Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 365765

Summary: media-gfx/xv-3.10a-r15: crash after png_free_default()
Product: Gentoo Linux Reporter: Martin Mokrejš <mmokrejs>
Component: Current packagesAssignee: Joe Peterson (RETIRED) <lavajoe>
Status: RESOLVED DUPLICATE    
Severity: normal CC: transacid
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard:
Package list:
Runtime testing required: ---

Description Martin Mokrejš 2011-05-02 22:14:30 UTC
Hi,
  xv is crashing for me occasionally. For example, now I tried to crash it again and it crashed when I kept pressing [enter] button for a while:


Program terminated with signal 11, Segmentation fault.
#0  0xb7570e08 in _int_free (av=<value optimized out>, p=0x82a2138) at malloc.c:4964
4964    malloc.c: No such file or directory.
        in malloc.c
(gdb) where
#0  0xb7570e08 in _int_free (av=<value optimized out>, p=0x82a2138) at malloc.c:4964
#1  0xb75743ad in __libc_free (mem=0x82a2178) at malloc.c:3738
#2  0xb76e0779 in png_free_default (png_ptr=0x82a1d18, ptr=0x49472068) at pngmem.c:555
#3  0xb76e07c4 in png_free (png_ptr=0x49472068, ptr=0x74697720) at pngmem.c:539
#4  0xb76c9e2f in png_free_data (png_ptr=0x82a1d18, info_ptr=0x82a2008, mask=32767, num=-1) at png.c:269
#5  0xb76c9fb9 in png_info_destroy (png_ptr=0x82a1d18, info_ptr=0x82a2008) at png.c:453
#6  0xb76d540c in png_read_destroy (png_ptr=0x82a1d18, info_ptr=0x49472068, end_info_ptr=0x0) at pngread.c:1059
#7  0xb76d58a7 in png_destroy_read_struct (png_ptr_ptr=0xbfadee0c, info_ptr_ptr=0xbfadee08, end_info_ptr_ptr=0x0) at pngread.c:998
#8  0x080d17e8 in LoadPNG (
    fname=0xbfadf958 "/home/xxxx/file.png", 
    pinfo=0xbfadeee8) at xvpng.c:1130
#9  0x0805097f in openPic (filenum=<value optimized out>) at xv.c:2511
#10 0x0805268d in mainLoop () at xv.c:3813
#11 0x08055f15 in main (argc=2, argv=0xbfadfe84) at xv.c:1037
(gdb) bt full
#0  0xb7570e08 in _int_free (av=<value optimized out>, p=0x82a2138) at malloc.c:4964
        size = 312
        nextchunk = 0x82a2270
        nextsize = 32
        prevsize = <value optimized out>
        bck = 0x49472068
        fwd = <value optimized out>
        errstr = <value optimized out>
        __func__ = "_int_free"
#1  0xb75743ad in __libc_free (mem=0x82a2178) at malloc.c:3738
        ar_ptr = 0xb765b3a0
        p = 0x74697720
#2  0xb76e0779 in png_free_default (png_ptr=0x82a1d18, ptr=0x49472068) at pngmem.c:555
No locals.
#3  0xb76e07c4 in png_free (png_ptr=0x49472068, ptr=0x74697720) at pngmem.c:539
No locals.
#4  0xb76c9e2f in png_free_data (png_ptr=0x82a1d18, info_ptr=0x82a2008, mask=32767, num=-1) at png.c:269
        i = <value optimized out>
#5  0xb76c9fb9 in png_info_destroy (png_ptr=0x82a1d18, info_ptr=0x82a2008) at png.c:453
No locals.
#6  0xb76d540c in png_read_destroy (png_ptr=0x82a1d18, info_ptr=0x49472068, end_info_ptr=0x0) at pngread.c:1059
        tmp_jmp = {{__jmpbuf = {0, -1079120664, -1217603108, 136977688, 0, 0}, __mask_was_saved = 1145980233, __saved_mask = {__val = {4, 0, 2, 3077472244, 136978072, 
                3215846789, 3215846824, 3077396974, 136977688, 136978440, 0, 3077472244, 136977688, 3077462832, 3215846780, 3215846790, 3215846785, 3215846795, 3075939982, 
                136978068, 4, 2046820352, 7624788, 1397641844, 1296659456, 1165230149, 1929409624, 2, 32, 2, 11, 1879069769}}}}
        error_fn = <value optimized out>
        warning_fn = 0x82a1e94
        error_ptr = 0x4
        free_fn = 0xb76e7ff4
#7  0xb76d58a7 in png_destroy_read_struct (png_ptr_ptr=0xbfadee0c, info_ptr_ptr=0xbfadee08, end_info_ptr_ptr=0x0) at pngread.c:998
        png_ptr = 0x82a1d18
        info_ptr = <value optimized out>
        end_info_ptr = 0x0
        free_fn = 0
        mem_ptr = 0x0
#8  0x080d17e8 in LoadPNG (
    fname=0xbfadf958 "/home/xxxx/file.png", 
    pinfo=0xbfadeee8) at xvpng.c:1130
        fp = 0x82a1bb0
        png_ptr = 0x82a1d18
        info_ptr = 0x82a2008
        my_background = {index = 255 '\377', red = 0, green = 0, blue = 0, gray = 0}
        i = 28
        j = 28
        linesize = -1079120152
        bufsize = <value optimized out>
        filesize = 125056
        pass = 1
        gray_to_rgb = <value optimized out>
        commentsize = 3215847144
#9  0x0805097f in openPic (filenum=<value optimized out>) at xv.c:2511
        pinfo = {pic = 0xb6d90008 '?' <repeats 200 times>..., w = 1123, h = 666, type = 1, r = '\000' <repeats 255 times>, g = '\000' <repeats 255 times>, 
          b = '\000' <repeats 255 times>, normw = 1123, normh = 666, frmType = 0, colType = 0, 
          fullInfo = "PNG, 24 bit truecolor, non-interlaced. (125056 bytes)", '\000' <repeats 74 times>, shrtInfo = "1123x666 PNG", '\000' <repeats 115 times>, 
          comment = 0x82a2130 "Comment::Created with GIMP\n", exifInfo = 0x0, exifInfoSize = 0, numpages = 1, pagebname = '\000' <repeats 63 times>}
---Type <return> to continue, or q <return> to quit---
        i = <value optimized out>
        filetype = 20
        freename = 1
        frompipe = 0
        frompoll = 0
        fromint = 0
        killpage = 0
        oldeWIDE = 1123
        oldeHIGH = 666
        oldpWIDE = 0
        oldpHIGH = 0
        oldCXOFF = 0
        oldCYOFF = 0
        oldCWIDE = 0
        oldCHIGH = 0
        wascropped = 0
        tmp = <value optimized out>
        fullname = <value optimized out>
        filename = "/home/xxxx/file.png\000\205\267\030\320(\b\t\000\000\000(\372\255\277\214rx\267\030\320(\b\260\372\255\277\000\000\000\000\000\260t\267\300Ju\267\364(\372\255\277.hx\267\030\320(\b\214\362)\b\000\000\000\000\364\354\362)\b\020\373\255\277h\372\255\277\\Nw\267\030\320(\b\260\372\255\277\000\000\000\000\000\000\000\000\001\000\000\000\r\377\000\000\000\000\000\000\001"...
#10 0x0805268d in mainLoop () at xv.c:3813
        j = <value optimized out>
        i = 1229398120
#11 0x08055f15 in main (argc=2, argv=0xbfadfe84) at xv.c:1037
        i = <value optimized out>
        ecdef = {pixel = 9148853, red = 35584, green = 39168, blue = 46336, flags = 7 '\a', pad = -65 '\277'}
        rootReturn = 125
        parentReturn = 0
        children = 0x829cf80
        numChildren = 65
(gdb)


# emerge --info
Portage 2.1.9.43 (default/linux/x86/10.0/desktop, gcc-4.5.2, glibc-2.12.1-r3, 2.6.27.58 i686)
=================================================================
System uname: Linux-2.6.27.58-i686-Mobile_Intel-R-_Pentium-R-_4_-_M_CPU_1.80GHz-with-gentoo-2.0.1
Timestamp of tree: Sat, 30 Apr 2011 08:15:01 +0000
distcc 3.1 i686-pc-linux-gnu [enabled]
app-shells/bash:     4.2_p8
dev-java/java-config: 1.3.7-r1, 2.1.11-r3
dev-lang/python:     2.5.4-r4, 2.6.6-r1, 2.7.1, 3.1.3
dev-util/cmake:      2.8.4
sys-apps/baselayout: 2.0.1-r1
sys-apps/openrc:     0.7.0
sys-apps/sandbox:    2.5
sys-devel/autoconf:  2.13::<unknown repository>, 2.68
sys-devel/automake:  1.4_p6-r1, 1.5-r1, 1.6.3-r1, 1.7.9-r2, 1.8.5-r4, 1.9.6-r3, 1.10.3, 1.11.1
sys-devel/binutils:  2.21
sys-devel/gcc:       3.3.6-r1, 4.2.4-r1, 4.3.5, 4.4.5, 4.5.2
sys-devel/gcc-config: 1.4.1
sys-devel/libtool:   2.4-r1
sys-devel/make:      3.81-r2
sys-kernel/linux-headers: 2.6.36.1
sys-libs/glibc:      2.12.1-r3
virtual/os-headers:  2.6.36.1 (sys-kernel/linux-headers)
ACCEPT_KEYWORDS="x86 ~x86"
ACCEPT_LICENSE="* -@EULA dlj-1.1 sun-bcla-java-vm Nero-EULA-US skype-eula AdobeFlash AdobeFlash-10 AdobeFlash-10.1 PUEL"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2 -march=pentium4 -mmmx -msse -msse2 -pipe -fno-strict-aliasing -ggdb"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/openvpn/easy-rsa /var/bind /var/lib/hsqldb /var/qmail/alias /var/qmail/control /var/vpopmail/etc"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/php/apache2-php5.2/ext-active/ /etc/php/apache2-php5.3/ext-active/ /etc/php/cgi-php5.2/ext-active/ /etc/php/cgi-php5.3/ext-active/ /etc/php/cli-php5.2/ext-active/ /etc/php/cli-php5.3/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c"
CXXFLAGS="-O2 -march=pentium4 -mmmx -msse -msse2 -pipe -fno-strict-aliasing -ggdb"
DISTDIR="/usr/portage/distfiles"
FEATURES="assume-digests binpkg-logs distcc distlocks fixlafiles fixpackages metadata-transfer news nostrip parallel-fetch protect-owned sandbox sfperms splitdebug strict unknown-features-warn unmerge-logs unmerge-orphans userfetch"
FFLAGS=""
GENTOO_MIRRORS="http://gentoo.mirror.web4u.cz"
LDFLAGS="-Wl,-O1 -Wl,--as-needed"
LINGUAS="en cs cz"
MAKEOPTS="-j6"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage /home/mmokrejs/proj/sci"
SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage"
USE="32bit 7zip R X Xaw3d a52 aac aalib ace acl acpi alsa amr amrnb amrwb apache apache2 audacious audiofile bash-completion bcmath berkdb blas bluetooth boost branding bzip2 cairo caps cblas cddb cdparanoia cdr cgi clamav cli colordiff compress consolekit cpio cracklib crypt cscope css ctype cups curl curlwrappers cxx dbi dbus dga dia directfb djbfft dri dts dv dvb dvd dvdr dvdread emboss emf enblend encode enscript exif expat faad fam fame fat fbcon ffmpeg fftw firefox flac flash fontconfig fortran fpx ftp gcj gd gdbm gdu ggi gif gimp gimpprint glibc-compat20 glibc-omitfp glut gmp gnuplot gnutls gpgme gphoto2 gpm graphviz gs gsl gsm gtk gtkhtml hdf hdf5 hp2xx i8x0 iconv icu id3 id3tag ieee1394 imagemagick imlib inifile innodb ithreads jack java javascript jbig jce jikes jpeg jpeg2k kdtree kerberos ladspa lame lapack laptop lcms leim libcaca libnotify libwww live lzo lzw mad maildir matroska mhash mikmod mime ming mjpeg mmap mmx mng mod_python modperl modplug modules motif mozilla moznoirc mp2 mp3 mp4 mpeg mpi mpi_njtree mpich2 mplayer mudflap mule musepack mxdatetime mysql mysqli nat ncurses netcdf netpbm network nls nntp nptl nptlonly nsplugin ntfs numeric objc ogg opengl openmp openssl pam pango parport pcmcia pcntl pcre pdf perl php plotutils plugin png pnm policykit postproc postscript ppds pppd procmail pymol python qt3support qt4 quicktime rar raw readline recode reiserfs romio rpm samba sasl scanner scp sdl seamonkey server session sftp sift slp smime sndfile soap sockets spell sqlite srt sse sse2 ssl startup-notification static-libs subtitles subversion svg svgz sysfs sysvipc t1lib tcl tcpd theora threads tidy tiff tk transcode truetype udev unicode urandom usb userlocales utils uuencode v4l v4l2 vcd vhook vim-syntax vim-with-x vorbis wavpack wifi win32codecs wmf wxwindows x264 x86 xanim xcb xcf xfs xft xinerama xinetd xml xorg xpm xsl xslt xulrunner xv xvid xvmc yv12 zip zlib" ALSA_CARDS="intel-8x0m" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic auth_digest authn_anon authn_dbd authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dbd deflate dir disk_cache env expires ext_filter file_cache filter headers icu ident imagemap include info log_config mem_cache mime mime_magic php rewrite setenvif speling status unique_id userdir usertrack vhost_alias negotiation" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ubx" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="en cs cz" PHP_TARGETS="php5-3" RUBY_TARGETS="ruby18" USERLAND="GNU" VIDEO_CARDS="radeon vesa" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" 
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS

# emerge -pv xv

These are the packages that would be merged, in order:

Calculating dependencies... done!
[ebuild   R   ] media-gfx/xv-3.10a-r15  USE="jpeg png tiff" 3,539 kB
Comment 1 Jeroen Roovers (RETIRED) gentoo-dev 2011-05-06 03:58:46 UTC
Please post the output of `emerge -vpq libpng'.
Comment 2 Martin Mokrejš 2011-05-06 06:35:02 UTC
[ebuild     U ] media-libs/libpng-1.4.7 [1.4.5] USE="static-libs -apng%"
Comment 3 Joe Peterson (RETIRED) gentoo-dev 2011-05-11 15:15:10 UTC
Can you get it to happen without "static-libs" set on libpng?  What about with "apng"?

Also, can you give some more detail on exactly how you got it to crash?  When were you hitting enter (i.e. after the image was being displayed), and in what window?
Comment 4 Martin Mokrejš 2011-05-12 08:03:04 UTC
I pres enter in the image window (not in the management menu window, that one was sent into the background using mouse right click).

So I tried:

USE=apng emerge xv 
[cut]
i686-pc-linux-gnu-gcc -O2 -march=pentium4 -mmmx -msse -msse2 -pipe -fno-strict-aliasing -ggdb -DUSE_GETCWD -DLINUX -DUSLEEP -DDOJPEG -DDOPNG -DDOTIFF -DUSE_TILED_TIFF_BOTLEFT_FIX   -I/usr/include     -DDOPDS    -DMGCSFXDIR=\"/var/tmp/portage/media-gfx/xv-3.10a-r15/temp\"          -DDOCDIR=\"/usr/share/doc/xv-3.10a-r15\" -DSYSCONFDIR=\"/etc\" -DXVEXECPATH=\"/var/tmp/portage/media-gfx/xv-3.10a-r15/temp\" -Wl,-O1 -Wl,--as-needed -o xv xv.o xvevent.o xvroot.o xvmisc.o xvimage.o xvcolor.o xvsmooth.o xv24to8.o xvgif.o xvpm.o xvinfo.o xvctrl.o xvscrl.o xvalg.o xvgifwr.o xvdir.o xvbutt.o xvpbm.o xvxbm.o xvgam.o xvbmp.o xvdial.o xvgraf.o xvsunras.o xvjpeg.o xvps.o xvpopup.o xvdflt.o xvtiff.o xvtiffwr.o xvpds.o xvrle.o xviris.o xvgrab.o vprintf.o xvbrowse.o xvtext.o xvpcx.o xviff.o xvtarga.o xvxpm.o xvcut.o xvxwd.o xvfits.o xvpng.o xvzx.o xvwbmp.o xvpcd.o xvhips.o xvmag.o xvpic.o xvmaki.o xvpi.o xvpic2.o xvvd.o xvmgcsfx.o xvml.o xvjp2k.o    -L/usr/lib -lz  -L/usr/X11R6/lib -lX11 -lm -ljpeg -lz -lpng -ltiff
# ldd /usr/bin/xv
        linux-gate.so.1 =>  (0xffffe000)
        libz.so.1 => /lib/libz.so.1 (0xb773c000)
        libX11.so.6 => /usr/lib/libX11.so.6 (0xb7625000)
        libm.so.6 => /lib/libm.so.6 (0xb75ff000)
        libjpeg.so.8 => /usr/lib/libjpeg.so.8 (0xb75c4000)
        libpng14.so.14 => /usr/lib/libpng14.so.14 (0xb759f000)
        libtiff.so.5 => /usr/lib/libtiff.so.5 (0xb7538000)
        libc.so.6 => /lib/libc.so.6 (0xb73de000)
        libxcb.so.1 => /usr/lib/libxcb.so.1 (0xb73c4000)
        libdl.so.2 => /lib/libdl.so.2 (0xb73c0000)
        /lib/ld-linux.so.2 (0xb7784000)
        libjbig.so => /usr/lib/libjbig.so (0xb73b3000)
        libXau.so.6 => /usr/lib/libXau.so.6 (0xb73af000)
        libXdmcp.so.6 => /usr/lib/libXdmcp.so.6 (0xb73a9000)
#
That gives me a not working binary altogether:

$ /usr/bin/xv file.png
Segmentation fault (core dumped)
$ 

with a *different* stracktrace

(gdb) where
#0  _xcb_map_remove (list=0x828d9c0, key=2771) at xcb_list.c:89
#1  0xb7363afe in poll_for_reply (c=0x828dc40, request=<value optimized out>, reply=0xbfd726ec, error=0xbfd7274c) at xcb_in.c:297
#2  0xb7363f17 in xcb_wait_for_reply (c=0x828dc40, request=2771, e=0xbfd7274c) at xcb_in.c:377
#3  0xb75f4b85 in _XReply (dpy=0x828d018, rep=0xbfd72790, extra=0, discard=1) at xcb_io.c:533
#4  0xb75da425 in XAllocColor (dpy=0x828d018, cmap=32, def=0xbfd72840) at GetHColor.c:48
#5  0x080671ec in screen_init (pic24=0xb70fe008 '?' <repeats 200 times>..., wide=1123, high=666) at xvimage.c:140
#6  Pic24ToXImage (pic24=0xb70fe008 '?' <repeats 200 times>..., wide=1123, high=666) at xvimage.c:2190
#7  0x08068db9 in CreateXImage () at xvimage.c:1735
#8  0x080519a0 in openPic (filenum=0) at xv.c:2917
#9  0x0805303d in openFirstPic () at xv.c:3657
#10 mainLoop () at xv.c:3776
#11 0x08055fe0 in main (argc=2, argv=0xbfd73864) at xv.c:1037
(gdb) bt full
#0  _xcb_map_remove (list=0x828d9c0, key=2771) at xcb_list.c:89
        cur = 0x828d9c0
#1  0xb7363afe in poll_for_reply (c=0x828dc40, request=<value optimized out>, reply=0xbfd726ec, error=0xbfd7274c) at xcb_in.c:297
        head = <value optimized out>
#2  0xb7363f17 in xcb_wait_for_reply (c=0x828dc40, request=2771, e=0xbfd7274c) at xcb_in.c:377
        cond = {__data = {__lock = 0, __futex = 0, __total_seq = 0, __wakeup_seq = 0, __woken_seq = 0, __mutex = 0x0, __nwaiters = 0, __broadcast_seq = 0}, 
          __size = '\000' <repeats 47 times>, __align = 0}
        reader = {request = 2771, data = 0xbfd726b0, next = 0x0}
        prev_reader = <value optimized out>
        widened_request = <value optimized out>
        ret = 0x0
#3  0xb75f4b85 in _XReply (dpy=0x828d018, rep=0xbfd72790, extra=0, discard=1) at xcb_io.c:533
        error = 0x0
        c = 0x828dc40
        current = <value optimized out>
        __PRETTY_FUNCTION__ = "_XReply"
#4  0xb75da425 in XAllocColor (dpy=0x828d018, cmap=32, def=0xbfd72840) at GetHColor.c:48
        status = <value optimized out>
        rep = {type = 0 '\000', pad1 = 0 '\000', sequenceNumber = 0, length = 1, red = 37828, green = 2066, blue = 0, pad2 = 0, pixel = 3076268176, pad3 = 0, pad4 = 135476832, 
          pad5 = 3218548800}
#5  0x080671ec in screen_init (pic24=0xb70fe008 '?' <repeats 200 times>..., wide=1123, high=666) at xvimage.c:140
        check_map = 23069562
        check_col = {pixel = 1123, red = 0, green = 0, blue = 0, flags = -41 '\327', pad = -65 '\277'}
        ci = <value optimized out>
        i = <value optimized out>
        init_flag = 1
        check_gc = 0x829ef20
        check_image = <value optimized out>
#6  Pic24ToXImage (pic24=0xb70fe008 '?' <repeats 200 times>..., wide=1123, high=666) at xvimage.c:2190
        xcol = <value optimized out>
        imagedata = 0xb6e23008 ""
        lip = <value optimized out>
        pp = <value optimized out>
        bperpix = 32
        bperline = 4492
        ip = <value optimized out>
        i = <value optimized out>
        j = <value optimized out>
        xim = 0x829edd8
#7  0x08068db9 in CreateXImage () at xvimage.c:1735
No locals.
---Type <return> to continue, or q <return> to quit---
#8  0x080519a0 in openPic (filenum=0) at xv.c:2917
        pinfo = {pic = 0xb70fe008 '?' <repeats 200 times>..., w = 1123, h = 666, type = 1, r = '\000' <repeats 255 times>, g = '\000' <repeats 255 times>, 
          b = '\000' <repeats 255 times>, normw = 1123, normh = 666, frmType = 0, colType = 0, 
          fullInfo = "PNG, 24 bit truecolor, non-interlaced. (125056 bytes)", '\000' <repeats 74 times>, shrtInfo = "1123x666 PNG", '\000' <repeats 115 times>, 
          comment = 0x828d9b0 "Comment::Created with GIMP\n", exifInfo = 0x0, exifInfoSize = 0, numpages = 1, pagebname = '\000' <repeats 63 times>}
        i = <value optimized out>
        filetype = <value optimized out>
        freename = 1
        frompipe = 0
        frompoll = 0
        fromint = 0
        killpage = <value optimized out>
        oldeWIDE = 0
        oldeHIGH = 0
        oldpWIDE = 0
        oldpHIGH = 0
        oldCXOFF = 0
        oldCYOFF = 0
        oldCWIDE = 0
        oldCHIGH = 0
        wascropped = 0
        tmp = <value optimized out>
        fullname = 0x829eea8 "/home/xxx/file.png"
        filename = "/home/xxx/file.png\000\000$$$$HHHHmmmm\221\221\221\221\266\266\266\266\332\332\332\332\377\377\377\377\000\000\000\000$$$$HHHHmmmm\221\221\221\221\266\266\266\266\332\332\332\332\377\377\377\377\000\000\000\000$$$$HHHHmmmm\221\221\221\221\266\266\266\266\332\332\332\332\377\377\377\377\000\000\000\000$$$$HHHHmmmm\221\221\221\221\266\266\266\266\332\332\332\332\377\377\377\377\000\000\000\000$$$$HHHHmmmm\221\221\221\221\266\266\266\266\332\332\332\332\377\377\377\377", '\000' <repeats 32 times>, '$' <repeats 32 times>...
#9  0x0805303d in openFirstPic () at xv.c:3657
        i = 0
#10 mainLoop () at xv.c:3776
        i = <value optimized out>
#11 0x08055fe0 in main (argc=2, argv=0xbfd73864) at xv.c:1037
        i = <value optimized out>
        ecdef = {pixel = 9148853, red = 35584, green = 39168, blue = 46336, flags = 7 '\a', pad = -65 '\277'}
        rootReturn = 125
        parentReturn = 0
        children = 0x829cfa8
        numChildren = 75
        rootDEEP = <value optimized out>
(gdb)
Comment 5 Martin Mokrejš 2011-05-12 08:12:31 UTC
(In reply to comment #4)
> I pres enter in the image window (not in the management menu window, that one
> was sent into the background using mouse right click).
> 
> So I tried:
> 
> USE=apng emerge xv 

And anyway, the apng USE flag was meant for libpng, so the below test proved nothing.


> $ /usr/bin/xv file.png
> Segmentation fault (core dumped)
> $ 
> 
> with a *different* stracktrace
> 
> (gdb) where
> #0  _xcb_map_remove (list=0x828d9c0, key=2771) at xcb_list.c:89
> #1  0xb7363afe in poll_for_reply (c=0x828dc40, request=<value optimized out>,
> reply=0xbfd726ec, error=0xbfd7274c) at xcb_in.c:297
> #2  0xb7363f17 in xcb_wait_for_reply (c=0x828dc40, request=2771, e=0xbfd7274c)
> at xcb_in.c:377
> #3  0xb75f4b85 in _XReply (dpy=0x828d018, rep=0xbfd72790, extra=0, discard=1)
> at xcb_io.c:533
> #4  0xb75da425 in XAllocColor (dpy=0x828d018, cmap=32, def=0xbfd72840) at
> GetHColor.c:48
> #5  0x080671ec in screen_init (pic24=0xb70fe008 '?' <repeats 200 times>...,
> wide=1123, high=666) at xvimage.c:140
> #6  Pic24ToXImage (pic24=0xb70fe008 '?' <repeats 200 times>..., wide=1123,
> high=666) at xvimage.c:2190
> #7  0x08068db9 in CreateXImage () at xvimage.c:1735
> #8  0x080519a0 in openPic (filenum=0) at xv.c:2917
> #9  0x0805303d in openFirstPic () at xv.c:3657
> #10 mainLoop () at xv.c:3776
> #11 0x08055fe0 in main (argc=2, argv=0xbfd73864) at xv.c:1037
> (gdb)

Sorry, that I already reported elsewhere, I forgot I was getting two, different stacktraces from xv.

https://bugs.freedesktop.org/show_bug.cgi?id=36716
Comment 6 Martin Mokrejš 2011-05-12 08:23:19 UTC
So now, have recompile libpng with apng set, recompiled xv:
xv crashed on the [enter] key:

(gdb) where
#0  0xffffe424 in __kernel_vsyscall ()
#1  0xb74da6f1 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#2  0xb74dbe32 in abort () at abort.c:92
#3  0xb7515b85 in __libc_message (do_abort=2, fmt=0xb75e6fa0 "*** glibc detected *** %s: %s: 0x%s ***\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:186
#4  0xb751ba41 in malloc_printerr (action=<value optimized out>, str=0x6 <Address 0x6 out of bounds>, ptr=0x829e388) at malloc.c:6283
#5  0xb751d2c0 in _int_free (av=<value optimized out>, p=<value optimized out>) at malloc.c:4795
#6  0xb75203ad in __libc_free (mem=0x829e388) at malloc.c:3738
#7  0x08067c20 in KillOldPics () at xvimage.c:1465
#8  0x080515cc in openPic (filenum=0) at xv.c:2611
#9  0x08053125 in mainLoop () at xv.c:3813
#10 0x08055fe0 in main (argc=2, argv=0xbf881754) at xv.c:1037
(gdb) bt full
#0  0xffffe424 in __kernel_vsyscall ()
No symbol table info available.
#1  0xb74da6f1 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
        resultvar = <value optimized out>
        pid = -1218420748
        selftid = 8859
#2  0xb74dbe32 in abort () at abort.c:92
        act = {__sigaction_handler = {sa_handler = 0xb78774c4 <_rtld_local+1220>, sa_sigaction = 0xb78774c4 <_rtld_local+1220>}, sa_mask = {__val = {4293984256, 136889680, 
              134521892, 3213361368, 4266, 3213361336, 134516868, 3213361180, 4, 3213361264, 3075958129, 14, 136889680, 3213361264, 3076546548, 9, 3213362724, 3213361384, 
              3076069412, 4, 3213361264, 4, 0, 3213361360, 3213361372, 2, 3076406505, 3076406501, 3076402049, 3076402075, 230, 3213361264}}, sa_flags = -1081605960, 
          sa_restorer = 0xb75e5039}
        sigs = {__val = {32, 0 <repeats 31 times>}}
#3  0xb7515b85 in __libc_message (do_abort=2, fmt=0xb75e6fa0 "*** glibc detected *** %s: %s: 0x%s ***\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:186
        ap = <value optimized out>
        fd = -1081605600
        on_2 = <value optimized out>
        list = <value optimized out>
        nlist = <value optimized out>
        cp = <value optimized out>
        written = false
#4  0xb751ba41 in malloc_printerr (action=<value optimized out>, str=0x6 <Address 0x6 out of bounds>, ptr=0x829e388) at malloc.c:6283
        buf = "0829e388"
        cp = <value optimized out>
#5  0xb751d2c0 in _int_free (av=<value optimized out>, p=<value optimized out>) at malloc.c:4795
        size = 16
        nextchunk = 0x229b
        nextsize = 136965768
        prevsize = <value optimized out>
        bck = <value optimized out>
        fwd = <value optimized out>
        errstr = 0x6 <Address 0x6 out of bounds>
        __func__ = "_int_free"
#6  0xb75203ad in __libc_free (mem=0x829e388) at malloc.c:3738
        ar_ptr = 0xb76073a0
        p = 0x6
#7  0x08067c20 in KillOldPics () at xvimage.c:1465
No locals.
#8  0x080515cc in openPic (filenum=0) at xv.c:2611
        pinfo = {pic = 0xb6d3c008 '?' <repeats 200 times>..., w = 1123, h = 666, type = 1, r = '\000' <repeats 255 times>, g = '\000' <repeats 255 times>, 
          b = '\000' <repeats 255 times>, normw = 1123, normh = 666, frmType = 0, colType = 0, 
          fullInfo = "PNG, 24 bit truecolor, non-interlaced. (125056 bytes)", '\000' <repeats 74 times>, shrtInfo = "1123x666 PNG", '\000' <repeats 115 times>, 
---Type <return> to continue, or q <return> to quit---
          comment = 0x829f500 "Comment::Created with GIMP\n", exifInfo = 0x0, exifInfoSize = 0, numpages = 1, pagebname = '\000' <repeats 63 times>}
        i = <value optimized out>
        filetype = <value optimized out>
        freename = 1
        frompipe = 0
        frompoll = 0
        fromint = 0
        killpage = <value optimized out>
        oldeWIDE = 1123
        oldeHIGH = 666
        oldpWIDE = 0
        oldpHIGH = 0
        oldCXOFF = 0
        oldCYOFF = 0
        oldCWIDE = 0
        oldCHIGH = 0
        wascropped = 0
        tmp = <value optimized out>
        fullname = 0x82a1be0 "/home/xxx/file.png"
        filename = "/home/xxx/file.png\000\b\000\000\000\000\000\000\000\000\370\023\210\277\260І\267\000\000\000\000\364߀\267\030\320(\b\t\000\000\000\370\023\210\277\214bs\267\030\320(\b\200\024\210\277\000\000\000\000\000\240o\267\300:p\267\364߀\267\370\023\210\277.Xs\267\030\320(\b\034\363)\b\000\000\000\000\364߀\267|\363)\b\340\024\210\277\070\024\210\277\\>r\267\030\320(\b\200\024\210\277\030\363)\b\000\000\000\000\200\364)\b\r\000\000\000\000\000\000\000\001\000\000\000X"...
#9  0x08053125 in mainLoop () at xv.c:3813
        j = <value optimized out>
        i = <value optimized out>
#10 0x08055fe0 in main (argc=2, argv=0xbf881754) at xv.c:1037
        i = <value optimized out>
        ecdef = {pixel = 9148853, red = 35584, green = 39168, blue = 46336, flags = 7 '\a', pad = -65 '\277'}
        rootReturn = 125
        parentReturn = 0
        children = 0x829d020
        numChildren = 105
        rootDEEP = <value optimized out>
(gdb)
Comment 7 Joe Peterson (RETIRED) gentoo-dev 2011-05-12 14:58:58 UTC
First, very strange that emerging xv with apng causes different behavior, since xv does not use apng...

But what I am particularly interested in is having you emerge libpng without static-libs:

USE="apng -static-libs" emerge -1 libpng

I am not sure why you have static-libs set, anyway.
Comment 8 Joe Peterson (RETIRED) gentoo-dev 2011-12-01 18:06:16 UTC
Not sure if this is the same problem, but marking this as a duplicate, since there are still issues with png images crashing.  Also, there is a newer version (r16) -please try this before reopening this issue as separate.

*** This bug has been marked as a duplicate of bug 376211 ***