Inkscape crashes when using 3d box after attempting to render latex, gears, tree, barcode, maybe others.

[John B.]

Binary package hint: inkscape

I couldn't get apport to pick up this crash, otherwise this would be more complete.

Inkscape does not render a LaTeX formula at all. Running Render->LaTeX Forumula seems to go fine, (pstoedit seems to complete without error), yet no equation is displayed on the page. If I subsequently try to use the perspective/3d tool (new in 0.46), inkscape crashes very hard, and I have to kill it from the terminal. The crash also occurs after rendering a random tree, gears, or barcode (which all render fine, unlike latex). Rendering a Grid did not cause the 3d box crash.

The 3d/perspective tool works fine if I do not try to use those render tools. All other drawing tools (circles, squares, etc.) seem to run fine whether or not I try to render those objects (tree, gears, barcode, latex). The "latex" portion of this bug seems related to https://bugs.launchpad.net/inkscape/+bug/195052, but I have not seen the second portion (the crash when using the 3d box tool).

I have attached a backtrace obtained by following the instructions at https://wiki.ubuntu.com/DebuggingProgramCrash and https://wiki.ubuntu.com/Backtrace.

If there is anything else I can do to help with this bug, please let me know.

jbuncher@hardybeta:~$ lsb_release -rd
Description: Ubuntu hardy (development branch)
Release: 8.04

jbuncher@hardybeta:~$ apt-cache policy inkscape
inkscape:
  Installed: 0.46-0ubuntu1
  Candidate: 0.46-0ubuntu1
  Version table:
 *** 0.46-0ubuntu1 0
        500 http://us.archive.ubuntu.com hardy/main Packages
        100 /var/lib/dpkg/status
jbuncher@hardybeta:~$

[Bryce Harrington (bryce)]

We've just released 0.46, which has packages available for Ubuntu Gutsy and Hardy (see http://inkscape.org news from today for notes about the ppa). I don't think there is a fix included for this issue but it would be worth testing.

Also, thanks for trying to make a backtrace, but you didn't run the most important command. :-)
Please repeat the procedure but run "(gdb) backtrace full" and attach that.

For more info, see:
https://wiki.ubuntu.com/DebuggingProgramCrash

[John B. (jbuncher)]

Bryce,

Yikes, thanks for pointing that out!

Unfortunately, I just tried going back to run that command, and every time inkscape crashes, it seems to hang other things as well, so that I can not click in the terminal running the gdb to run the "(gdb) backtrace full" command. I tried killing the /usr/bin/inkscape program, but nothing happened (maybe because it's under control of gdb??) I have to end up killing the gdb program to regain control, and then cannot run the backtrace.

I've tried "attaching" from a tty to inkscape already running, but when I went back to the desktop inkscape was all greyed out and not happy, and I could not continue with the actions that would cause the crash.

What is the latest package of inkscape in hardy? I have 0.46-0ubuntu1, and I haven't noticed any updates to inkscape in the past day or to, so I'll wait a bit longer to see if inkscape updates to re-confirm the bug.

Do you have any other suggestions on how to help give you guys some more info? Are you able to reproduce the crash? Just render a barcode or latex or gears or a random tree and then try the 3d box command, that "works" every time for me.

Thanks for your time and help!

[John B. (jbuncher)]

As of today, on a fully up-to-date Hardy install, this bug still persists (both the latex not functioning, and the 3d box crashing inkscape after rendering one of the many objects from the Effects->Render menu).

Is there a way I can help "complete" the bug report, or at least help confirm the bug?

[John B. (jbuncher)]

I finally was able to get a backtrace. Here it is!

In case it matters, I rendered the default "gears" to cause the crash, if that helps.

[Bryce Harrington (bryce)]

(gdb) backtrace full
#0 box3d_write (object=0x9b1d250, repr=0xa7c15f0, flags=<value optimized out>) at box3d.cpp:282
 persp_repr = (class Inkscape::XML::Node *) 0x0
 persp_id = <value optimized out>
 doc = (class SPDocument *) 0x8b16f50
 coordstr0 = <value optimized out>
 coordstr7 = <value optimized out>
#1 0x080dd04b in SPObject::updateRepr (this=0x8b16f50, flags=2) at sp-object.cpp:1182
 repr = (class Inkscape::XML::Node *) 0x0
#2 0x08140690 in sp_box3d_drag (bc=@0x8f45ac8) at box3d-context.cpp:615
 xml_doc = (class Inkscape::XML::Document *) 0x8b12d80
 repr = (class Inkscape::XML::Node *) 0xa7c15f0
 repr_side = <value optimized out>
 desktop = (class SPDesktop *) 0x8b36e00
 __PRETTY_FUNCTION__ = "void sp_box3d_drag(Box3DContext&, guint)"

Looks like box3d_write is being passed a null pointer for persp_repr - wonder if that's what's causing the crash? Also the repr in updateRepr is null.

[John B. (jbuncher)]

@Bryce: I'm guessing your "wonder if that's what's causing the crash?" wasn't directed at me, but if so and you're awaiting a response, I'll just say that interpreting what's in the backtrace is way beyond my level of knowledge. If there's any other way I can help in testing/fixing this bug, let me know!

Thanks again for your work and attention on this issue.

[Max Rabkin (max-rabkin)]

I get this too, in Hardy.

[John B. (jbuncher)]

I am able to reproduce this bug on an Intrepid Alpha3 LiveCD with all updates applied, the inkscape package version is 0.46-0ubuntu4.

To reproduce the bug, I rendered a "Gears", and then tried the perspective tool.

[John B. (jbuncher)]

I was able to reproduce this bug on Vista Home Premium 32-bit with Inkscape 0.46 that I downloaded today (2008-08-18), so I added the general "Inkscape" to the projects the bug affects (since its not ubuntu-specific). If this was not the appropriate action, please let me know.

To reproduce the bug, I rendered the default "Gear...", and then tried the 3d box perspective tool.

[Krzysztof Kosinski (tweenk)]

Still present in current SVN.

[Bryce Harrington (bryce)]

A pre-release of the upcoming Inkscape 0.47 is now available in Ubuntu
Karmic for testing. Because *so* much stuff has changed compared with
the version you reported your bug against, would you mind re-testing
this new version and see if this bug is now resolved?

Karmic Alpha CD ISO images are available at:

  http://cdimage.ubuntu.com/releases/karmic/

If you're not testing Karmic yet, there are .debs of this new Inkscape
for Jaunty, Hardy, and Intrepid here:

  https://launchpad.net/~inkscape.testers/+archive/ppa

You might find further bugs when testing this alpha release. If that is
the case, please file a NEW bug report here:

   https://edge.launchpad.net/inkscape/+filebug

Thanks ahead of time for your testing efforts, and enjoy the new Inkscape!

[John B. (jbuncher)]

Bryce,

Sure thing, I'll try and test it out tonight. though it looks like (I haven't tested it) this may have been fixed in inkscape (0.46-5ubuntu3) jaunty, from this entry on Bug #198608,

https://bugs.launchpad.net/ubuntu/+source/inkscape/+bug/198608/comments/8

I'll give karmic a spin and report the results though.

[John B. (jbuncher)]

I gave karmic a spin, and this bug is still an issue. Started inkscape, rendered a gear, clicked on the 3dbox tool, clicked in the drawing area, and got the error.

[John B. (jbuncher)]

I just tried out Karmic Alpha 3, this bug still exists (comment 14 was with Alpha 2). Started inkscape, rendered a gear, clicked on the 3dbox tool, clicked in the drawing area, and got the error.

[John B. (jbuncher)]

Bug is still present in the inkscape shipped in Karmic Alpha 4.

[Alex Valavanis (valavanisalex)]

Confirmed in Karmic Alpha 4. To reproduce:
* Use barcode tool (EAN code 1234567)
* Click on 3D box tool in toolbar on left.
* Click on canvas and start dragging.

Symptoms:
* Inkscape displays a warning dialog stating "Inkscape encountered an internal error and will close now"
* Mouse cursor is stuck as inkscape 3D box tool, regardless of position on screen
* Mouse clicks are unresponsive anywhere on desktop
* Most desktop key commands do not work (alt+tab, ctrl+alt+arrows etc)
* Print screen and alt+F2 (run program) still work

Recovery:
* alt+F2 to open "run program" dialog.
* enter "gnome-terminal" into dialog
* type "killall inkscape" in terminal window to force inkscape shutdown

Notes:
* 3D box tool works fine under other circumstances (e.g. if it is the first tool used)

$ lsb_release -rd
Description: Ubuntu karmic (development branch)
Release: 9.10

$ apt-cache policy inkscape
inkscape:
  Installed: 0.47~pre1-0ubuntu1
  Candidate: 0.47~pre1-0ubuntu1
  Version table:
 *** 0.47~pre1-0ubuntu1 0
        500 http://gb.archive.ubuntu.com karmic/main Packages
        100 /var/lib/dpkg/status

[jazzynico (jazzynico)]

Reproduced on Ubuntu 9.04, Inkscape rev. 22183.
Just found a workaround (and thus maybe a clue): Inkscape doesn't crash if you delete the inkscape:perspective node in the defs (vacuum defs or manually in the xml editor) before using the 3D tool.
Looks like if the 3D tool tries to update the defs unsuccessfully.

[John B. (jbuncher)]

Still present in Karmic Alpha 5.

[Petteri Aimonen (jpa-lp)]

Found out what happens:

1) Extensions (including barcode) replace the whole document when executing, performed in Script::copy_doc in extension/implementation/script.cpp.

2) Replacing the document frees all objects associated with the old document.

3) Persp3D *SPDocument::current_persp3d contains a pointer to an object associated with the XML node in the old document. The old node has been freed.

However, I'm not sure how it should be fixed. Maybe use SPDocument::connectReconstructionFinish to either zero the pointer (simple) or fix the object (difficult, should find the node again)?

[Petteri Aimonen (jpa-lp)]

The attached patch inkscape-persp3d-with-extensions-bug.patch (against svn r22293) fixed this bug for me. This is my first patch for Inkscape, so I wouldn't be surprised about unintended consequences.

[ScislaC (scislac)]

Hey everyone... This bug will unfortunately not be fixed for 0.47. It will however be addressed for 0.48. We are planning to have a much shorter dev cycle for 0.48... hopefully one of the shortest we've ever had. Luckily, the way this will be addressed in 0.48 should fix many other 3D Box related bugs as well in the process (the patch is just too dangerous to commit so late in this dev cycle).

Petteri, thank you very much for your efforts on the patch, and if we didn't have the "proper" fix waiting by the tool's author, this would have been accepted. I do hope you'll consider contributing more to inkscape too as we can always use more good minds. :)

[ScislaC (scislac)]

Well, disregard what was said a week ago about this not being fixed in 0.47. Committed the patch in r22390. Thank you for your efforts Petteri!

[John B. (jbuncher)]

Just wanted to add that with the recent pull of the pre3 release into Ubuntu Karmic, that this bug is now fixed in Karmic. If someone could update the status (so that it's still "confirmed" on hardy-intrepid-jaunty, or maybe "won't fix" if the specific bugfix can't get backported, but "Fix Released" on Karmic), that would be great.

[Alex Valavanis (valavanisalex)]

Fixed in karmic beta. Instructions for requesting a Stable Release Update can be found at https://wiki.ubuntu.com/StableReleaseUpdates

Backport requests can be made using the procedure at https://help.ubuntu.com/community/UbuntuBackports#How%20to%20request%20new%20packages