Segfaults upon adding text object when compiled with gcc-4.3

Bug #190722 reported by Lubomir Rintel
4
Affects Status Importance Assigned to Milestone
Inkscape
Fix Released
Undecided
Unassigned
inkscape (Fedora)
Fix Released
High

Bug Description

The crash happens only when compiled by GCC 4.3, but I can not tell whether it's compiler's fault, or Inkscape's;
It is easily reproducible, just add text object, type some text and press Enter.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 46912501729296 (LWP 24343)]
_wordcopy_bwd_aligned (dstp=-120, srcp=78356352, len=2305843009213693944) at wordcopy.c:296
296 ((op_t *) dstp)[6] = a0;
Current language: auto; currently c
(gdb) up
#1 0x0000003d3a67a801 in memmove (dest=0x0, src=<value optimized out>, len=<value optimized out>) at memmove.c:99
99 WORD_COPY_BWD (dstp, srcp, len, len);
(gdb)
#2 0x00000000004b81dd in TextTagAttributes::mergeSingleAttribute (output_list=0x7fff8cfeb5f0, parent_list=@0x7fff8cfeb710, parent_offset=5, overlay_list=0x0)
    at /usr/include/c++/4.3.0/bits/stl_algobase.h:377
377 __builtin_memmove(__result, __first,
Current language: auto; currently c++
(gdb)
#3 0x00000000004b82d0 in TextTagAttributes::mergeInto (this=0x4c31368, output=0x7fff8cfeb5f0, parent_attrs=@0x7fff8cfeb710, parent_attrs_offset=5, copy_xy=false,
    copy_dxdyrotate=true) at sp-text.cpp:742
742 mergeSingleAttribute(&output->x, parent_attrs.x, parent_attrs_offset, copy_xy ? &attributes.x : NULL);
(gdb)
#4 0x00000000004b8df1 in SPText::_buildLayoutInput (this=0x2c0cba0, root=0x4c311f0, parent_optional_attrs=@0x7fff8cfeb710, parent_attrs_offset=5, in_textpath=false)
    at sp-text.cpp:518
518 tspan->attributes.mergeInto(&optional_attrs, parent_optional_attrs, parent_attrs_offset, use_xy, true);
(gdb)

Full backtrace is attached to the Fedora bug referenced above.
Should any more information such as values of variables or core dump and debugging symbols be needed (in case you don't have gcc-4.3 handy, etc.), please let me know.

Tags: crash gcc-4.3
Revision history for this message
In , Andrew (andrew-redhat-bugs) wrote :

Description of problem:
I'm seeing inkscape sigsegv after adding a small word with the new text tool and
pressing enter. The backtrace with debuginfo is attached.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x2aaaacb26780 (LWP 31103)]
_wordcopy_bwd_aligned (dstp=-56, srcp=<value optimized out>, len=<value
optimized out>)
    at wordcopy.c:314
314 ((op_t *) dstp)[0] = a0;
Current language: auto; currently c

Version-Release number of selected component (if applicable):
inkscape-0.45.1+0.46pre1-2.fc9.x86_64

How reproducible:
Very consistent, although I do not know if its new with this version (I haven't
been using it).

Steps to Reproduce:
1. add new layer, choose text tool
2. add new text (liberation sans, 16pt), write small word such as 'PCB'
3. press enter, then sigsegv occurs

Revision history for this message
In , Andrew (andrew-redhat-bugs) wrote :

Created attachment 294483
inkscape-segv-smallwords.txt

Revision history for this message
In , Andrew (andrew-redhat-bugs) wrote :

Happens on i686 as well, and with large or small words on either platform, using
different fonts.

Revision history for this message
In , Lubomir (lubomir-redhat-bugs) wrote :

This happens only in f9 -- the same version on f8 works fine. I will take a
closer look shortly.

Revision history for this message
In , Lubomir (lubomir-redhat-bugs) wrote :

Interesting thing is that on Fedora 8 it doesn't segfault when compiled with
gcc-4.1, but when compiled with gcc-4.3 (and newer libsigc++20, but otherwise
stock f8) it crashes.

Revision history for this message
In , Lubomir (lubomir-redhat-bugs) wrote :

Upstream bug: https://bugs.launchpad.net/fedora/+source/inkscape/+bug/190722
Jakub: Could you please have a short look at this in case it's a compiler issue?

Tom Davidson (tjd-mit)
Changed in inkscape:
milestone: none → 0.47
Changed in inkscape:
status: Unknown → In Progress
Revision history for this message
In , Lubomir (lubomir-redhat-bugs) wrote :

Andrew: I attempted to fix the problem. inkscape-0.45.1+0.46pre1-3.fc9 is just
building [1] and will hit rawhide soon. Please check if you can cause inkscape
to crash. Thanks.

http://koji.fedoraproject.org/koji/taskinfo?taskID=424500

Revision history for this message
Lubomir Rintel (lkundrak) wrote : [PATCH] Segfaults upon adding text object when compiled with gcc-4.3

This is the patch from Fedora project; it solved the problem for me:
http://cvs.fedora.redhat.com/viewcvs/*checkout*/rpms/inkscape/devel/inkscape-0.46pre1-vectors.patch

Revision history for this message
bbyak (buliabyak) wrote :

cyreve, can you please review the patch and apply it if it makes sense?

Revision history for this message
Richard Hughes (cyreve) wrote :

Yep, looks good. No idea what I was smoking when I wrote that.

Changed in inkscape:
status: New → Fix Released
Revision history for this message
In , Andrew (andrew-redhat-bugs) wrote :

Thanks for the quick work on that, it looks like you got this one. After 5
minutes testing various words it has not happened; in contrast pre1-2 can be
crashed with the first attempt. I'll reopen if I notice it during some more
thorough work this week.

Changed in inkscape:
status: In Progress → Fix Released
Changed in inkscape (Fedora):
importance: Unknown → High
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.