Bug#886401: evince: Evince does not start: Error in `evince': double free or corruption (fasttop)

[Jason Crain]

Control: severity -1 important
Control: reassign -1 libfontconfig1 2.12.6-0.1
Control: affects -1 evince
Control: forcemerge 882590 -1

Crash appears to have happened while fontconfig was parsing a config
file.  If you have a customized fontconfig configuration it's possibly
triggering a bug in fontconfig.  Though memory corruption bugs are
tricky and can cause crashes in unrelated parts of the program.

I'm reassigning/merging this to fontconfig because your description
looks a lot like https://bugs.debian.org/882590.  According to some of
the comments in that bug, you could try downgrading libfontconfig1 or
removing your ~/.fonts.conf.  Keep a copy of your .fonts.conf though in
case it's useful for debugging.

Bug#886401: evince: Evince does not start: Error in `evince': double free or corruption (fasttop)

[Geoffrey Ferrari]

Hi Jason,

Sorry, I think that's beyond my expertise - there is no installable
package for evince-dbgsym and several in the debug repository and I'm
not competent enough to build these packages from scratch.

Geoffrey

On 5 January 2018 at 15:57, Jason Crain  wrote:
> Control: tags -1 + moreinfo
>
> On Fri, Jan 05, 2018 at 11:48:21AM +, Geoffrey Ferrari wrote:
>>* What led up to the situation?
>> Trying to run evince from command line or from gnome desktop, without or
>> without a pdf file to view.
>>
>>* What exactly did you do (or not do) that was effective (or
>>  ineffective)?
>> Tried executing "evince" from command line with no pdf file specified.
>>* What was the outcome of this action?
>>
>> The following error message is reported:
>> *** Error in `evince': double free or corruption (fasttop): 
>> 0x55884b31a380
>> ***
>
> Can you provide a backtrace with debug symbols?  You'll need to install
> at least evince-dbgsym, libevdocument3-4-dbgsym, libevview3-3-dbgsym,
> libglib2.0-0-dbgsym, libgtk-3-0-dbgsym, libpango-1.0-0-dbgsym,
> libpangoft2-1.0-0-dbgsym, libpangocairo-1.0-0-dbgsym,
> libfontconfig1-dbgsym, and libexpat1-dbgsym.
>
> https://wiki.debian.org/HowToGetABacktrace#Installing_the_debugging_symbols
> describes how to enable the repo for the dbgsym packages.

Bug#886401: evince: Evince does not start: Error in `evince': double free or corruption (fasttop)

[Jason Crain]

Control: tags -1 + moreinfo

On Fri, Jan 05, 2018 at 11:48:21AM +, Geoffrey Ferrari wrote:
>* What led up to the situation?
> Trying to run evince from command line or from gnome desktop, without or
> without a pdf file to view.
> 
>* What exactly did you do (or not do) that was effective (or
>  ineffective)?
> Tried executing "evince" from command line with no pdf file specified.
>* What was the outcome of this action?
> 
> The following error message is reported:
> *** Error in `evince': double free or corruption (fasttop): 0x55884b31a380
> ***

Can you provide a backtrace with debug symbols?  You'll need to install
at least evince-dbgsym, libevdocument3-4-dbgsym, libevview3-3-dbgsym,
libglib2.0-0-dbgsym, libgtk-3-0-dbgsym, libpango-1.0-0-dbgsym,
libpangoft2-1.0-0-dbgsym, libpangocairo-1.0-0-dbgsym,
libfontconfig1-dbgsym, and libexpat1-dbgsym.

https://wiki.debian.org/HowToGetABacktrace#Installing_the_debugging_symbols
describes how to enable the repo for the dbgsym packages.

Bug#886401: evince: Evince does not start: Error in `evince': double free or corruption (fasttop)

[Geoffrey Ferrari]

Package: evince
Version: 3.26.0-2
Severity: grave
Justification: renders package unusable

Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

   * What led up to the situation?
Trying to run evince from command line or from gnome desktop, without or
without a pdf file to view.

   * What exactly did you do (or not do) that was effective (or
 ineffective)?
Tried executing "evince" from command line with no pdf file specified.
   * What was the outcome of this action?

The following error message is reported:
*** Error in `evince': double free or corruption (fasttop): 0x55884b31a380
***
=== Backtrace: =
/lib/x86_64-linux-gnu/libc.so.6(+0x722fb)[0x7fe7fcdcf2fb]
/lib/x86_64-linux-gnu/libc.so.6(+0x7895e)[0x7fe7fcdd595e]
/lib/x86_64-linux-gnu/libc.so.6(+0x791be)[0x7fe7fcdd61be]
/usr/lib/x86_64-linux-
gnu/libfontconfig.so.1(FcConfigParseAndLoad+0x13a)[0x7fe7f9ccdd4a]
/usr/lib/x86_64-linux-gnu/libfontconfig.so.1(+0x2415e)[0x7fe7f9cce15e]
/lib/x86_64-linux-gnu/libexpat.so.1(+0xade8)[0x7fe7f6550de8]
/lib/x86_64-linux-gnu/libexpat.so.1(+0xbbbc)[0x7fe7f6551bbc]
/lib/x86_64-linux-gnu/libexpat.so.1(+0x9803)[0x7fe7f654f803]
/lib/x86_64-linux-gnu/libexpat.so.1(+0xa4c5)[0x7fe7f65504c5]
/lib/x86_64-linux-gnu/libexpat.so.1(XML_ParseBuffer+0x7d)[0x7fe7f655407d]
/usr/lib/x86_64-linux-gnu/libfontconfig.so.1(+0x23b43)[0x7fe7f9ccdb43]
/usr/lib/x86_64-linux-
gnu/libfontconfig.so.1(FcConfigParseAndLoad+0x366)[0x7fe7f9ccdf76]
/usr/lib/x86_64-linux-
gnu/libfontconfig.so.1(FcConfigParseAndLoad+0x3d8)[0x7fe7f9ccdfe8]
/usr/lib/x86_64-linux-gnu/libfontconfig.so.1(+0x2415e)[0x7fe7f9cce15e]
/lib/x86_64-linux-gnu/libexpat.so.1(+0xade8)[0x7fe7f6550de8]
/lib/x86_64-linux-gnu/libexpat.so.1(+0xbbbc)[0x7fe7f6551bbc]
/lib/x86_64-linux-gnu/libexpat.so.1(+0x9803)[0x7fe7f654f803]
/lib/x86_64-linux-gnu/libexpat.so.1(+0xa4c5)[0x7fe7f65504c5]
/lib/x86_64-linux-gnu/libexpat.so.1(XML_ParseBuffer+0x7d)[0x7fe7f655407d]
/usr/lib/x86_64-linux-gnu/libfontconfig.so.1(+0x23b43)[0x7fe7f9ccdb43]
/usr/lib/x86_64-linux-
gnu/libfontconfig.so.1(FcConfigParseAndLoad+0x366)[0x7fe7f9ccdf76]
/usr/lib/x86_64-linux-gnu/libfontconfig.so.1(+0x16d34)[0x7fe7f9cc0d34]
/usr/lib/x86_64-linux-gnu/libfontconfig.so.1(+0x16f86)[0x7fe7f9cc0f86]
/usr/lib/x86_64-linux-gnu/libfontconfig.so.1(+0xaa57)[0x7fe7f9cb4a57]
/usr/lib/x86_64-linux-
gnu/libfontconfig.so.1(FcConfigSubstituteWithPat+0xa15)[0x7fe7f9cb6ae5]
/usr/lib/x86_64-linux-gnu/libpangocairo-1.0.so.0(+0x9728)[0x7fe7feaf6728]
/usr/lib/x86_64-linux-gnu/libpangoft2-1.0.so.0(+0xa562)[0x7fe7f9ef9562]
/usr/lib/x86_64-linux-gnu/libpango-1.0.so.0(+0x17a67)[0x7fe7fe8b7a67]
/usr/lib/x86_64-linux-
gnu/libpango-1.0.so.0(pango_itemize_with_base_dir+0xa0)[0x7fe7fe8b90c0]
/usr/lib/x86_64-linux-gnu/libpango-1.0.so.0(+0x2175d)[0x7fe7fe8c175d]
/usr/lib/x86_64-linux-
gnu/libpango-1.0.so.0(pango_layout_get_unknown_glyphs_count+0x32)[0x7fe7fe8c2b42]
/usr/lib/x86_64-linux-gnu/libgtk-3.so.0(+0x1a3aaa)[0x7fe7ff195aaa]
/usr/lib/x86_64-linux-gnu/libgtk-3.so.0(+0x1a3b18)[0x7fe7ff195b18]
/usr/lib/x86_64-linux-gnu/libgtk-3.so.0(+0x1a3c88)[0x7fe7ff195c88]
/usr/lib/x86_64-linux-
gnu/libgobject-2.0.so.0(g_type_create_instance+0x1e5)[0x7fe7fd979735]
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0(+0x155d8)[0x7fe7fd95a5d8]
/usr/lib/x86_64-linux-
gnu/libgobject-2.0.so.0(g_object_new_with_properties+0x2f5)[0x7fe7fd95bd75]
/usr/lib/x86_64-linux-
gnu/libgobject-2.0.so.0(g_object_new+0xc1)[0x7fe7fd95c7f1]
evince(+0x4dd15)[0x558849189d15]
/usr/lib/x86_64-linux-
gnu/libgobject-2.0.so.0(g_type_create_instance+0x1e5)[0x7fe7fd979735]
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0(+0x155d8)[0x7fe7fd95a5d8]
/usr/lib/x86_64-linux-
gnu/libgobject-2.0.so.0(g_object_new_with_properties+0x2f5)[0x7fe7fd95bd75]
/usr/lib/x86_64-linux-
gnu/libgobject-2.0.so.0(g_object_new+0xc1)[0x7fe7fd95c7f1]
evince(+0x2cfe0)[0x558849168fe0]
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0(+0x15790)[0x7fe7fd95a790]
/usr/lib/x86_64-linux-
gnu/libgobject-2.0.so.0(g_object_new_valist+0x3d0)[0x7fe7fd95c450]
/usr/lib/x86_64-linux-
gnu/libgobject-2.0.so.0(g_object_new+0x99)[0x7fe7fd95c7c9]
evince(+0x2d4f2)[0x5588491694f2]
evince(+0x39ba3)[0x558849175ba3]
/usr/lib/x86_64-linux-
gnu/libgobject-2.0.so.0(g_type_create_instance+0x1e5)[0x7fe7fd979735]
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0(+0x155d8)[0x7fe7fd95a5d8]
/usr/lib/x86_64-linux-
gnu/libgobject-2.0.so.0(g_object_new_valist+0x3d0)[0x7fe7fd95c450]
/usr/lib/x86_64-linux-
gnu/libgobject-2.0.so.0(g_object_new+0x99)[0x7fe7fd95c7c9]
evince(+0x3ba7b)[0x558849177a7b]
evince(+0x24015)[0x558849160015]
evince(+0x1fc44)[0x55884915bc44]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf1)[0x7fe7fcd7d561]
evince(+0x1fdaa)[0x55884915bdaa]
=== Memory map: 
55884913c000-5588491a3000 r-xp  08:01 1060629
/usr/bin/evince
5588493a2000-5588493a7000 r--p 00066000 08:01 1060629
/usr/bin/evince
5588493a7000-5588493a8000 rw-p 0006b000 08:01 1060629
/usr/bin/evince
55884aff-55884b32f000