Assertion failed in cairo-mempool.c

[henryk]

I have a slide deck that often (not entirely always, somehow related to screen configuration) crashes pdfpc in libcairo: pdfpc: /build/buildd/cairo-1.12.14/src/cairo-mempool.c:160: get_buddy: Assertion `offset + (1 << bits) <= pool->num_blocks' failed.

pdfpc version is from git as of 2013-09-21, everything else is stock Ubuntu 13.04. The crash never happens with disabled cache or disabled cache compression. I tried to reduce the number of slides to trigger the problem with a minimized slide deck, but was not able to. Removing any significant number of frames from the presentation makes the crash go away. The full set is here: http://shiny.ploetzli.ch/~henryk/0d1b9a106db15ab13f94de7cd5ae31da/ht2013_2013-09-21.pdf

GDB backtrace:

Starting program: /usr/local/stow/pdfpc-git/bin/pdfpc ht2013_2013-09-21.pdf
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
pdfpc v3.1.1
(C) 2012 David Vilar
(C) 2009-2011 Jakob Westhoff

[New Thread 0x7fffeaa61700 (LWP 21197)]
[New Thread 0x7fffea260700 (LWP 21198)]
Initializing rendering...
pdfpc: /build/buildd/cairo-1.12.14/src/cairo-mempool.c:160: get_buddy: Assertion `offset + (1 << bits) <= pool->num_blocks' failed.

Program received signal SIGABRT, Aborted.
0x00007ffff4e6c037 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56  ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0  0x00007ffff4e6c037 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007ffff4e6f698 in __GI_abort () at abort.c:90
#2  0x00007ffff4e64e03 in __assert_fail_base (fmt=0x7ffff4fbb578 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x7ffff6e721a0 "offset + (1 << bits) <= pool->num_blocks", 
    file=file@entry=0x7ffff6e72170 "/build/buildd/cairo-1.12.14/src/cairo-mempool.c", line=line@entry=160, function=function@entry=0x7ffff6e72281 "get_buddy") at assert.c:92
#3  0x00007ffff4e64eb2 in __GI___assert_fail (assertion=0x7ffff6e721a0 "offset + (1 << bits) <= pool->num_blocks", file=0x7ffff6e72170 "/build/buildd/cairo-1.12.14/src/cairo-mempool.c", line=160, 
    function=0x7ffff6e72281 "get_buddy") at assert.c:101
#4  0x00007ffff6ddf7eb in ?? () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
#5  0x00007ffff6ddf874 in ?? () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
#6  0x00007ffff6e3c216 in ?? () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
#7  0x00007ffff6e3ca6a in ?? () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
#8  0x00007ffff6e39c0b in ?? () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
#9  0x00007ffff6e0a4d7 in ?? () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
#10 0x00007ffff6e36358 in ?? () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
#11 0x00007ffff6e371d7 in ?? () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
#12 0x00007ffff6e1d8a6 in ?? () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
#13 0x00007ffff6e1e27b in ?? () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
#14 0x00007ffff6dc7ac1 in ?? () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
#15 0x00007ffff6e0b641 in ?? () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
#16 0x00007ffff6dcf967 in ?? () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
#17 0x00007ffff6dc9634 in ?? () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
#18 0x00007ffff6dc2875 in cairo_fill () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
#19 0x00007ffff70cf4dc in CairoOutputDev::fill(GfxState*) () from /usr/lib/x86_64-linux-gnu/libpoppler-glib.so.8
#20 0x00007ffff3c18652 in Gfx::doAxialShFill(GfxAxialShading*) () from /usr/lib/x86_64-linux-gnu/libpoppler.so.28
#21 0x00007ffff3c1da3b in Gfx::opShFill(Object*, int) () from /usr/lib/x86_64-linux-gnu/libpoppler.so.28
#22 0x00007ffff3c1eb04 in Gfx::go(bool) () from /usr/lib/x86_64-linux-gnu/libpoppler.so.28
#23 0x00007ffff3c1ef70 in Gfx::display(Object*, bool) () from /usr/lib/x86_64-linux-gnu/libpoppler.so.28
#24 0x00007ffff3c1f314 in Gfx::drawForm(Object*, Dict*, double*, double*, bool, bool, GfxColorSpace*, bool, bool, bool, Function*, GfxColor*) () from /usr/lib/x86_64-linux-gnu/libpoppler.so.28
#25 0x00007ffff3c2027c in Gfx::doForm(Object*) () from /usr/lib/x86_64-linux-gnu/libpoppler.so.28
#26 0x00007ffff3c22dd3 in Gfx::opXObject(Object*, int) () from /usr/lib/x86_64-linux-gnu/libpoppler.so.28
#27 0x00007ffff3c1eb04 in Gfx::go(bool) () from /usr/lib/x86_64-linux-gnu/libpoppler.so.28
#28 0x00007ffff3c1ef70 in Gfx::display(Object*, bool) () from /usr/lib/x86_64-linux-gnu/libpoppler.so.28
#29 0x00007ffff3c5f654 in Page::displaySlice(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) () from /usr/lib/x86_64-linux-gnu/libpoppler.so.28
#30 0x00007ffff70c374d in ?? () from /usr/lib/x86_64-linux-gnu/libpoppler-glib.so.8
#31 0x0000000000411443 in pdfpc_renderer_pdf_real_render_to_pixmap ()
#32 0x0000000000410833 in pdfpc_renderer_base_render_to_pixmap ()
#33 0x000000000041d10e in __lambda4_ ()
#34 0x000000000041d33a in ___lambda4__gsource_func ()
#35 0x00007ffff78d7f05 in g_main_context_dispatch () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#36 0x00007ffff78d8248 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#37 0x00007ffff78d86ba in g_main_loop_run () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#38 0x00007ffff689dfe7 in gtk_main () from /usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0
#39 0x000000000041018a in pdfpc_application_run ()
#40 0x0000000000410262 in pdfpc_application_main ()
#41 0x00000000004102b8 in main ()