Crash on drag and drop

[Thangalin]

Replicate

1. Open attached image.
2. Find the "left justify" icon.
3. Click and hold to drag the left justify icon.

Expected Results

User can drag the icon around.

Actual Results

Thread 1 "inkscape" received signal SIGSEGV, Segmentation fault.
0x00007ffff74aeedf in ?? () from /usr/bin/../lib/inkscape/libinkscape_base.so
(gdb) info frame
Stack level 0, frame at 0x7fffffffc7d0:
 rip = 0x7ffff74aeedf; saved rip = 0x7ffff74aefeb
 called by frame at 0x7fffffffc8c0
 Arglist at 0x7fffffffc6d8, args:
 Locals at 0x7fffffffc6d8, Previous frame's sp is 0x7fffffffc7d0
 Saved registers:
  rbx at 0x7fffffffc798, rbp at 0x7fffffffc7a0, r12 at 0x7fffffffc7a8,
  r13 at 0x7fffffffc7b0, r14 at 0x7fffffffc7b8, r15 at 0x7fffffffc7c0,
  rip at 0x7fffffffc7c8
(gdb) bt
#0 0x00007ffff74aeedf in ?? ()
   from /usr/bin/../lib/inkscape/libinkscape_base.so
#1 0x00007ffff74aefeb in ?? ()
   from /usr/bin/../lib/inkscape/libinkscape_base.so
#2 0x00007ffff7183835 in Inkscape::UI::Tools::SelectTool::root_handler(_GdkEvent*) () from /usr/bin/../lib/inkscape/libinkscape_base.so
#3 0x00007ffff719816a in Inkscape::UI::Tools::sp_event_context_virtual_root_handler(Inkscape::UI::Tools::ToolBase*, _GdkEvent*) ()
   from /usr/bin/../lib/inkscape/libinkscape_base.so
#4 0x00007ffff70026a8 in sp_marshal_INT__POINTER_POINTER ()
   from /usr/bin/../lib/inkscape/libinkscape_base.so
#5 0x00007ffff2fedfa5 in g_closure_invoke ()
   from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#6 0x00007ffff2ffffc1 in ?? ()
   from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#7 0x00007ffff30087f9 in g_signal_emit_valist ()
   from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#8 0x00007ffff300908f in g_signal_emit ()
   from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#9 0x00007ffff6ec7803 in ?? ()
   from /usr/bin/../lib/inkscape/libinkscape_base.so
#10 0x00007ffff6ec80e6 in ?? ()
   from /usr/bin/../lib/inkscape/libinkscape_base.so
#11 0x00007ffff7002464 in sp_marshal_BOOLEAN__POINTER ()
   from /usr/bin/../lib/inkscape/libinkscape_base.so
#12 0x00007ffff2fedfa5 in g_closure_invoke ()
   from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#13 0x00007ffff300056e in ?? ()
   from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#14 0x00007ffff30087f9 in g_signal_emit_valist ()
   from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#15 0x00007ffff300908f in g_signal_emit ()
   from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#16 0x00007ffff6f1e524 in SPCanvas::emitEvent(_GdkEvent*) ()
   from /usr/bin/../lib/inkscape/libinkscape_base.so
#17 0x00007ffff6f1ed13 in SPCanvas::handle_motion(_GtkWidget*, _GdkEventMotion*) () from /usr/bin/../lib/inkscape/libinkscape_base.so
#18 0x00007ffff4dbcfac in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#19 0x00007ffff2fedfa5 in g_closure_invoke ()
   from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#20 0x00007ffff300056e in ?? ()
   from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#21 0x00007ffff30087f9 in g_signal_emit_valist ()
   from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#22 0x00007ffff300908f in g_signal_emit ()
   from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#23 0x00007ffff4efac5c in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#24 0x00007ffff4dba3be in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#25 0x00007ffff4dbc1bc in gtk_main_do_event ()
   from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#26 0x00007ffff4929ca2 in ?? () from /usr/lib/x86_64-linux-gnu/libgdk-3.so.0
#27 0x00007ffff65eb1a7 in g_main_context_dispatch ()
   from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#28 0x00007ffff65eb400 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#29 0x00007ffff65eb722 in g_main_loop_run ()
   from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#30 0x00007ffff4dbb395 in gtk_main ()
   from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#31 0x000055555555b8f0 in sp_main_gui(int, char const**) ()
#32 0x00007ffff3dea830 in __libc_start_main (main=0x555555559930 <main>,
    argc=1, argv=0x7fffffffddc8, init=<optimized out>, fini=<optimized out>,
    rtld_fini=<optimized out>, stack_end=0x7fffffffddb8)
    at ../csu/libc-start.c:291
#33 0x0000555555559e69 in _start ()

$ inkscape --version
Inkscape 0.92pre1 unknown (Aug 13 2016)

Comes from inkscape-trunk PPA.

[Thangalin (thangalin-deactivatedaccount)]

Bug does not exist in 0.91.

$ inkscape --version
Inkscape 0.91 r13725

[jazzynico (jazzynico)]

Crash reproduced on Windows XP (32-bit) with lp:inkscape/0.92.x rev. 15214.
Not reproduced with 0.91.

The crash occurs in:
0x0055369f in find_group_at_point(unsigned int, SPGroup*, Geom::Point const&) ()

(sorry, minimal win32 bt...)

[jazzynico (jazzynico)]

Removing the symbol object from the attached file (or from the original) fixes the issue.

[su_v (suv-lp)]

Based on tests with archived builds (on OS X 10.7.5):
- not reproduced with lp:inkscape rev <= 14831,
- reproduced with lp:inkscape rev >= 14835;
it seems likely that the regression was exposed with changes during the Hackfest 2016 to address canvas flickering while dragging objects:
http://bazaar.launchpad.net/~inkscape.dev/inkscape/trunk/changes/14835

Based on the attached backtrace with an autotools-based GTK2 debug build of r15036, possibly the changes to src/document.cpp around r14834 are relevant:
http://bazaar.launchpad.net/~inkscape.dev/inkscape/trunk/revision/14834

[su_v (suv-lp)]

On OS X 10.7.5, crash:
- reproduced with lp:inkscape/0.92.x r15365,
- not reproduced with lp:inkscape/0.92.x r15365 + patch (bug #1612989)

Proposing to link as duplicate to (newer) bug #1612989.

[jazzynico (jazzynico)]

Marking duplicate of bug #1662439 "Instant crash when trying to move svg symbol".
Thanks for checking!