Bug 694549 - Hard to reproduce seg fault with Bug688845.eps
Summary: Hard to reproduce seg fault with Bug688845.eps
Status: RESOLVED FIXED
Alias: None
Product: Ghostscript
Classification: Unclassified
Component: General (show other bugs)
Version: master
Hardware: PC Linux
: P1 normal
Assignee: Chris Liddell (chrisl)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-08-29 13:16 UTC by Marcos H. Woehrmann
Modified: 2015-05-28 00:35 UTC (History)
0 users

See Also:
Customer:
Word Size: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcos H. Woehrmann 2013-08-29 13:16:32 UTC
The following command seg faults (in 466d8f6):

 bin/gs -I./gs/lib -o /dev/null -dMaxBitmap=10000 \
   -sDEVICE=pbmraw -dEPSCrop -r300  -sDEFAULTPAPERSIZE=letter \
   -dJOBSERVER ./tests_private/comparefiles/Bug688845.eps
Comment 1 Marcos H. Woehrmann 2013-08-29 13:17:19 UTC
Luckily the debug build fails as well.  Here is the gdb stack trace:

Starting program: /home/marcos/weekly/Tue/ghostpdl/gs/debugbin/gs -I./gs/lib -o /dev/null -dMaxBitmap=10000 -sDEVICE=pbmraw -dEPSCrop -r300  -sDEFAULTPAPERSIZE=letter -dJOBSERVER ./tests_private/comparefiles/Bug688845.eps
[Thread debugging using libthread_db enabled]
GPL Ghostscript 9.10 (2013-08-21)
Copyright (C) 2013 Artifex Software, Inc.  All rights reserved.
This software comes with NO WARRANTY: see the file PUBLIC for details.
[New Thread 0x7ffff2ba8700 (LWP 4134)]
[Thread 0x7ffff2ba8700 (LWP 4134) exited]
[New Thread 0x7ffff2ba8700 (LWP 4135)]
[Thread 0x7ffff2ba8700 (LWP 4135) exited]
[New Thread 0x7ffff2ba8700 (LWP 4136)]
[Thread 0x7ffff2ba8700 (LWP 4136) exited]
Error: /undefined in Start
Operand stack:

Execution stack:
   %interp_exit   .runexec2   --nostringval--   --nostringval--   --nostringval--   2   %stopped_push   --nostringval--   --nostringval--   --nostringval--   false   1   %stopped_push   1900   1   3   %oparray_pop   1899   1   3   %oparray_pop   --nostringval--   1883   1   3   %oparray_pop   1771   1   3   %oparray_pop   --nostringval--   %errorexec_pop   .runexec2   --nostringval--   --nostringval--   --nostringval--   2   %stopped_push   --nostringval--   --nostringval--
Dictionary stack:
   --dict:1174/1684(ro)(G)--   --dict:0/20(G)--   --dict:90/200(L)--   --dict:38/60(L)--   --dict:181/205(L)--   --dict:41/60(L)--   --dict:43/65(L)--   --dict:159/190(L)--   --dict:11/20(L)--
Current allocation mode is local
Last OS error: No such file or directory
Current file position is 284435
GPL Ghostscript 9.10: Unrecoverable error, exit code 1

Program received signal SIGSEGV, Segmentation fault.
0x0000000000596aae in ptr_struct_mark (pep=0x7fffffffdbf0, ignored=0x7fffffffe430) at ./psi/igc.c:1088
1088        if (!o_is_unmarked(ptr))
(gdb) where
#0  0x0000000000596aae in ptr_struct_mark (pep=0x7fffffffdbf0, ignored=0x7fffffffe430) at ./psi/igc.c:1088
#1  0x0000000000596565 in gc_trace (rp=0x7fffffffe790, pstate=0x7fffffffe430, pmstack=0x7fffffffdcc0) at ./psi/igc.c:949
#2  0x0000000000594639 in gs_gc_reclaim (pspaces=0x18ea528, global=1) at ./psi/igc.c:335
#3  0x000000000068857c in context_reclaim (pspaces=0x18ea528, global=1) at ./psi/zcontext.c:280
#4  0x0000000000549467 in gs_vmreclaim (dmem=0x18ea520, global=1) at ./psi/ireclaim.c:155
#5  0x00000000005491b2 in ireclaim (dmem=0x18ea520, space=8) at ./psi/ireclaim.c:77
#6  0x00000000005426d3 in interp_reclaim (pi_ctx_p=0x189b3f0, space=8) at ./psi/interp.c:441
#7  0x00000000005361b4 in gs_main_finit (minst=0x189b350, exit_status=1, code=-100) at ./psi/imain.c:844
#8  0x000000000053681b in gs_to_exit_with_code (mem=0x189b040, exit_status=1, code=-100) at ./psi/imain.c:931
#9  0x0000000000468c88 in main (argc=11, argv=0x7fffffffe998) at ./psi/gs.c:139
(gdb)
Comment 2 Marcos H. Woehrmann 2013-08-29 13:19:14 UTC
Valgrind reports:

marcos@inches:[22]% valgrind ./ghostpdl/gs/debugbin/gs -I./gs/lib -o /dev/null -dMaxBitmap=10000 -sDEVICE=pbmraw -dEPSCrop -r300 -sDEFAULTPAPERSIZE=letter -dJOBSERVER ./tests_private/comparefiles/Bug688845.eps
==4155== Memcheck, a memory error detector
==4155== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==4155== Using Valgrind-3.6.0.SVN-Debian and LibVEX; rerun with -h for copyright info
==4155== Command: ./ghostpdl/gs/debugbin/gs -I./gs/lib -o /dev/null -dMaxBitmap=10000 -sDEVICE=pbmraw -dEPSCrop -r300 -sDEFAULTPAPERSIZE=letter -dJOBSERVER ./tests_private/comparefiles/Bug688845.eps
==4155== 
GPL Ghostscript 9.10 (2013-08-21)
Copyright (C) 2013 Artifex Software, Inc.  All rights reserved.
This software comes with NO WARRANTY: see the file PUBLIC for details.
==4155== Syscall param write(buf) points to uninitialised byte(s)
==4155==    at 0x6F0800D: ??? (syscall-template.S:82)
==4155==    by 0x6EA1732: _IO_file_write@@GLIBC_2.2.5 (fileops.c:1276)
==4155==    by 0x6EA15DC: _IO_file_xsputn@@GLIBC_2.2.5 (fileops.c:530)
==4155==    by 0x6E975BC: fwrite (iofwrite.c:45)
==4155==    by 0x7182C9: clist_fwrite_chars (gxclfile.c:74)
==4155==    by 0x6FBE2E: cmd_write_band (gxclutil.c:198)
==4155==    by 0x6FC192: cmd_write_buffer (gxclutil.c:277)
==4155==    by 0x6E0EBA: clist_end_page (gxclist.c:813)
==4155==    by 0x6F2017: clist_close_writer_and_init_reader (gxclread.c:349)
==4155==    by 0x6F2A97: clist_get_bits_rectangle (gxclread.c:601)
==4155==    by 0x715271: clist_get_bits_rect_mt (gxclthrd.c:644)
==4155==    by 0xA8A131: gx_default_get_bits (gdevdgbr.c:54)
==4155==  Address 0xa5542f2 is 803,506 bytes inside a block of size 4,000,048 alloc'd
==4155==    at 0x4C274A8: malloc (vg_replace_malloc.c:236)
==4155==    by 0x95CD73: gs_heap_alloc_bytes (gsmalloc.c:183)
==4155==    by 0x6D6AF3: gdev_prn_setup_as_command_list (gdevprn.c:165)
==4155==    by 0x6D7542: gdev_prn_allocate (gdevprn.c:393)
==4155==    by 0x6D79A6: gdev_prn_allocate_memory (gdevprn.c:480)
==4155==    by 0x6D68DC: gdev_prn_open (gdevprn.c:88)
==4155==    by 0x942C66: gs_opendevice (gsdevice.c:393)
==4155==    by 0x942FA8: gs_setdevice_no_erase (gsdevice.c:505)
==4155==    by 0x58BD43: zsetdevice (zdevice.c:481)
==4155==    by 0x542114: do_call_operator (interp.c:86)
==4155==    by 0x545634: interp (interp.c:1561)
==4155==    by 0x542960: gs_call_interp (interp.c:510)
==4155== 
==4155== 
==4155== HEAP SUMMARY:
==4155==     in use at exit: 0 bytes in 0 blocks
==4155==   total heap usage: 6,376 allocs, 6,376 frees, 66,026,847 bytes allocated
==4155== 
==4155== All heap blocks were freed -- no leaks are possible
==4155== 
==4155== For counts of detected and suppressed errors, rerun with: -v
==4155== Use --track-origins=yes to see where uninitialised values come from
==4155== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 8 from 6)
marcos@inches:[23]%
Comment 3 Marcos H. Woehrmann 2014-05-17 21:38:38 UTC
A hopefully related problem is that this command line:

  ./gs/bin/gs -I/dev/null -o test.pgm  -dMaxBitmap=10000 -sDEVICE=cups \
    -dcupsColorSpace=0   -r300 -Z: -sDEFAULTPAPERSIZE=letter -dNOPAUSE \ 
    -dBATCH -K1000000 -dJOBSERVER - <  \
    ./tests_private/comparefiles/Bug688845.eps

Produces the following error:

Error: /undefined in SpotColor
Operand stack:
   --nostringval--   (\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000)   AGMGrad_ndx   get   --nostringval--   exch   get   (\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000)   AGMGrad_ndx   get   --nostringval--   exch   get   (\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000)   AGMGrad_ndx   get   --nostringval--   exch   get   (3210/.-,+*\)\('&%$$#"! \037\036\035\035\034\033\032\031\031\030\027\026\025\025\024\023\023\022\021\021\020\017\017\016\016\r\r\r)   AGMGrad_ndx   get   --nostringval--   exch   get   --nostringval--   exec   true
Execution stack:
   %interp_exit   .runexec2   --nostringval--   --nostringval--   --nostringval--   2   %stopped_push   --nostringval--   --nostringval--   --nostringval--   false   1   %stopped_push   1966   1   3   %oparray_pop   1965   1   3   %oparray_pop   --nostringval--   1949   1   3   %oparray_pop   1835   1   3   %oparray_pop   --nostringval--   %errorexec_pop   .runexec2   --nostringval--   --nostringval--   --nostringval--   2   %stopped_push   --nostringval--   --nostringval--   --nostringval--   --nostringval--   --nostringval--   --nostringval--
Dictionary stack:
   --dict:1183/1684(ro)(G)--   --dict:0/20(G)--   --dict:90/200(L)--   --dict:38/60(L)--   --dict:181/205(L)--   --dict:41/60(L)--   --dict:43/65(L)--   --dict:159/190(L)--   --dict:11/20(L)--
Current allocation mode is local
Last OS error: No such file or directory
GPL Ghostscript 9.15: Unrecoverable error, exit code 1
Segmentation fault


Changing the command line in trivial ways (i.e. removing the -I/dev/null) causes the error to change or go away.
Comment 4 Chris Liddell (chrisl) 2015-05-28 00:35:34 UTC
Fixed in:

http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=46cbd272