696945 – PDF crash (look like with JPEG 2000)

Bug 696945 - PDF crash (look like with JPEG 2000)

Summary: PDF crash (look like with JPEG 2000)

Status:	RESOLVED INVALID

Alias:	None

Product:	MuPDF
Classification:	Unclassified
Component:	mupdf (show other bugs)
Version:	1.9
Hardware:	PC Linux

Importance:	P4 normal
Assignee:	MuPDF bugs

URL:
Keywords:

Depends on:
Blocks:

Reported:	2016-07-25 07:42 UTC by foobnix
Modified:	2016-07-28 20:29 UTC (History)
CC List:	1 user (show)

See Also:
Customer:
Word Size:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description foobnix 2016-07-25 07:42:06 UTC

Created attachment 12717 [details]
book.pdf

I/libmupdf( 1842): Drop page 0
I/libmupdf( 1842): Goto page 0...
I/libmupdf( 1842): Load page 0
I/libmupdf( 1842): PageWidth=1008
I/libmupdf( 1842): PageHeight=1323
I/libmupdf( 1842): Drop page 0
I/libmupdf( 1842): Goto page 1...
I/libmupdf( 1842): Load page 1
I/libmupdf( 1842): PageWidth=1008
D/dalvikvm( 1842): GC_CONCURRENT freed 19K, 1% free 17875K/17944K, paused 0ms+0ms, total 3ms
I/libmupdf( 1842): PageHeight=1323
I/libmupdf( 1842): PageWidth=1008
I/libmupdf( 1842): PageHeight=1323
I/libmupdf( 1842): In native method
I/libmupdf( 1842): Checking format
I/libmupdf( 1842): locking pixels
I/libmupdf( 1842): Rendering page(0)=768x1008 patch=[0,0,768,1008]
F/libc    ( 1842): Fatal signal 11 (SIGSEGV) at 0x00000000 (code=128), thread 1873 (AsyncTask #1)
I/ActivityManager(  520): Displayed com.artifex.mupdfdemo/.MuPDFActivity: +381ms
I/DEBUG   (  143): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
I/DEBUG   (  143): Build fingerprint: 'generic/vbox86p/vbox86p:4.4.4/KTU84P/eng.buildbot.20150610.102145:userdebug/test-keys'
I/DEBUG   (  143): Revision: '0'
I/DEBUG   (  143): pid: 1842, tid: 1873, name: AsyncTask #1  >>> com.artifex.mupdfdemo <<<
I/DEBUG   (  143): signal 11 (SIGSEGV), code 128 (SI_KERNEL), fault addr 00000000
I/DEBUG   (  143):     eax 909e4008  ebx 93d49e0c  ecx 90962008  edx 909a3008
I/DEBUG   (  143):     esi 00000000  edi 00002000
I/DEBUG   (  143):     xcs 00000073  xds 0000007b  xes 0000007b  xfs 00000000  xss 0000007b
I/DEBUG   (  143):     eip 91d14ec0  ebp 90962008  esp 913f2b4c  flags 00210246
I/DEBUG   (  143): 
I/DEBUG   (  143): backtrace:
I/DEBUG   (  143):     #00  pc 0022bec0  /data/app-lib/com.artifex.mupdfdemo-1/libmupdf_java.so (opj_mct_decode_real+80)
I/DEBUG   (  143):     #01  pc 0023342c  /data/app-lib/com.artifex.mupdfdemo-1/libmupdf_java.so (opj_tcd_decode_tile+684)
I/DEBUG   (  143):     #02  pc 0022574b  /data/app-lib/com.artifex.mupdfdemo-1/libmupdf_java.so (opj_j2k_decode_tile+123)
I/DEBUG   (  143):     #03  pc 002259ce  /data/app-lib/com.artifex.mupdfdemo-1/libmupdf_java.so
I/DEBUG   (  143):     #04  pc 0021d77c  /data/app-lib/com.artifex.mupdfdemo-1/libmupdf_java.so
I/DEBUG   (  143):     #05  pc 002273a1  /data/app-lib/com.artifex.mupdfdemo-1/libmupdf_java.so (opj_j2k_decode+113)
I/DEBUG   (  143):     #06  pc 0022ada1  /data/app-lib/com.artifex.mupdfdemo-1/libmupdf_java.so (opj_jp2_decode+65)
I/DEBUG   (  143):     #07  pc 0019c167  /data/app-lib/com.artifex.mupdfdemo-1/libmupdf_java.so (opj_decode+71)
I/DEBUG   (  143):     #08  pc 00093abe  /data/app-lib/com.artifex.mupdfdemo-1/libmupdf_java.so
I/DEBUG   (  143):     #09  pc 000d4848  /data/app-lib/com.artifex.mupdfdemo-1/libmupdf_java.so
I/DEBUG   (  143):     #10  pc 000d4149  /data/app-lib/com.artifex.mupdfdemo-1/libmupdf_java.so
I/DEBUG   (  143):     #11  pc 000d4ab5  /data/app-lib/com.artifex.mupdfdemo-1/libmupdf_java.so (pdf_load_image+101)
I/DEBUG   (  143):     #12  pc 00140c87  /data/app-lib/com.artifex.mupdfdemo-1/libmupdf_java.so
I/DEBUG   (  143):     #13  pc 00142c69  /data/app-lib/com.artifex.mupdfdemo-1/libmupdf_java.so
I/DEBUG   (  143):     #14  pc 00143596  /data/app-lib/com.artifex.mupdfdemo-1/libmupdf_java.so
I/DEBUG   (  143):     #15  pc 00143b56  /data/app-lib/com.artifex.mupdfdemo-1/libmupdf_java.so (pdf_process_contents+470)
I/DEBUG   (  143):     #16  pc 000e5632  /data/app-lib/com.artifex.mupdfdemo-1/libmupdf_java.so
I/DEBUG   (  143):     #17  pc 000e588d  /data/app-lib/com.artifex.mupdfdemo-1/libmupdf_java.so (pdf_run_page_contents+237)
I/DEBUG   (  143):     #18  pc 0006861d  /data/app-lib/com.artifex.mupdfdemo-1/libmupdf_java.so (fz_run_page_contents+173)
I/DEBUG   (  143):     #19  pc 0003f4f3  /data/app-lib/com.artifex.mupdfdemo-1/libmupdf_java.so (Java_com_artifex_mupdfdemo_MuPDFCore_drawPage+2067)
I/DEBUG   (  143):     #20  pc 0002a4ab  /system/lib/libdvm.so (dvmPlatformInvoke+79)
I/DEBUG   (  143):     #21  pc 0011338f  [heap]
I/DEBUG   (  143):     #22  pc 00086da2  /system/lib/libdvm.so (dvmCallJNIMethod(unsigned int const*, JValue*, Method const*, Thread*)+434)
I/DEBUG   (  143):     #23  pc 0008b2b6  /system/lib/libdvm.so (dvmResolveNativeMethod(unsigned int const*, JValue*, Method const*, Thread*)+326)
I/DEBUG   (  143):     #24  pc 001775b8  /system/lib/libdvm.so
I/DEBUG   (  143):     #25  pc 00003dab  <unknown>
I/DEBUG   (  143):     #26  pc 0003b962  /system/lib/libdvm.so (dvmMterpStd(Thread*)+66)
I/DEBUG   (  143):     #27  pc 00037029  /system/lib/libdvm.so (dvmInterpret(Thread*, Method const*, JValue*)+217)
I/DEBUG   (  143):     #28  pc 000bd027  /system/lib/libdvm.so (dvmCallMethodV(Thread*, Method const*, Object*, bool, JValue*, char*)+759)
I/DEBUG   (  143):     #29  pc 000bd437  /system/lib/libdvm.so (dvmCallMethod(Thread*, Method const*, Object*, JValue*, ...)+55)
I/DEBUG   (  143):     #30  pc 000993c3  /system/lib/libdvm.so (interpThreadStart(void*)+995)
I/DEBUG   (  143):     #31  pc 0000bc7c  /system/lib/libc.so (__thread_entry+236)
I/DEBUG   (  143): 
I/DEBUG   (  143): stack:
I/DEBUG   (  143):          913f2b0c  00000100  
I/DEBUG   (  143):          913f2b10  00000800  
I/DEBUG   (  143):          913f2b14  00000c00  
I/DEBUG   (  143):          913f2b18  00000100  
I/DEBUG   (  143):          913f2b1c  00000000  
I/DEBUG   (  143):          913f2b20  909a2008  [anon:libc_malloc]
I/DEBUG   (  143):          913f2b24  00000000  
I/DEBUG   (  143):          913f2b28  b8f0281c  [heap]
I/DEBUG   (  143):          913f2b2c  00000100  
I/DEBUG   (  143):          913f2b30  b8f96610  [heap]
I/DEBUG   (  143):          913f2b34  00000080  
I/DEBUG   (  143):          913f2b38  00000080  
I/DEBUG   (  143):          913f2b3c  00000000  
I/DEBUG   (  143):          913f2b40  b8f96610  [heap]
I/DEBUG   (  143):          913f2b44  00000080  
I/DEBUG   (  143):          913f2b48  00000080  
I/DEBUG   (  143):     #00  913f2b4c  00002000  
I/DEBUG   (  143):          913f2b50  b8dbcd48  [heap]
I/DEBUG   (  143):          913f2b54  00000000  
I/DEBUG   (  143):          913f2b58  91d14e79  /data/app-lib/com.artifex.mupdfdemo-1/libmupdf_java.so (opj_mct_decode_real+9)
I/DEBUG   (  143):          913f2b5c  93d49e0c  /data/app-lib/com.artifex.mupdfdemo-1/libmupdf_java.so
I/DEBUG   (  143):          913f2b60  b8db00b0  [heap]
I/DEBUG   (  143):          913f2b64  00010000  
I/DEBUG   (  143):          913f2b68  b8d93300  [heap]
I/DEBUG   (  143):          913f2b6c  91d1c42d  /data/app-lib/com.artifex.mupdfdemo-1/libmupdf_java.so (opj_tcd_decode_tile+685)
I/DEBUG   (  143):     #01  913f2b70  909e4008  [anon:libc_malloc]
I/DEBUG   (  143):          913f2b74  909a3008  [anon:libc_malloc]
I/DEBUG   (  143):          913f2b78  90962008  [anon:libc_malloc]
I/DEBUG   (  143):          913f2b7c  00010000  
I/DEBUG   (  143):          913f2b80  913f2bcc  [stack:1873]
I/DEBUG   (  143):          913f2b84  00000000  
I/DEBUG   (  143):          913f2b88  b8d928f0  [heap]
I/DEBUG   (  143):          913f2b8c  b76e7455  /system/lib/libc.so (dlfree+885)
I/DEBUG   (  143):          913f2b90  b7774800  
I/DEBUG   (  143):          913f2b94  90a25008  [anon:libc_malloc]
I/DEBUG   (  143):          913f2b98  00000001  
I/DEBUG   (  143):          913f2b9c  00010000  
I/DEBUG   (  143):          913f2ba0  00000000  
I/DEBUG   (  143):          913f2ba4  b8dbce50  [heap]
I/DEBUG   (  143):          913f2ba8  90931000  [anon:libc_malloc]
I/DEBUG   (  143):          913f2bac  c61973c4  
I/DEBUG   (  143):          ........  ........
Can't open PDF file, MUPDF crash, it is look like JPEG 2000 inside

I/DEBUG   (  143):     #02  913f2bf0  b8d93300  [heap]
I/DEBUG   (  143):          913f2bf4  b8dd1b98  [heap]
I/DEBUG   (  143):          913f2bf8  00001094  
I/DEBUG   (  143):          913f2bfc  00000000  
I/DEBUG   (  143):          913f2c00  b8d928f0  [heap]
I/DEBUG   (  143):          913f2c04  b8d92384  [heap]
I/DEBUG   (  143):          913f2c08  b8dbca68  [heap]
I/DEBUG   (  143):          913f2c0c  b76e12b8  /system/lib/libc.so (realloc+40)
I/DEBUG   (  143):          913f2c10  b8dbca68  [heap]
I/DEBUG   (  143):          913f2c14  00030000  
I/DEBUG   (  143):          913f2c18  91d0dea9  /data/app-lib/com.artifex.mupdfdemo-1/libmupdf_java.so (opj_j2k_read_tile_header+9)
I/DEBUG   (  143):          913f2c1c  91d0e6d8  /data/app-lib/com.artifex.mupdfdemo-1/libmupdf_java.so (opj_j2k_decode_tile+8)
I/DEBUG   (  143):          913f2c20  93d49e0c  /data/app-lib/com.artifex.mupdfdemo-1/libmupdf_java.so
I/DEBUG   (  143):          913f2c24  b8d92438  [heap]
I/DEBUG   (  143):          913f2c28  b8d92384  [heap]
I/DEBUG   (  143):          913f2c2c  91d0e9cf  /data/app-lib/com.artifex.mupdfdemo-1/libmupdf_java.so
I/BootReceiver(  520): Copying /data/tombstones/tombstone_09 to DropBox (SYSTEM_TOMBSTONE)
D/dalvikvm(  520): GC_CONCURRENT freed 441K, 16% free 8132K/9592K, paused 1ms+0ms, total 7ms

Comment 1 foobnix 2016-07-25 07:43:36 UTC

Can't open Book, MUPDF crash, it is look like JPEG 2000 inside

Comment 2 foobnix 2016-07-25 13:12:12 UTC

It's reproduced only on x86 but on ARM works well

Comment 3 Sebastian Rasmussen 2016-07-27 11:38:47 UTC

While I can see a valgrind error when rendering this using Luratech JPX decoder (reported in 696871) I cannot reproduce this (inside our outside valgrind) using openjpeg on 32-bit Linux. Unfortunately I don't readily have access to 64-bit at the moment. All of this tested on the latest master of course.

Comment 4 Sebastian Rasmussen 2016-07-27 12:54:56 UTC

foobnix, when I attempt to reproduce this outside of Android I'm failing to see the issue you report. Have you seen the crash in the desktop client (if so, 64-bit only? Or also 32-bit?). If I need to setup the Android emulator to reproduce this then it would be useful to know how you configured it.

Comment 5 foobnix 2016-07-27 13:14:50 UTC

Sebastian Rasmussen, I am using  Ubuntu Linux 14.04, make build from git master run on Geanymotion Adnroid Emulator (https://www.genymotion.com/)
Platform Google Nexus 4 Android version 4.4.4

Comment 6 foobnix 2016-07-27 13:23:57 UTC

Sebastian Rasmussen, Ubuntu 14.04 64bit

Comment 7 Sebastian Rasmussen 2016-07-28 12:19:06 UTC

foobnix, we have tested your file on 32- and 64-bit desktop Linux and can't reproduce the problem. I've also tested on ARM android and not been able to reproduce it. Since there are SSE instructions in openjpeg these might be the cause. Do you mind recompiling using -mno-sse and testing again?

Comment 8 foobnix 2016-07-28 12:43:40 UTC

Sebastian Rasmussen,

LOCAL_CFLAGS += -mno-sse

Resolved the issue, works well as expected