL,                /* discard_transparency_layer */
> >  #ifdef dev_t_proc_encode_color
> >     cups_get_color_mapping_procs,
> > -   gx_error_get_color_comp_index,    /* Dummy to avoid segfault */
> > +   NULL,
> >     cups_encode_color,
> >     cups_decode_color,
> >  #else
> > 
> > 
> > According to the logs Till changed the method to workaround a problem, but
> > clearly the fix is wrong, so I guess we need to unearth the problem files that
> > motivated Till's fix and continue.  Till will you comment about this please? 
> > Thank you.
> 
> Taking back this re-introduces bug 690338 (segmentation fault when printing
> Ubuntu test page), which means that the CUPS test page coming with Ubuntu gets
> unprintable with all CUPS Raster drivers.
> 
> Looks like that a NULL check is needed before the get_color_comp_index function
> gets called.

Nope, once you set the method for get_color_mapping_procs gs assumes you know what you are doing and will further assume you will prepare a correct get_color_comp_index method.  So the page should work if you set get_color_mapping_procs to NULL instead of cups_get_color_mapping_procs, then you'll get gs defaults and the page should work okay.  WARNING: you will need to write your own procedures to support the myriad of color spaces in cups, gs only deals with the common spaces.  The bug report called for RGB.  The procedures aren't difficult to write and there are plenty of examples in the code.  We'd rather you follow up if you want to support the unusual cups color models and write your own get_color_mapping_procs and get_color_comp_index methods.

Created attachment 6228 [details]
Additional testcase

Fantastic - building ghostscript r11118 with Michael's patch has resolved the Citymap-* raster issues here.

Running my test-suite, I get four unique crash signatures (all 20 get hit with SEGV). I've included example PDFs, except the last. Let me know if it helps and I'll upload it:

http://www.brunel200.com/downloads/launch_leaflet.pdf 
http://www.cambridgeaudio.com/assets/documents/AP227921Azur540RV3SerialControlProtocolV1.pdf
#0  gc_objects_clear_marks (pspaces=<value optimized out>, global=<value optimized out>) at ./psi/igc.c:591
#1  gs_gc_reclaim (pspaces=<value optimized out>, global=<value optimized out>) at ./psi/igc.c:260
#2  0x000000000058b734 in context_reclaim (pspaces=0x27bd050, global=1) at ./psi/zcontext.c:283
#3  0x00000000004dac44 in gs_vmreclaim (dmem=0x27bd048, space=-1) at ./psi/ireclaim.c:153
#4  ireclaim (dmem=0x27bd048, space=-1) at ./psi/ireclaim.c:75
#5  0x00000000004d66f1 in interp_reclaim (pi_ctx_p=0x277e378, space=-1) at ./psi/interp.c:439
#6  0x00000000004d7a87 in interp (pi_ctx_p=<value optimized out>, pref=<value optimized out>, perror_object=<value optimized out>)
    at ./psi/interp.c:1702
#7  0x00000000004d863b in gs_call_interp (pi_ctx_p=0x277e378, pref=<value optimized out>, user_errors=<value optimized out>, 
    pexit_code=<value optimized out>, perror_object=0x7ffffd96c100) at ./psi/interp.c:508
#8  gs_interpret (pi_ctx_p=0x277e378, pref=<value optimized out>, user_errors=<value optimized out>, pexit_code=<value optimized out>, 
    perror_object=0x7ffffd96c100) at ./psi/interp.c:466
#9  0x00000000004ccef5 in gs_main_interpret (minst=<value optimized out>, user_errors=0, pexit_code=<value optimized out>, 
    perror_object=0x68) at ./psi/imain.c:214
#10 gs_main_run_string_end (minst=<value optimized out>, user_errors=0, pexit_code=<value optimized out>, perror_object=0x68)
    at ./psi/imain.c:526
#11 0x00000000004ce0fe in run_string (minst=0x2940c08, str=0x0, options=3) at ./psi/imainarg.c:814
#12 0x00000000004ce91a in runarg (minst=0x277e2e0, pre=0x8080bd "", arg=<value optimized out>, post=0x7c3972 ".runfile", options=3)
    at ./psi/imainarg.c:805
#13 0x00000000004d02bc in gs_main_init_with_args (minst=0x277e2e0, argc=23, argv=0x7ffffd96ccf8) at ./psi/imainarg.c:215
#14 0x000000000045ab61 in main (argc=23, argv=0x7ffffd96ccf8) at ./psi/gs.c:77

http://www.stdout.org/~winston/latex/latexsheet-a4.pdf
http://cimg.sourceforge.net/CImg_flyer.pdf
#0  cmd_put_list_op (cldev=0x101e848, pcl=0x7f386ceb9990, size=24) at ./base/gxclutil.c:269
#1  0x00000000005ec4d1 in cmd_write_unknown (cldev=0x101e848, pcls=0x7f386ceb97d8, must_know=<value optimized out>) at ./base/gxclpath.c:479
#2  0x00000000005ede6d in clist_stroke_path (dev=0x101e848, pis=0xfbaf88, ppath=0xfd7ac8, params=<value optimized out>, pdcolor=0x11a82f0, 
    pcpath=0x11a3be0) at ./base/gxclpath.c:899
#3  0x00000000007912af in gx_stroke_fill (ppath=0xfd7ac8, pgs=0xfbaf88) at ./base/gxpaint.c:65
#4  0x0000000000759eff in do_stroke (pgs=0xfbaf88) at ./base/gspaint.c:439
#5  gs_stroke (pgs=0xfbaf88) at ./base/gspaint.c:473
#6  0x00000000004d76fe in interp (pi_ctx_p=<value optimized out>, pref=<value optimized out>, perror_object=<value optimized out>)
    at ./psi/interp.c:1287
#7  0x00000000004d863b in gs_call_interp (pi_ctx_p=0xf98378, pref=<value optimized out>, user_errors=<value optimized out>, 
    pexit_code=<value optimized out>, perror_object=0x7fffd0f03f10) at ./psi/interp.c:508
#8  gs_interpret (pi_ctx_p=0xf98378, pref=<value optimized out>, user_errors=<value optimized out>, pexit_code=<value optimized out>, 
    perror_object=0x7fffd0f03f10) at ./psi/interp.c:466
#9  0x00000000004ccef5 in gs_main_interpret (minst=<value optimized out>, user_errors=1984160475, pexit_code=<value optimized out>, 
    perror_object=0x0) at ./psi/imain.c:214
#10 gs_main_run_string_end (minst=<value optimized out>, user_errors=1984160475, pexit_code=<value optimized out>, perror_object=0x0)
    at ./psi/imain.c:526
#11 0x00000000004ce0fe in run_string (minst=0x101e848, str=0x7f386ceb9990 "\n\342|\211\222\343@\001\333\342Cvn\357\360\337\004\002\t", 
    options=3) at ./psi/imainarg.c:814
#12 0x00000000004ce91a in runarg (minst=0xf982e0, pre=0x8080bd "", arg=<value optimized out>, post=0x7c3972 ".runfile", options=3)
    at ./psi/imainarg.c:805
#13 0x00000000004d02bc in gs_main_init_with_args (minst=0xf982e0, argc=23, argv=0x7fffd0f04b08) at ./psi/imainarg.c:215
#14 0x000000000045ab61 in main (argc=23, argv=0x7fffd0f04b08) at ./psi/gs.c:77

SMP_Warwick_14.pdf
#0  cmd_put_list_op (cldev=0x1eb3848, pcl=0x7f67eba342f0, size=14) at ./base/gxclutil.c:269
#1  0x00000000005ec4d1 in cmd_write_unknown (cldev=0x1eb3848, pcls=0x7f67eba34138, must_know=<value optimized out>) at ./base/gxclpath.c:479
#2  0x00000000005ea621 in clist_image_plane_data (info=0x21c70e8, planes=<value optimized out>, yh=<value optimized out>, 
    rows_used=<value optimized out>) at ./base/gxclimag.c:706
#3  0x000000000075204a in gs_image_next_planes (penum=<value optimized out>, plane_data=0x2092721, used=0x2092721) at ./base/gsimage.c:600
#4  0x0000000000509423 in image_file_continue (i_ctx_p=0x1e6c040) at ./psi/zimage.c:517
#5  0x00000000004d6ffe in interp (pi_ctx_p=<value optimized out>, pref=<value optimized out>, perror_object=<value optimized out>)
    at ./psi/interp.c:1174
#6  0x00000000004d863b in gs_call_interp (pi_ctx_p=0x1e2d378, pref=<value optimized out>, user_errors=<value optimized out>, 
    pexit_code=<value optimized out>, perror_object=0x7fff1142ac60) at ./psi/interp.c:508
#7  gs_interpret (pi_ctx_p=0x1e2d378, pref=<value optimized out>, user_errors=<value optimized out>, pexit_code=<value optimized out>, 
    perror_object=0x7fff1142ac60) at ./psi/interp.c:466
#8  0x00000000004ccef5 in gs_main_interpret (minst=<value optimized out>, user_errors=268435456, pexit_code=<value optimized out>, 
    perror_object=0x7fe8a357) at ./psi/imain.c:214
#9  gs_main_run_string_end (minst=<value optimized out>, user_errors=268435456, pexit_code=<value optimized out>, perror_object=0x7fe8a357)
    at ./psi/imain.c:526
#10 0x00000000004ce0fe in run_string (minst=0x1eb3848, str=0x7f67eba342f0 "\004", options=3) at ./psi/imainarg.c:814
#11 0x00000000004ce91a in runarg (minst=0x1e2d2e0, pre=0x8080bd "", arg=<value optimized out>, post=0x7c3972 ".runfile", options=3)
    at ./psi/imainarg.c:805
#12 0x00000000004d02bc in gs_main_init_with_args (minst=0x1e2d2e0, argc=23, argv=0x7fff1142b858) at ./psi/imainarg.c:215
#13 0x000000000045ab61 in main (argc=23, argv=0x7fff1142b858) at ./psi/gs.c:77

<PDF available on request>
#0  cmd_put_list_op (cldev=0x2e8a848, pcl=0x7fd1a897c990, size=291) at ./base/gxclutil.c:269
#1  0x00000000005ea49f in cmd_image_plane_data (info=<value optimized out>, planes=<value optimized out>, yh=<value optimized out>, 
    rows_used=<value optimized out>) at ./base/gxclimag.c:1528
#2  clist_image_plane_data (info=<value optimized out>, planes=<value optimized out>, yh=<value optimized out>, 
    rows_used=<value optimized out>) at ./base/gxclimag.c:789
#3  0x000000000075204a in gs_image_next_planes (penum=<value optimized out>, plane_data=0x314b6f1, used=0x314b6f1) at ./base/gsimage.c:600
#4  0x0000000000509423 in image_file_continue (i_ctx_p=0x2e43040) at ./psi/zimage.c:517
#5  0x00000000004d6ffe in interp (pi_ctx_p=<value optimized out>, pref=<value optimized out>, perror_object=<value optimized out>)
    at ./psi/interp.c:1174
#6  0x00000000004d863b in gs_call_interp (pi_ctx_p=0x2e04378, pref=<value optimized out>, user_errors=<value optimized out>, 
    pexit_code=<value optimized out>, perror_object=0x7fffbba37440) at ./psi/interp.c:508
#7  gs_interpret (pi_ctx_p=0x2e04378, pref=<value optimized out>, user_errors=<value optimized out>, pexit_code=<value optimized out>, 
    perror_object=0x7fffbba37440) at ./psi/interp.c:466
#8  0x00000000004ccef5 in gs_main_interpret (minst=<value optimized out>, user_errors=1024, pexit_code=<value optimized out>, 
    perror_object=0x8) at ./psi/imain.c:214
#9  gs_main_run_string_end (minst=<value optimized out>, user_errors=1024, pexit_code=<value optimized out>, perror_object=0x8)
    at ./psi/imain.c:526
#10 0x00000000004ce0fe in run_string (minst=0x2e8a848, str=0x7fd1a897c990 "", options=3) at ./psi/imainarg.c:814
#11 0x00000000004ce91a in runarg (minst=0x2e042e0, pre=0x8080bd "", arg=<value optimized out>, post=0x7c3972 ".runfile", options=3)
    at ./psi/imainarg.c:805
#12 0x00000000004d02bc in gs_main_init_with_args (minst=0x2e042e0, argc=23, argv=0x7fffbba38038) at ./psi/imainarg.c:215
#13 0x000000000045ab61 in main (argc=23, argv=0x7fffbba38038) at ./psi/gs.c:77

Reassigning to Hin-Tak (open source liaison), who will attempt to reproduce the issues on supported devices with complete command lines and reassign to the appropriate engineer.

(In reply to comment #62)
 > Patch looks good go ahead and commit or I can do it, let me know.  The cups
> device will not work properly without changing the initialization of device's
> get_color_comp_index method:
> 
> 
> Index: gdevcups.c
> ===================================================================
> --- gdevcups.c    (revision 11115)
> +++ gdevcups.c    (working copy)
> @@ -257,7 +257,7 @@
>     NULL,                /* discard_transparency_layer */
>  #ifdef dev_t_proc_encode_color
>     cups_get_color_mapping_procs,
> -   gx_error_get_color_comp_index,    /* Dummy to avoid segfault */
> +   NULL,
>     cups_encode_color,
>     cups_decode_color,
>  #else
> 
> 
> According to the logs Till changed the method to workaround a problem, but
> clearly the fix is wrong, so I guess we need to unearth the problem files that
> motivated Till's fix and continue.  Till will you comment about this please? 
> Thank you.

I have fixed this issue by supplying a real get_color_comp_index() method now. Fix is in SVN rev 11120. This really fixes bug 690338.

This does not solve the problem of org_chromium_ANn03F.pdf.

(In reply to comment #70)

> http://www.brunel200.com/downloads/launch_leaflet.pdf 
> http://www.cambridgeaudio.com/assets/documents/AP227921Azur540RV3SerialControlProtocolV1.pdf
> #0  gc_objects_clear_marks (pspaces=<value optimized out>, global=<value
> optimized out>) at ./psi/igc.c:591
> #1  gs_gc_reclaim (pspaces=<value optimized out>, global=<value optimized out>)

> http://www.stdout.org/~winston/latex/latexsheet-a4.pdf
> http://cimg.sourceforge.net/CImg_flyer.pdf
> #0  cmd_put_list_op (cldev=0x101e848, pcl=0x7f386ceb9990, size=24) at
> ./base/gxclutil.c:269
> #1  0x00000000005ec4d1 in cmd_write_unknown (cldev=0x101e848,
> pcls=0x7f386ceb97d8, must_know=<value optimized out>) at ./base/gxclpath.c:479
> #2  0x00000000005ede6d in clist_stroke_path (dev=0x101e848, pis=0xfbaf88,
> ppath=0xfd7ac8, params=<value optimized out>, pdcolor=0x11a82f0, 
>     pcpath=0x11a3be0) at ./base/gxclpath.c:899

> SMP_Warwick_14.pdf
> #0  cmd_put_list_op (cldev=0x1eb3848, pcl=0x7f67eba342f0, size=14) at
> ./base/gxclutil.c:269
> #1  0x00000000005ec4d1 in cmd_write_unknown (cldev=0x1eb3848,
> pcls=0x7f67eba34138, must_know=<value optimized out>) at ./base/gxclpath.c:479
> #2  0x00000000005ea621 in clist_image_plane_data (info=0x21c70e8, planes=<value
> optimized out>, yh=<value optimized out>, 
>     rows_used=<value optimized out>) at ./base/gxclimag.c:706

> <PDF available on request>
> #0  cmd_put_list_op (cldev=0x2e8a848, pcl=0x7fd1a897c990, size=291) at
> ./base/gxclutil.c:269
> #1  0x00000000005ea49f in cmd_image_plane_data (info=<value optimized out>,
> planes=<value optimized out>, yh=<value optimized out>, 
>     rows_used=<value optimized out>) at ./base/gxclimag.c:1528
> #2  clist_image_plane_data (info=<value optimized out>, planes=<value optimized
> out>, yh=<value optimized out>, 
>     rows_used=<value optimized out>) at ./base/gxclimag.c:789


That looks like two problem areas - gabbage collector and still in clist. Both are being looked at.

About the "<PDF available on request>" - while we have no shortage of test files now (in fact it might be preferable to file new bugs than to pile it on), and there is a bugzilla limit of 10MB, I think, or used to, attachments can be marked a private and only Artifex engineers/consultants can get at them.

(In reply to comment #70)
> http://www.brunel200.com/downloads/launch_leaflet.pdf 
> http://www.cambridgeaudio.com/assets/documents/AP227921Azur540RV3SerialControlProtocolV1.pdf
> http://www.stdout.org/~winston/latex/latexsheet-a4.pdf
> http://cimg.sourceforge.net/CImg_flyer.pdf

I tried these 4 and could not get a segfault - I am using the result of 'make debug' with r11113 + attachment 6225 [details] , and trying with the commandline in comment 33.

> ... - building ghostscript r11118 with Michael's patch...

do you really mean r11118? Michael's patch is r11117 .

In any case, I think I need your exact command line to try to get a segfault, and if you use any PPD, attach also the ppd.

Commit 11124 should fix the problems with org_chromium_ANn03F.pdf related to compositor actions in the pattern clist.  This particular file however, also has a GC issue on my system.  There is a GC relocation that occurs, after which point the bit cache data in the pattern clist is no longer valid (i.e. leads to an access violation).   In order to have it run, I had to use -dNOGC.

Created attachment 6231 [details]
Stylus R220 PPD used to reproduce issues

Revision 11125 should resolve the crash in the FAPI code running CityMap-evince.pdf

I've distilled the reproducer some more. Using the given PPD:

$ sudo apt-get build-dep ghostscript
$ svn co -r 11125 http://svn.ghostscript.com/ghostscript/trunk/gs # includes Michael's patch
$ cd gs
$ ./autogen
$ make debug
$ cd ..
$ PPD=Stylus-Photo-R220.ppd ./gs/debugobj/gs -dNOPAUSE -dBATCH -sDEVICE=cups -sstdout=%stderr -sOutputFile=/dev/null -r720x360 -dDEVICEWIDTHPOINTS=595 -dDEVICEHEIGHTPOINTS=842 -dcupsBitsPerColor=8 -dcupsColorOrder=0 -dcupsColorSpace=1 -c -f -_ PDFs/launch_leaflet.pdf </dev/null >/dev/null 2>&1
Segmentation fault

On Ubuntu, the build dependencies installed are: automake1.9 freeglut3 freeglut3-dev libcups2-dev libcupsimage2 libcupsimage2-dev libfontconfig1-dev libfreetype6-dev libgcrypt11-dev libgl1-mesa-dev libglu1-mesa libglu1-mesa-dev libgnutls-dev libgpg-error-dev libice-dev libjpeg62-dev linpng-dev libpaper-dev libpaper1 libpthread-stubs0 libpthread-stubs0-dev libsm-dev libtasn1-3-dev libtiff4-dev libtiffxx0c2 libx11-dev libxau-dev libxcb1-dev libxdmcp-dev libxext-dev libxt-dev mesa-common-dev pkg-config x11proto-core-dev x11proto-input-dev x11proto-kb-dev x11proto-xext-dev xlibmesa-gl-dev xtrans-dev

Created attachment 6232 [details]
Fourth crash signature testcase

Hin-Tak we'd like to have these files added to the public regression suite as problems are fixed.

(In reply to comment #70)
> SMP_Warwick_14.pdf

Daniel: there is no URL for this file.

Created attachment 6235 [details]
additional testcase

Hin-Tak: other testcases here fail the same way as SMP_Warwick_14.pdf; attaching anyway, as more testcases is better than less.

I added all the files we have so far to (all the Bug691014_*, for ease of looking) :
http://svn.ghostscript.com/ghostscript/tests/pdf/ 

with r11126, only two segfaults on my system - Bug6901014_latexsheet-a4.pdf, 
Bug6901014_launch_leaflet.pdf, and the crash is within 5 lines of each other,
pcl->tail->size or pcl->tail->next points at invalid addresses:

#0  0x00000000006d5a15 in cmd_put_list_op (cldev=0x334c7f8, pcl=0x7f2dd0b99620, size=19) at ./base/gxclutil.c:263
263			pcl->tail->size > dp - (byte *) (pcl->tail + 1)

#0  0x00000000006d5a15 in cmd_put_list_op (cldev=0x334c7f8, pcl=0x7f2dd0b99620, size=19) at ./base/gxclutil.c:263
#1  0x00000000006d5c81 in cmd_put_op (cldev=0x334c7f8, pcls=0x7f2dd0b99468, size=19) at ./base/gxclutil.c:306
#2  0x00000000006ddbe6 in cmd_write_unknown (cldev=0x334c7f8, pcls=0x7f2dd0b99468, must_know=16383) at ./base/gxclpath.c:479
#3  0x00000000006df81a in clist_stroke_path (dev=0x334c7f8, pis=0x32e5fa8, ppath=0x3302ee0, params=0x7fff8b9d9fd0, 
    pdcolor=0x364de08, pcpath=0x364d938) at ./base/gxclpath.c:899

#0  0x00000000006d5a85 in cmd_put_list_op (cldev=0x20387f8, pcl=0x7fd4412ea620, size=147) at ./base/gxclutil.c:269
269		    pcl->tail->next = cp;
#0  0x00000000006d5a85 in cmd_put_list_op (cldev=0x20387f8, pcl=0x7fd4412ea620, size=147) at ./base/gxclutil.c:269
#1  0x00000000006d5c81 in cmd_put_op (cldev=0x20387f8, pcls=0x7fd4412ea468, size=147) at ./base/gxclutil.c:306
#2  0x00000000006dc4bc in cmd_image_plane_data (cldev=0x20387f8, pcls=0x7fd4412ea468, planes=0x26cfeb0, pie=0x26e1ad8, 
    bytes_per_plane=48, offsets=0x7fff2fa503e0, dx=0, h=3) at ./base/gxclimag.c:1528
#3  0x00000000006d9d0f in clist_image_plane_data (info=0x26e1ad8, planes=0x26cfeb0, yh=3, rows_used=0x7fff2fa505f8)
    at ./base/gxclimag.c:789
#4  0x0000000000930fb8 in gx_image_plane_data_rows (info=0x26e1ad8, planes=0x26cfeb0, height=3, rows_used=0x7fff2fa505f8)
    at ./base/gximage.c:181

Fixed in rev 11149.

Problem was memory reallocation for page geometry (size/margins) changes. Using gdev_prn_maybe_realloc_memory() instead of making own decisions about when to reallocate.

In addition, added some corrections for the generation of the CUPS Raster header parameters. Especially set the parameters only after completely finishing the geometry settings of the original page, and also taken into account landscape mode.

Now the PDF files attached to this bug actually render, not segfaulting any more and the rendered pages being correctly positioned in the CUPS Raster output files (tested with rasterview from http://www.easysw.com/~mike/rasterview/index.html).

I will put it out as a Stable Release Update (SRU) for Ubuntu Lucid, to solve all the (or at least most) "I cannot print this file" bug reports.

Yes, confirm all the files are working. Guess comment 84 was just general memory corruption.

Outstanding work Michael and Till! Testing with a large set of PDFs I have here, r11149 works without getting hit with a SEGV any more. Fantastic, thanks.

(In reply to comment #87)
> Outstanding work Michael and Till! Testing with a large set of PDFs I have
> here, r11149 works without getting hit with a SEGV any more. Fantastic, thanks.

Till's patch generates a small compiler warning which I am looking at at the moment. there will be a patch for it, so please look out for backporting, etc.

The state whether the document uses transparency does not change between the call of gdev_prn_put_params() and gdev_prn_maybe_realloc_memory() in put_params(), so adding pdev->page_uses_transparency as fifth argument to the call of gdev_prn_maybe_realloc_memory() should be OK.

Fixed the warnings, retested, and committed result as SVN rev 11156.

For me all files still render, but please re-test.

(In reply to comment #89)
> The state whether the document uses transparency does not change between the
> call of gdev_prn_put_params() and gdev_prn_maybe_realloc_memory() in
> put_params(), so adding pdev->page_uses_transparency as fifth argument to the
> call of gdev_prn_maybe_realloc_memory() should be OK.

(In reply to comment #90)
> Fixed the warnings, retested, and committed result as SVN rev 11156.
> 
> For me all files still render, but please re-test.

Only two part of ghostscript calls gdev_prn_maybe_realloc_memory() (the other one in ijs) and you must have found that it also use the existing "pdev->page_uses_transparency" value also.

I was testing an almost identical patch (except indentation/style) just before I went out and was going to commit when I get back - so I have already tested the change.

With r11156, ~25 of 2032 PDFs caused ghostscript to crash - I'm just gathering details of what files, backtraces etc.

Daniel, does rev 11149 render all your 2032 files? Or did it also segfault on your mentioned 25? It is important for us to know whether the fix of the compiler warnings with rev 11156 introduced these 25 files as new crashers or not.

Please also make these 25 (or better even the 2032) available to us for further investigation and especially for our regression test cluster.

Created attachment 6242 [details]
additional testcases, some of which cause r11156 to SEGV

Hi Till, yes with r11149, none of the 2032 PDFs caused a SEGV (though I didn't check the render output in any cases). The delayed response is because it takes a few hours for the rasterise all these files...

The last attachment has a couple of PDFs which reproduce crashing with r11156 - clearly on outside-VMA access due to incorrect memory allocation.

Thanks - Daniel

I cannot get a segfault with any of the files against r11156.

Daniel, I do not get any crash with the files of your last attachment (tarball with 14 files). The files with Chinese, Japanese, or Korean text error out due to missing fonts, but they also do not display with Adobe Reader or evince due to missing fonts. All other files render perfectly for me.

Please tell what the problem for these files is for you and give us files which segfault for you. Thanks.

Daniel, as we do not succeed to reproduce these segfaults it would be great if you could supply us backtraces and valgring output. Thanks.

Daniel, especially provide us also the differences between the valgring output og (succeeding) rev 11149 and (crashing) rev 11156).

Indeed, this needs the full CUPS setup (as in comment 11), which can probably be trimmed down a bit:

$ svn co -r 11156 http://svn.ghostscript.com/ghostscript/trunk/gs
$ cd gs; ./autogen.sh; make debug; cd ..
$ sudo bash
# export CUPS_CACHEDIR=/var/cache/cups CUPS_DATADIR=/usr/share/cups CUPS_DOCROOT=/usr/share/cups/doc-root CUPS_FONTPATH=/usr/share/cups/fonts CUPS_REQUESTROOT=/var/spool/cups CUPS_SERVERBIN=/usr/lib/cups CUPS_SERVERROOT=/etc/cups CUPS_STATEDIR=/var/run/cups HOME=/var/spool/cups/tmp PATH=/usr/lib/cups/filter:/usr/bin:/usr/sbin:/bin:/usr/bin SERVER_ADMIN=root@exige SOFTWARE=CUPS/1.4.2 TMPDIR=/var/spool/cups/tmp TZ=Europe/London USER=root CUPS_SERVER=/var/run/cups/cups.sock CUPS_ENCRYPTION=IfRequested IPP_PORT=631 CHARSET=utf-8 LANG=en.UTF-8 PPD=/etc/cups/ppd/Stylus-Photo-R220.ppd RIP_MAX_CACHE=978762k CONTENT_TYPE=application/pdf DEVICE_URI=usb://EPSON/Stylus%20Photo%20R220 PRINTER_INFO="EPSON Stylus Photo R220" PRINTER_LOCATION=exige PRINTER=Stylus-Photo-R220 CUPS_FILETYPE=document FINAL_CONTENT_TYPE=printer/Stylus-Photo-R220
# ./gs/debugobj/gs -dQUIET -dPARANOIDSAFER -dNOPAUSE -dBATCH -sDEVICE=cups -sstdout=%stderr -sOutputFile=/dev/null -I/usr/share/cups/fonts -sMediaClass=Standard -sMediaType=Plain -r720x360 -dDEVICEWIDTHPOINTS=595 -dDEVICEHEIGHTPOINTS=842 -dcupsBitsPerColor=8 -dcupsColorOrder=0 -dcupsColorSpace=1 -dcupsRowFeed=5 -scupsPageSizeName=A4 -c -f -_ PDF13.pdf </dev/null >/dev/null 2>&1
Segmentation fault

Daniel, also this way I do not get a segfault, but I did not compile in debug mode, so perhaps there is a problem with some debug-only code.

(In reply to comment #100)
> Indeed, this needs the full CUPS setup (as in comment 11), which can probably
> be trimmed down a bit:
> 
> $ svn co -r 11156 http://svn.ghostscript.com/ghostscript/trunk/gs
> $ cd gs; ./autogen.sh; make debug; cd ..

Argh, could you also try the result of just "make" - there was a bug with debug build - fixed in r11151, but possibly requires more. (I was testing with 'make')

if you have a debug build and segfault, it would be useful to do "ulimit -c <largenumber>" and let it generate a core file, run gdb against the core file to see where it actually segfault.

One possibility is the font path - there are some freetype changes, and since I am on fedora I don't have the same CUPS_FONTPATHS anyway.

Testing again, I find r11151 built non-debug doesn't crash with any PDFs, and have double-checked that r11156 non-debug does crash with various PDFs, see the example backtraces. I'll rebuild with -g to get the filenames and line numbers.

Please ensure that the gs you build does correctly output raster data and not exit with failure to find resource files - I have to symlink /usr/share/ghostscript/8.72 to my build directory.

#0  0x00000000007c5810 in mem_true24_fill_rectangle ()
#1  0x0000000000790fc0 in spot_into_trapezoids ()
#2  0x000000000078cef9 in gx_default_fill_path ()
#3  0x00000000007a30e5 in gx_fill_path ()
#4  0x000000000076c79f in fill_with_rule ()
#5  0x000000000048b377 in interp ()
#6  0x000000000048c24b in gs_interpret ()
#7  0x0000000000481095 in gs_main_run_string_end ()
#8  0x00000000004821de in run_string ()
#9  0x000000000048294e in runarg ()
#10 0x00000000004841f4 in gs_main_init_with_args ()
#11 0x0000000000410688 in main ()

#0  0x00000000007c4e61 in mem_true24_copy_mono ()
#1  0x00000000007741a9 in gx_image_cached_char ()
#2  0x000000000077824c in show_update ()
#3  0x0000000000778fd9 in continue_show_update ()
#4  0x00000000004aaf9b in op_show_continue ()
#5  0x000000000048ac96 in interp ()
#6  0x000000000048c24b in gs_interpret ()
#7  0x0000000000481095 in gs_main_run_string_end ()
#8  0x00000000004821de in run_string ()
#9  0x000000000048294e in runarg ()
#10 0x00000000004841f4 in gs_main_init_with_args ()
#11 0x0000000000410688 in main ()

#0  0x00000000007c5810 in mem_true24_fill_rectangle ()
#1  0x000000000077d573 in clip_fill_rectangle ()
#2  0x0000000000783eb5 in gx_dc_pure_fill_rectangle ()
#3  0x0000000000417cb6 in image_render_color ()
#4  0x0000000000798ddb in gx_image1_plane_data ()
#5  0x0000000000764a09 in gs_image_next_planes ()
#6  0x00000000004bc406 in image_file_continue ()
#7  0x000000000048ac96 in interp ()
#8  0x000000000048c24b in gs_interpret ()
#9  0x0000000000481095 in gs_main_run_string_end ()
#10 0x00000000004821de in run_string ()
#11 0x000000000048294e in runarg ()
#12 0x00000000004841f4 in gs_main_init_with_args ()
#13 0x0000000000410688 in main ()

Daniel, can you try your test file arsenal on the current SVN state (rev 11187 or newer)? Change on the CUPS device is now to make it completely thread-safe, so no intended change to fix your segfault issues. But as a regression test we want to know whether it causes additional segfaults or not, or whether it even fixes some of your segfaults. Thanks in advance.

Daniel, we would also like to have your 2032 test files, to do automated regression tests on the PDF interpreter and on the CUPS Raster output driver. It would be great to make them available for us at Artifex. We can handle and distinguish confidential and non-confidential files and the former will not be downloadable for vistors nor will their content appear in publicly available logs or e-mail notifications.

Please either send me the files in tarballs by e-mail (especially the confidential ones) or make them available for download on a web server (especially the non-confidential ones). We will then put the files into the appropriate testing systems.

Thank you very much in advance.

Hi Till et al. Checking out and building r11187 non-debug with '-g', we get roughly the same number of SEGVs than with r11156 (ie 418 from my full 11570-files/7.3GB testsuite), so there is no additional acute issue. Backtraces attached, but you'll see it may be better to revert or fix the regressions introduced between r11151 and r11156, as we can't see the wood for the trees right now.

When the regression is fixed, I thought of running testing with all PPDs on a subset of the PDFs/PSs I have to get more exposure, but could expand this to use various settings; it would be tractible on a 96-core cluster I have.

Over the next week or two, I'll prepare the public part of my full PDF/PS testsuite for testing there when time allows.

Please let me know if you need more information/assistance to fix the regression...

Created attachment 6261 [details]
"can't see the wood for the trees" backtraces from r11187 non-debug

Can you do the following small change in cups/gdevcups.c:

Replace

      if ((code = gdev_prn_maybe_realloc_memory((gx_device_printer *)pdev, &sp, 
						width_old, height_old,
						cups->page_uses_transparency))

by

      if ((code = gdev_prn_maybe_realloc_memory((gx_device_printer *)pdev, &sp, 
						width_old, height_old,
						0))


(it is at line 3367). Then run your test suite through Ghostscript again. See also whether the files (especially the ones with transparency) give correct Raster output.

For which files are your last backtraces? Can you link or attach them if you did not do so yet?

Are there files which work with 11156 and segfault with 11187?

Are there files which segfault with 11156 and work with 11187?

Hi Till et al. Changing cups->page_uses_transparency to 0 does not resolve the crashing. I'll see if I can get time over the next week to debug it and locate the change that caused the regression. Also, any tips on converting the rasterised data back to a usable image format, to check the output?

Since I'm not on SDSL, uploading my testsuite would take considerable time. I cooked up a far more scalable solution, attached.

Created attachment 6268 [details]
PDF testsuite fetchatron

Daniel, CUPS Raster files can be directly displayed with rasterview, from http://www.easysw.com/~mike/rasterview/index.html

Ok, the regression introduced in r11156 is due to cups->page_uses_transparency always being 0 (guessing a bug), thus memory isn't (re)allocated when transparency is used, causing the SEGV. When the argument wasn't passed, the value consumed on the stack was non-zero, thus the transparency buffer was always allocated. We avoid these SEGVs eg by passing in 1, ie:

cups/gdevcups.c:3367
if ((code = gdev_prn_maybe_realloc_memory((gx_device_printer *)pdev, &sp, width_old, height_old, 1))

this fixes most of the issues seen, but obviously isn't the idea fix.

Running the testsuite again again r11234, I see some remaining different issues, eg:

#0  memset () at ../sysdeps/x86_64/memset.S:564
#1  0x0000000000820214 in mem_true24_fill_rectangle (dev=0xffffffffffffffff, x=<value optimized out>, y=<value optimized out>, 
    w=<value optimized out>, h=1, color=<value optimized out>) at /usr/include/bits/string3.h:86
#2  0x00000000007de245 in gx_dc_pure_fill_rectangle (pdevc=<value optimized out>, x=0, y=0, w=2975, h=1, dev=0x7ffff7e45068, lop=240, 
    source=0x0) at ./base/gxdcolor.c:414
#3  0x000000000046cf2a in image_render_color (penum_orig=0x1bbb4d8, buffer=<value optimized out>, data_x=<value optimized out>, 
    w=<value optimized out>, h=<value optimized out>, dev=<value optimized out>) at ./base/gxicolor.c:497
#4  0x00000000007f3291 in gx_image1_plane_data (info=0x1bbb4d8, planes=0x7fffffffa660, height=<value optimized out>, 
    rows_used=<value optimized out>) at ./base/gxidata.c:208
#5  0x000000000056bf80 in pdf14_put_image (dev=<value optimized out>, pis=<value optimized out>, target=<value optimized out>)
    at ./base/gdevp14.c:1407
#6  0x000000000056d72d in gx_update_pdf14_compositor (pdev=0x1396718, pis=<value optimized out>, pdf14pct=<value optimized out>, 
    mem=<value optimized out>) at ./base/gdevp14.c:2280
#7  0x000000000056f0b2 in send_pdf14trans (pis=0xfe7298, dev=0x1396718, pcdev=0x7fffffffc0d8, pparams=<value optimized out>, 
    mem=0xfc4bc8) at ./base/gdevp14.c:4645
#8  0x0000000000561bad in gs_state_update_pdf14trans (pgs=0x0, pparams=0xffffffffffffffa0) at ./base/gstrans.c:203
#9  0x0000000000561c1a in gs_pop_pdf14trans_device (pgs=0x0) at ./base/gstrans.c:843
#10 0x00000000004e1e95 in interp (pi_ctx_p=<value optimized out>, pref=<value optimized out>, perror_object=<value optimized out>)
    at ./psi/interp.c:1526
#11 0x00000000004e29fb in gs_call_interp (pi_ctx_p=0xfc46c8, pref=<value optimized out>, user_errors=<value optimized out>, 
    pexit_code=<value optimized out>, perror_object=0x7fffffffd190) at ./psi/interp.c:484
#12 gs_interpret (pi_ctx_p=0xfc46c8, pref=<value optimized out>, user_errors=<value optimized out>, pexit_code=<value optimized out>, 
    perror_object=0x7fffffffd190) at ./psi/interp.c:442
#13 0x00000000004d71b5 in gs_main_interpret (minst=<value optimized out>, user_errors=-1, pexit_code=<value optimized out>, 
    perror_object=0x22dc) at ./psi/imain.c:240
#14 gs_main_run_string_end (minst=<value optimized out>, user_errors=-1, pexit_code=<value optimized out>, perror_object=0x22dc)
    at ./psi/imain.c:556
#15 0x00000000004d840e in run_string (minst=0x0, str=0x0, options=3) at ./psi/imainarg.c:814
#16 0x00000000004d8c2a in runarg (minst=0xfc4630, pre=0x887b3d "", arg=<value optimized out>, post=0x82fcb2 ".runfile", options=3)
    at ./psi/imainarg.c:805
#17 0x00000000004da5cc in gs_main_init_with_args (minst=0xfc4630, argc=23, argv=0x7fffffffdd88) at ./psi/imainarg.c:215
#18 0x0000000000464ad6 in main (argc=23, argv=0x7fffffffdd88) at ./psi/gs.c:96

I'll upload these new testcases. For rastering speed (thus getting through the test cases quicker), I'm using 360x360 resolution, ie:

$ export IPP_PORT=631 TMPDIR=/var/spool/cups/tmp CUPS_FONTPATH=/usr/share/cups/fonts CUPS_DOCROOT=/usr/share/cups/doc-root CUPS_SERVERROOT=/etc/cups SOFTWARE=CUPS/1.4.3 CUPS_FILETYPE=document CUPS_CACHEDIR=/var/cache/cups DEVICE_URI=usb://EPSON/Stylus%20Photo%20R220 PATH=/usr/lib/cups/filter:/usr/bin:/usr/sbin:/bin:/usr/bin CUPS_REQUESTROOT=/var/spool/cups SERVER_ADMIN=root@exon PPD=/etc/cups/ppd/Stylus-Photo-R220.ppd LANG=en.UTF-8 TZ=Europe/London CUPS_ENCRYPTION=IfRequested HOME=/var/spool/cups/tmp CUPS_DATADIR=/usr/share/cups PRINTER=Stylus-Photo-R220 FINAL_CONTENT_TYPE=printer/Stylus-Photo-R220 RIP_MAX_CACHE=930617k PRINTER_LOCATION=exon CONTENT_TYPE=application/pdf PRINTER_INFO='EPSON Stylus Photo R220' CUPS_SERVER=/var/run/cups/cups.sock CHARSET=utf-8 CUPS_STATEDIR=/var/run/cups CUPS_SERVERBIN=/usr/lib/cups
$ find PDFs -iname '*.eps' -o -iname '*.ps' -o -iname '*.pdf' -print -exec gs/bin/gs -dQUIET -dPARANOIDSAFER -dNOPAUSE -dBATCH -sDEVICE=cups -sstdout=%stderr -sOutputFile=%stdout -I/usr/share/cups/fonts -sMediaClass=Standard -sMediaType=GlossyPhoto -r360x360 -dDEVICEWIDTHPOINTS=595 -dDEVICEHEIGHTPOINTS=842 -dcupsBitsPerColor=8 -dcupsColorOrder=0 -dcupsColorSpace=1 -dcupsRowFeed=10 -scupsPageSizeName=A4 -c -f -_ {} \; </dev/null >/dev/null 2>&1

Remember you need to use this PPD and link the gs build dir to /usr/share/ghostscript/8.72 in my configuration case. Let me know if you can't reproduce SEGV with these testcases, and I'll work with you. Daniel

Correction - for my instructions to work as non-root (as the prompt suggests) TMPDIR should be:

export TMPDIR=/tmp

Created attachment 6279 [details]
testcase showing r11234 regression over 8.71 release and regression over r11149

(In reply to comment #114)
> Created an attachment (id=6279) [details]
> testcase showing r11234 regression over 8.71 release and regression over r11149

Daniel: it is not helping anybody to keep adding test files and new issues to an old thread. I would suggest filing two separate bugs, one for cups->page_uses_transparency and another for any issues with new files.