Android spooler crashes with SIGSEV while printing pdf with a page range

Question

When I try to print a 16-page PDF document with only certain pages selected (i.e. page range) the spooler crashes due to a SIGSEV (please see the dump below). The same crash also happens when I try to 'print' to PDF. Printing all pages of the document works fine.

Is this a bug in android print framework?

The dump when trying to print only the first page out of 16:

05-16 11:51:16.828 6058-6069/? I/PdfManipulationService -> PdfRenderer: closeDocument()
05-16 11:51:16.838 11898-11898/? I/MutexFileProvider: Released file: /data/user/0/com.android.printspooler/files/print_job_1fc0a791-435d-493c-8cff-7ff65c3a642e.pdf from thread: Thread[main,5,main]
05-16 11:51:16.838 11898-12249/? I/MutexFileProvider: Acquired file: /data/user/0/com.android.printspooler/files/print_job_1fc0a791-435d-493c-8cff-7ff65c3a642e.pdf by thread: Thread[AsyncTask #6,5,main]
05-16 11:51:16.838 6058-6068/? I/PdfManipulationService -> PdfEditor: openDocument()
05-16 11:51:16.838 6058-6494/? I/PdfManipulationService -> PdfEditor: removePages()
05-16 11:51:16.838 6058-6494/? I/PdfManipulationService -> PdfEditor: trying to remove page 15/16
05-16 11:51:16.838 6058-6494/? I/PdfManipulationService -> PdfEditor: trying to remove page 14/15
05-16 11:51:16.838 6058-6494/? I/PdfManipulationService -> PdfEditor: trying to remove page 13/14
05-16 11:51:16.838 6058-6494/? I/PdfManipulationService -> PdfEditor: trying to remove page 12/13
05-16 11:51:16.838 6058-6494/? I/PdfManipulationService -> PdfEditor: trying to remove page 11/12
05-16 11:51:16.838 6058-6494/? I/PdfManipulationService -> PdfEditor: trying to remove page 10/11
05-16 11:51:16.838 6058-6494/? I/PdfManipulationService -> PdfEditor: trying to remove page 9/10
05-16 11:51:16.848 6058-6494/? I/PdfManipulationService -> PdfEditor: trying to remove page 8/9
05-16 11:51:16.848 6058-6494/? I/PdfManipulationService -> PdfEditor: trying to remove page 7/8
05-16 11:51:16.848 6058-6494/? I/PdfManipulationService -> PdfEditor: trying to remove page 6/7
05-16 11:51:16.848 6058-6494/? I/PdfManipulationService -> PdfEditor: trying to remove page 5/6
05-16 11:51:16.848 6058-6494/? I/PdfManipulationService -> PdfEditor: trying to remove page 4/5
05-16 11:51:16.848 6058-6494/? I/PdfManipulationService -> PdfEditor: trying to remove page 3/4
05-16 11:51:16.848 6058-6494/? I/PdfManipulationService -> PdfEditor: trying to remove page 2/3
05-16 11:51:16.848 6058-6494/? I/PdfManipulationService -> PdfEditor: trying to remove page 1/2
05-16 11:51:16.848 6058-6495/? I/PdfManipulationService -> PdfEditor: write()
05-16 11:51:17.018 6058-6495/? A/libc: Fatal signal 11 (SIGSEGV), code 1, fault addr 0x8 in tid 6495 (Binder_4)
05-16 11:51:17.088 3144-3144/? A/DEBUG: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
05-16 11:51:17.088 3144-3144/? A/DEBUG: Build fingerprint: 'samsung/heroltebmc/heroltebmc:6.0.1/MMB29K/G930W8VLU2APK3:user/release-keys'
05-16 11:51:17.088 3144-3144/? A/DEBUG: Revision: '8'
05-16 11:51:17.088 3144-3144/? A/DEBUG: ABI: 'arm64'
05-16 11:51:17.088 3144-3144/? A/DEBUG: pid: 6058, tid: 6495, name: Binder_4  >>> com.android.printspooler:renderer <<<
05-16 11:51:17.088 3144-3144/? A/DEBUG: signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x8
05-16 11:51:17.098 3144-3144/? A/DEBUG:     x0   0000000000000000  x1   0000007f7d61e700  x2   0000000000000621  x3   0000000000000000
05-16 11:51:17.098 3144-3144/? A/DEBUG:     x4   0000000000000000  x5   0000007f5b03f2c8  x6   0000007f5b03f2bc  x7   ffffffffffffffff
05-16 11:51:17.108 3144-3144/? A/DEBUG:     x8   0000000000000000  x9   0000007f81195000  x10  0000007f81195610  x11  0000000000000018
05-16 11:51:17.108 3144-3144/? A/DEBUG:     x12  0000000000000000  x13  ffffffffff000000  x14  0000000000000000  x15  0000000000000000
05-16 11:51:17.108 3144-3144/? A/DEBUG:     x16  0000007f8134deb0  x17  0000007f80fb3174  x18  00000000ffffffff  x19  0000000000000000
05-16 11:51:17.108 3144-3144/? A/DEBUG:     x20  0000000000000000  x21  0000007f5b03f2bc  x22  0000000000000621  x23  0000007f5b03f2c8
05-16 11:51:17.108 3144-3144/? A/DEBUG:     x24  0000007f7d61e700  x25  0000000000000000  x26  0000000000000000  x27  0000000000000000
05-16 11:51:17.108 3144-3144/? A/DEBUG:     x28  0000000000000000  x29  0000007f5b03f170  x30  0000007f80fe50b4
05-16 11:51:17.108 3144-3144/? A/DEBUG:     sp   0000007f5b03f150  pc   0000007f80fb3174  pstate 0000000060000000
05-16 11:51:17.108 3144-3144/? A/DEBUG: backtrace:
05-16 11:51:17.108 3144-3144/? A/DEBUG:     #00 pc 00000000000b9174  /system/lib64/libpdfium.so (_ZN14CPDF_ModuleMgr14GetFlateModuleEv)
05-16 11:51:17.108 3144-3144/? A/DEBUG:     #01 pc 00000000000eb0b0  /system/lib64/libpdfium.so (_Z24FPDFAPI_FlateOrLZWDecodeiPKhjP15CPDF_DictionaryjRPhRj+364)
05-16 11:51:17.108 3144-3144/? A/DEBUG:     #02 pc 00000000000eb440  /system/lib64/libpdfium.so (_Z14PDF_DataDecodePKhjPK15CPDF_DictionaryRPhRjR14CFX_ByteStringRPS1_ji+844)
05-16 11:51:17.108 3144-3144/? A/DEBUG:     #03 pc 00000000000f3980  /system/lib64/libpdfium.so (_ZN14CPDF_StreamAcc11LoadAllDataEPK11CPDF_Streamiji+436)
05-16 11:51:17.108 3144-3144/? A/DEBUG:     #04 pc 00000000000f621c  /system/lib64/libpdfium.so (_ZN11CPDF_Parser15GetObjectStreamEj+156)
05-16 11:51:17.108 3144-3144/? A/DEBUG:     #05 pc 00000000000f7a20  /system/lib64/libpdfium.so (_ZN11CPDF_Parser17GetIndirectBinaryEjRPhRj+244)
05-16 11:51:17.108 3144-3144/? A/DEBUG:     #06 pc 00000000000be7ec  /system/lib64/libpdfium.so (_ZN12CPDF_Creator22WriteOldIndirectObjectEj+500)
05-16 11:51:17.108 3144-3144/? A/DEBUG:     #07 pc 00000000000beb04  /system/lib64/libpdfium.so (_ZN12CPDF_Creator12WriteOldObjsEP9IFX_Pause+84)
05-16 11:51:17.108 3144-3144/? A/DEBUG:     #08 pc 00000000000c015c  /system/lib64/libpdfium.so (_ZN12CPDF_Creator15WriteDoc_Stage2EP9IFX_Pause+136)
05-16 11:51:17.108 3144-3144/? A/DEBUG:     #09 pc 00000000000c1f90  /system/lib64/libpdfium.so (_ZN12CPDF_Creator8ContinueEP9IFX_Pause+172)
05-16 11:51:17.108 3144-3144/? A/DEBUG:     #10 pc 00000000000c2598  /system/lib64/libpdfium.so (_ZN12CPDF_Creator6CreateEj+288)
05-16 11:51:17.108 3144-3144/? A/DEBUG:     #11 pc 000000000008dfd0  /system/lib64/libpdfium.so (_Z14_FPDF_Doc_SavePvP15FPDF_FILEWRITE_mii+120)
05-16 11:51:17.108 3144-3144/? A/DEBUG:     #12 pc 000000000010891c  /system/lib64/libandroid_runtime.so
05-16 11:51:17.108 3144-3144/? A/DEBUG:     #13 pc 0000000003314208  /system/framework/arm64/boot.oat (offset 0x2f5b000)
05-16 11:51:17.288 3144-3144/? A/DEBUG: Tombstone written to: /data/tombstones/tombstone_06
05-16 11:51:17.288 3144-3144/? E/DEBUG: AM write failed: Broken pipe

                                        [ 05-16 11:51:17.288  3144: 3144 E/         ]
                                        ro.product_ship = true

                                        [ 05-16 11:51:17.288  3144: 3144 E/         ]
                                        ro.debug_level = 0x4f4c

                                        [ 05-16 11:51:17.288  3144: 3144 E/         ]
                                        sys.mobilecare.preload = false
05-16 11:51:17.288 5284-5284/? E/audit: type=1701 msg=audit(1494944477.288:292): auid=4294967295 uid=99011 gid=99011 ses=4294967295 subj=u:r:isolated_app:s0:c512,c768 pid=6495 comm="Binder_4" exe="/system/bin/app_process64" sig=11
05-16 11:51:17.288 3480-3588/? I/BootReceiver: Copying /data/tombstones/tombstone_06 to DropBox (SYSTEM_TOMBSTONE)
05-16 11:51:17.298 3480-3572/? W/ResourcesManager: getTopLevelResources: /system/app/SPrintSpooler6/SPrintSpooler6.apk / 1.0 running in null rsrc of package com.android.printspooler
05-16 11:51:17.328 3167-3167/? I/Zygote: Process 6058 exited due to signal (11)
05-16 11:51:17.328 11898-12249/? E/PrintActivity: Error dropping pages
                                                  android.os.DeadObjectException
                                                      at android.os.BinderProxy.transactNative(Native Method)
                                                      at android.os.BinderProxy.transact(Binder.java:503)
                                                      at com.android.printspooler.renderer.IPdfEditor$Stub$Proxy.write(IPdfEditor.java:198)
                                                      at com.android.printspooler.ui.PrintActivity$DocumentTransformer.doTransform(PrintActivity.java:3052)
                                                      at com.android.printspooler.ui.PrintActivity$DocumentTransformer.access$5900(PrintActivity.java:2947)
                                                      at com.android.printspooler.ui.PrintActivity$DocumentTransformer$1.doInBackground(PrintActivity.java:2998)
                                                      at com.android.printspooler.ui.PrintActivity$DocumentTransformer$1.doInBackground(PrintActivity.java:2991)
                                                      at android.os.AsyncTask$2.call(AsyncTask.java:295)
                                                      at java.util.concurrent.FutureTask.run(FutureTask.java:237)
                                                      at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1113)
                                                      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:588)
                                                      at java.lang.Thread.run(Thread.java:818)

Answer 1

The latest update of Android got rid of the problem. I actually came across a bug fix reference but don't have a link to it at the moment.

Answer 2

hard to tell why exactly this happens, it's not too smart to post just the crash without the code which caused it (SIGSEV means, that an invalid memory reference caused the crash)... therefore I can only provide an example, but cannot not tell what could have caused the invalid reference.

PrintManager printManager = (PrintManager) this.getSystemService(Context.PRINT_SERVICE);
String jobName = this.getString(R.string.app_name) + " Document";
printManager.print(jobName, pda, null);

PrintDocumentAdapter pda = new PrintDocumentAdapter(){

    @Override
    public void onWrite(PageRange[] pages, ParcelFileDescriptor destination, CancellationSignal cancellationSignal, WriteResultCallback callback){
        InputStream input = null;
        OutputStream output = null;

        try {

            input = new FileInputStream(file to print);
            output = new FileOutputStream(destination.getFileDescriptor());

            byte[] buf = new byte[1024];
            int bytesRead;

            while ((bytesRead = input.read(buf)) > 0) {
                 output.write(buf, 0, bytesRead);
            }

            callback.onWriteFinished(new PageRange[]{PageRange.ALL_PAGES});

        } catch (FileNotFoundException ee){

        } catch (Exception e) {

        } finally {
            try {
                input.close();
                output.close();
            } catch (IOException e) {
                e.printStackTrace();
            }
        }
    }

    @Override
    public void onLayout(PrintAttributes oldAttributes, PrintAttributes newAttributes, CancellationSignal cancellationSignal, LayoutResultCallback callback, Bundle extras){

        if (cancellationSignal.isCanceled()) {
            callback.onLayoutCancelled();
            return;
        }           

        PrintDocumentInfo pdi = new PrintDocumentInfo.Builder("Name of file").setContentType(PrintDocumentInfo.CONTENT_TYPE_DOCUMENT).build();
        callback.onLayoutFinished(pdi, true);
    }
};