inkscape crashed with SIGABRT in __gnu_cxx::__verbose_terminate_handler()

[Mikhail Titov]

I embedded a single jpeg and I was looking how to make it pale.
Inkscape crashed when I attempted Extensions->Colors->More Light

ProblemType: Crash
DistroRelease: Ubuntu 13.04
Package: inkscape 0.48.4-0.1ubuntu1
ProcVersionSignature: Ubuntu 3.8.0-6.13-generic 3.8.0-rc7
Uname: Linux 3.8.0-6-generic i686
ApportVersion: 2.8-0ubuntu4
Architecture: i386
Date: Tue Feb 19 10:34:06 2013
ExecutablePath: /usr/bin/inkscape
MarkForUpload: True
ProcCmdline: inkscape /mnt/bbe/Cannon\ river/Geomorphology\ and\ Field\ Data/Belle\ Creek\ Project/Belle\ Creek_Site\ Data_NEW\ LABELS/Site\ Data_Belle\ Creek/BC-01/P7160006.JPG
Signal: 6
SourcePackage: inkscape
StacktraceTop:
 __gnu_cxx::__verbose_terminate_handler() () from /usr/lib/i386-linux-gnu/libstdc++.so.6
 ?? () from /usr/lib/i386-linux-gnu/libstdc++.so.6
 std::terminate() () from /usr/lib/i386-linux-gnu/libstdc++.so.6
 __cxa_throw () from /usr/lib/i386-linux-gnu/libstdc++.so.6
 Inkscape::Extension::open(Inkscape::Extension::Extension*, char const*) ()
Title: inkscape crashed with SIGABRT in __gnu_cxx::__verbose_terminate_handler()
UpgradeStatus: Upgraded to raring on 2013-01-15 (34 days ago)
UserGroups: adm admin audio cdrom davfs2 dialout dip disk floppy fuse lpadmin plugdev sambashare users video wireshark

[Apport retracing service (apport)]

StacktraceTop:
 __gnu_cxx::__verbose_terminate_handler () at ../../../../src/libstdc++-v3/libsupc++/vterminate.cc:95
 __cxxabiv1::__terminate (handler=0xb5dca7d0 <__gnu_cxx::__verbose_terminate_handler()>) at ../../../../src/libstdc++-v3/libsupc++/eh_terminate.cc:40
 std::terminate () at ../../../../src/libstdc++-v3/libsupc++/eh_terminate.cc:50
 __cxxabiv1::__cxa_throw (obj=0xd9da580, tinfo=0x88fc7d4 <typeinfo for Inkscape::Extension::Input::open_failed>, dest=0x83fc880 <Inkscape::Extension::Input::open_failed::~open_failed()>) at ../../../../src/libstdc++-v3/libsupc++/eh_throw.cc:83
 Inkscape::Extension::open (key=0x919cda8, filename=0xd36a3c4 "/tmp/ink_ext_XXXXXX.svgRLI2SW") at extension/system.cpp:133

[jazzynico (jazzynico)]

Not reproduced on Windows XP, Inkscape 0.48.4.

Did the crash happen only once, or is it easily reproducible?
Is your JPEG file located on a remote file system or on your local disk?

Note that the Extension>Color group doesn't work with bitmap images (only applies to vector objects), and that you should use the Extension>Raster menu instead.

[Mikhail Titov (mtitov)]

I had a thought that it was not the right menu. Indeed Extension->Raster does work fine.

It is 100% reproducible with at least one particular file. I tried to copy the file to /tmp/ and start from there with the same result. Interestingly enough that it does not crash either with a clean start or with some sample pre-installed images. I'll try to localize the issue further.

[jazzynico (jazzynico)]

@Mikhail - Thanks for reporting back!

Could you please attach your JPEG file (if it's not too big and if there's no privacy issue) so that we could investigate?

[Mikhail Titov (mtitov)]

I thought it was something in metadata. But after I stripped it with exiftool, it still crashes on such action. I attach unstripped version. I feel like it is something about this particular camera. All other photos I tried from same camera also crash inkscape.

I failed to attach 344k file here. Here is the link to sendspace upload http://www.sendspace.com/file/5avwt9

[jazzynico (jazzynico)]

Still not reproduced on Debian testing, Inkscape 0.48.3.1, 0.48.4 and trunk revision 12150.
Tested with the file from comment #9, linked or embedded, and didn't manage to crash Inkscape with the color extensions.

[Mikhail Titov (mtitov)]

I can reproduce it with trunk revision 12155. I feel like it might be something with underlying libraries on Ubuntu 13.04 32 bit. I don't know how muh time we want to put into investigation... Though it would be nice if inkscape was more dumb-proof and could withstand non-trivial menu clicking :-)

I feel like something creates badly formed xml that sp_repr_read_file() fails to read. I get same message as if from xmllint

 mlt@nb:~/workspace/inkscape$ xmllint /tmp/ink_ext_XXXXXX.svgLUK5SW
 /tmp/ink_ext_XXXXXX.svgLUK5SW:12: parser error : AttValue: ' expected
 6vs9RiG3hXUZuZlJhFgd d6FSoo2ZXTMnzPPhADMM50fDfEIBVbkyNPpvJOLf5WrWc2W+L/Ty2O/OzEw
                                                                                ^
 /tmp/ink_ext_XXXXXX.svgLUK5SW:12: parser error : Premature end of data in tag svg line 1
 6vs9RiG3hXUZuZlJhFgd d6FSoo2ZXTMnzPPhADMM50fDfEIBVbkyNPpvJOLf5WrWc2W+L/Ty2O/OzEw
                                                                                ^

Here is the link to that XML : http://www.sendspace.com/file/3044ib

Here is the screenshot in GUD http://imagepaste.nullnetwork.net/viewimage.php?id=5727

I guess I should rebuild it without optimization.

[Mikhail Titov (mtitov)]

It happens only when image is embedded. Something is broken with base 64 representation for that particular photo.

[Mikhail Titov (mtitov)]

I set a breakpoint at script.cpp:712 and I can see that it is just that script fails to produce well formed XML

/opt/inkscape/share/inkscape/extensions/color_morelight.py /tmp/ink_ext_XXXXXX.svgJ80RTW | xmllint -
-:12: parser error : AttValue: ' expected
6vs9RiG3hXUZuZlJhFgd d6FSoo2ZXTMnzPPhADMM50fDfEIBVbkyNPpvJOLf5WrWc2W+L/Ty2O/OzEw
                                                                               ^
-:12: parser error : Premature end of data in tag svg line 1
6vs9RiG3hXUZuZlJhFgd d6FSoo2ZXTMnzPPhADMM50fDfEIBVbkyNPpvJOLf5WrWc2W+L/Ty2O/OzEw
                                                                               ^

I guess there is nothing major in inkscape itself. Perhaps we can just close this bug as invalid.

[Mikhail Titov (mtitov)]

lxml is broken in Ubuntu 13.04 . The following code fails to produce valud xml

#!/usr/bin/env python
# -*- coding: utf-8 -*-

from lxml import etree
import sys

stream = open('/tmp/ink_ext_XXXXXX.svgJ80RTW','r')
document = etree.parse(stream)
stream.close()
document.write(sys.stdout)

[su_v (suv-lp)]

Crash not reproduced with Inkscape 0.48+devel:
- r12155, Ubuntu 12.10 (64bit, VM), (libxml2 2.8.0+dfsg1-5ubuntu2.1, python-lxml 2.3.5-1, Python 2.7.3)
- r12161, OS X 10.7.4 (64bit), (libxml2 2.8.0, py27-lxml 3.0.1, Python 2.7.3)

[Mikhail Titov (mtitov)]

@suv You are running an outdated libxml2. Looks like it is a regression bug in 2.9 which is shipped with Ubuntu 13.04. See https://github.com/lxml/lxml/issues/98

I cannot narrow down the problem to simple reproducible example. You can build libxml2 from git and test for yourself. Here is the equivalent C code http://pastebin.com/3WAZj62N . Depending on where you installed libxml2, to build you can use

gcc -ggdb -I/opt/libxml2/include/libxml2 -L/opt/libxml2/lib tst.c -lxml2 -o tst

./tst | xmllint -noout -

tst.svg can be taken from http://www.sendspace.com/file/doyain .

Meanwhile it would be nice if Inkscape caught an exception and gave a user reasonable message instead of crashing in places like system.cpp

    if (!doc) {
        throw Input::open_failed();
    }

[su_v (suv-lp)]

> @suv You are running an outdated libxml2. (…)

That was not the point of my comment (I have no plans to update libxml2 right now: Ubuntu 12.10 installs libxml2 2.8.0 [1], and libxml2 2.9.0 is broken on OS X Lion [2]). I only commented the test results to have additional data in this report which would confirm narrowing it down to Raring's version, and will refrain from adding further noise here.

[1] <http://packages.ubuntu.com/source/quantal/libxml2>
[2] <https://bugzilla.gnome.org/show_bug.cgi?id=684024>

[Alex Valavanis (valavanisalex)]

Reassign to libxml2. Fixed upstream in 2.9.1 [1]. Now fixed in Ubuntu Trusty.

[1] https://git.gnome.org/browse/libxml2/commit/?id=8e2098aef7d119ee95228564174d6a87d4183f4a