font subsetting segfaults in 1.28.0, regression from 1.27.2.2

[cbm755]

Description of the bug

I will attach a somewhat MWE, roughly I'm building a PDF one page at a time, then writing some non-ascii words on the first page, then font subsetting.

On 1.27.2.2 this works fine. But on 1.28.0, it seems to segfault 5% or 10% of the time.

Using pytest, I can capture more output:

platform linux -- Python 3.14.6, pytest-8.4.2, pluggy-1.6.0
PyQt6 6.11.0 -- Qt runtime 6.11.1 -- Qt compiled 6.11.1
rootdir: /home/cbm/src/plom/plom.git
configfile: pyproject.toml
plugins: mock-3.15.1, django-4.12.0, hypothesis-6.123.0, timeout-2.4.0, xvfb-3.1.1, qt-4.5.0, anyio-4.13.0
collected 141 items / 140 deselected / 1 selected                                                                                                                                                                                                     

plom/create/test_meh.py Fatal Python error: Segmentation fault

Current thread 0x00007f7a8c931bc0 [pytest] (most recent call first):
  File "/home/cbm/.local/lib/python3.14/site-packages/pymupdf/mupdf.py", line 60928 in pdf_subset_fonts2
  File "/home/cbm/.local/lib/python3.14/site-packages/pymupdf/__init__.py", line 7517 in subset_fonts
  File "/home/cbm/src/plom/plom.git/plom/create/test_meh.py", line 62 in test_font_subsetting
  File "/usr/lib/python3.14/site-packages/_pytest/python.py", line 157 in pytest_pyfunc_call
  File "/usr/lib/python3.14/site-packages/pluggy/_callers.py", line 121 in _multicall
  File "/usr/lib/python3.14/site-packages/pluggy/_manager.py", line 120 in _hookexec
  File "/usr/lib/python3.14/site-packages/pluggy/_hooks.py", line 512 in __call__
  File "/usr/lib/python3.14/site-packages/_pytest/python.py", line 1671 in runtest
  File "/usr/lib/python3.14/site-packages/_pytest/runner.py", line 178 in pytest_runtest_call
  File "/usr/lib/python3.14/site-packages/pluggy/_callers.py", line 121 in _multicall
  File "/usr/lib/python3.14/site-packages/pluggy/_manager.py", line 120 in _hookexec
  File "/usr/lib/python3.14/site-packages/pluggy/_hooks.py", line 512 in __call__
  File "/usr/lib/python3.14/site-packages/_pytest/runner.py", line 246 in <lambda>
  File "/usr/lib/python3.14/site-packages/_pytest/runner.py", line 344 in from_call
  File "/usr/lib/python3.14/site-packages/_pytest/runner.py", line 245 in call_and_report
  File "/usr/lib/python3.14/site-packages/_pytest/runner.py", line 136 in runtestprotocol
  File "/usr/lib/python3.14/site-packages/_pytest/runner.py", line 117 in pytest_runtest_protocol
  File "/usr/lib/python3.14/site-packages/pluggy/_callers.py", line 121 in _multicall
  File "/usr/lib/python3.14/site-packages/pluggy/_manager.py", line 120 in _hookexec
  File "/usr/lib/python3.14/site-packages/pluggy/_hooks.py", line 512 in __call__
  File "/usr/lib/python3.14/site-packages/_pytest/main.py", line 367 in pytest_runtestloop
  File "/usr/lib/python3.14/site-packages/pluggy/_callers.py", line 121 in _multicall
  File "/usr/lib/python3.14/site-packages/pluggy/_manager.py", line 120 in _hookexec
  File "/usr/lib/python3.14/site-packages/pluggy/_hooks.py", line 512 in __call__
  File "/usr/lib/python3.14/site-packages/_pytest/main.py", line 343 in _main
  File "/usr/lib/python3.14/site-packages/_pytest/main.py", line 289 in wrap_session
  File "/usr/lib/python3.14/site-packages/_pytest/main.py", line 336 in pytest_cmdline_main
  File "/usr/lib/python3.14/site-packages/pluggy/_callers.py", line 121 in _multicall
  File "/usr/lib/python3.14/site-packages/pluggy/_manager.py", line 120 in _hookexec
  File "/usr/lib/python3.14/site-packages/pluggy/_hooks.py", line 512 in __call__
  File "/usr/lib/python3.14/site-packages/_pytest/config/__init__.py", line 175 in main
  File "/usr/lib/python3.14/site-packages/_pytest/config/__init__.py", line 201 in console_main
  File "/home/cbm/.local/bin/pytest", line 8 in <module>

Current thread's C stack trace (most recent call first):
  Binary file "/lib64/libpython3.14.so.1.0", at _Py_DumpStack+0x4c [0x7f7a8c3406b2]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x14ad86 [0x7f7a8c34ad86]
  Binary file "/lib64/libc.so.6", at +0x1a0b0 [0x7f7a8c0210b0]
  Binary file "/home/cbm/.local/lib/python3.14/site-packages/pymupdf/libmupdf.so.29.0", at pdf_array_get+0x26 [0x7f7a73cd6dd6]
  Binary file "/home/cbm/.local/lib/python3.14/site-packages/pymupdf/libmupdf.so.29.0", at pdf_array_get_int+0x9 [0x7f7a73cddbd9]
  Binary file "/home/cbm/.local/lib/python3.14/site-packages/pymupdf/libmupdf.so.29.0", at pdf_subset_fonts+0x6bb [0x7f7a73d1081b]
  Binary file "/home/cbm/.local/lib/python3.14/site-packages/pymupdf/libmupdfcpp.so.29.0", at _ZN5mupdf20ll_pdf_subset_fonts2EP12pdf_documentRKSt6vectorIiSaIiEE+0x6a [0x7f7a737aa00a]
  Binary file "/home/cbm/.local/lib/python3.14/site-packages/pymupdf/_mupdf.so", at +0x6762ad [0x7f7a724762ad]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x1b52ce [0x7f7a8c3b52ce]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x182c2b [0x7f7a8c382c2b]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x25089 [0x7f7a8c225089]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x1c3044 [0x7f7a8c3c3044]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x3061a7 [0x7f7a8c5061a7]
  Binary file "/lib64/libpython3.14.so.1.0", at _PyObject_MakeTpCall+0x89 [0x7f7a8c382fe9]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x2cd86 [0x7f7a8c22cd86]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x1c3044 [0x7f7a8c3c3044]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x3061a7 [0x7f7a8c5061a7]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x1dd3e0 [0x7f7a8c3dd3e0]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x28d1a [0x7f7a8c228d1a]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x1c3044 [0x7f7a8c3c3044]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x3061a7 [0x7f7a8c5061a7]
  Binary file "/lib64/libpython3.14.so.1.0", at _PyObject_MakeTpCall+0x89 [0x7f7a8c382fe9]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x2cd86 [0x7f7a8c22cd86]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x1c3044 [0x7f7a8c3c3044]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x3061a7 [0x7f7a8c5061a7]
  Binary file "/lib64/libpython3.14.so.1.0", at _PyObject_MakeTpCall+0x89 [0x7f7a8c382fe9]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x2cd86 [0x7f7a8c22cd86]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x1c3044 [0x7f7a8c3c3044]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x3061a7 [0x7f7a8c5061a7]
  Binary file "/lib64/libpython3.14.so.1.0", at _PyObject_MakeTpCall+0x89 [0x7f7a8c382fe9]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x2cd86 [0x7f7a8c22cd86]
  Binary file "/lib64/libpython3.14.so.1.0", at +0x195d12 [0x7f7a8c395d12]
  <truncated rest of calls>

Extension modules: PyQt6.QtCore, PyQt6.QtGui, PyQt6.QtWidgets, PyQt6.QtTest, _brotli, simplejson._speedups, pymupdf._extra, pymupdf._mupdf, PIL._imaging, numpy._core._multiarray_umath, numpy.linalg._umath_linalg, cython.cimports.libc.math, _cyutility, scipy._cyutility, scipy._lib._ccallback_c, numpy.random._common, numpy.random.bit_generator, numpy.random._bounded_integers, numpy.random._mt19937, numpy.random.mtrand, numpy.random._philox, numpy.random._pcg64, numpy.random._sfc64, numpy.random._generator, scipy.sparse._sparsetools, _csparsetools, scipy.sparse._csparsetools, scipy.spatial._ckdtree, scipy._lib.messagestream, scipy.linalg._fblas, scipy.linalg._flapack, scipy.linalg.cython_lapack, scipy.linalg._cythonized_array_utils, scipy.linalg._solve_toeplitz, scipy.linalg._decomp_lu_cython, scipy.linalg._matfuncs_schur_sqrtm, scipy.linalg._matfuncs_expm, scipy.linalg._linalg_pythran, scipy.linalg.cython_blas, scipy.linalg._decomp_update, scipy.spatial._qhull, scipy.spatial._voronoi, scipy.special._ufuncs_cxx, scipy.special._ellip_harm_2, scipy.special._special_ufuncs, scipy.special._gufuncs, scipy.special._ufuncs, scipy.special._specfun, scipy.special._comb, scipy.spatial._hausdorff, scipy.spatial._distance_wrap, scipy.spatial.transform._rotation, scipy.spatial.transform._rigid_transform, zstandard.backend_c, yaml._yaml, PIL._imagingft (total: 56)
Segmentation fault         (core dumped) pytest -k test_font_subsetting plom
================================================================================================================= test session starts =================================================================================================================
platform linux -- Python 3.14.6, pytest-8.4.2, pluggy-1.6.0
PyQt6 6.11.0 -- Qt runtime 6.11.1 -- Qt compiled 6.11.1
rootdir: /home/cbm/src/plom/plom.git
configfile: pyproject.toml
plugins: mock-3.15.1, django-4.12.0, hypothesis-6.123.0, timeout-2.4.0, xvfb-3.1.1, qt-4.5.0, anyio-4.13.0
collected 141 items / 140 deselected / 1 selected                                                                                                                                                                                                     

plom/create/test_meh.py .                            

How to reproduce the bug

I cannot see how to attach the file to this Bug Report UI but I will attach it after submitting...

for i in {1..100}; do python3 test_meh.py; done
hello
goodbye
hello
goodbye
hello
goodbye
hello
goodbye
hello
goodbye
hello
goodbye
hello
goodbye
hello
goodbye
hello
goodbye
hello
goodbye
hello
Segmentation fault         (core dumped) python3 test_meh.py
hello
goodbye

PyMuPDF version

1.28.0

Operating system

Linux

Python version

3.14

[cbm755]

3pager.pdf (I don't think this file is anything special)

test_meh.py

[cbm755]

Downstream issue: https://gitlab.com/plom/plom/-/work_items/4260

[julian-smith-artifex-com]

Thanks for reporting this, and for the reproducer.

Valgrind reports memory errors, so we have something to work on here.

[julian-smith-artifex-com]

This is a bug in mupdf, which has just been fixed in mupdf branch master, and will fixed in the next release of pymupdf.