Crash when ungrouping a connector that avoids a shape

[Alex Valavanis]

Binary package hint: inkscape

To reproduce:

1. Draw three circles, one above the other.
2. Create a connector from the top circle to the bottom one
>> (The connector passes over the top of the middle circle)
3. Select all three circles with the selector tool
4. Click on the connector tool and choose "Make connectors avoid selected objects"
>> (The connector "kinks" to avoid the middle circle)
5. Select all three circles and the connector
6. Object->Group
>> (The connector passes over the top of the middle circle... I'll file this as a separate bug!)
7. Object->Ungroup
>> (CRASH!!)

Similar behaviour was observed in bug #168033 which was fixed long ago. The crash I am reporting has a different backtrace, so I figured it's best to create a new report.

ProblemType: Crash
Architecture: amd64
CrashCounter: 1
Date: Thu Mar 25 09:16:36 2010
DistroRelease: Ubuntu 10.04
EcryptfsInUse: Yes
ExecutablePath: /usr/bin/inkscape
InstallationMedia: Ubuntu 10.04 "Lucid Lynx" - Alpha amd64 (20091209)
NonfreeKernelModules: nvidia
Package: inkscape 0.47.0-1ubuntu2
ProcCmdline: inkscape
ProcCwd: /home/alex
ProcEnviron:
 SHELL=/bin/bash
 LANG=en_GB.utf8
ProcVersionSignature: Ubuntu 2.6.32-17.26-generic 2.6.32.10+drm33.1
SegvAnalysis:
 Segfault happened at: 0x4ca4a0 <_Z27sp_lpe_item_get_effect_listP9SPLPEItem+48>: mov 0x10(%rbx),%rdx
 PC (0x004ca4a0) ok
 source "0x10(%rbx)" (0x00000012) not located in a known VMA region (needed readable region)!
 destination "%rdx" ok
SegvReason: reading NULL VMA
Signal: 11
SourcePackage: inkscape
StacktraceTop:
 __gnu_cxx::new_allocator<Inkscape::LivePathEffect::LPEObjectReference*>::construct (lpeitem=<value optimised out>)
 std::list<Inkscape::LivePathEffect::LPEObjectReference*, std::allocator<Inkscape::LivePathEffect::LPEObjectReference*> >::_M_create_node (
 std::list<Inkscape::LivePathEffect::LPEObjectReference*, std::allocator<Inkscape::LivePathEffect::LPEObjectReference*> >::_M_insert (
 std::list<Inkscape::LivePathEffect::LPEObjectReference*, std::allocator<Inkscape::LivePathEffect::LPEObjectReference*> >::push_back (
 _M_initialize_dispatch<std::_List_const_iterator<Inkscape::LivePathEffect::LPEObjectReference*> > (lpeitem=<value optimised out>)
Title: inkscape crashed with SIGSEGV in __gnu_cxx::new_allocator<Inkscape::LivePathEffect::LPEObjectReference*>::construct()
Uname: Linux 2.6.32-17-generic x86_64
UserGroups: adm admin cdrom dialout lpadmin plugdev sambashare

[su_v (suv-lp)]

reproduced with Inkscape 0.47 r22583 on OS X 10.5.8

[su_v (suv-lp)]

reproduced with Inkscape 0.47+devel r9231 on OS X 10.5.8

minor difference: in the devel version from bzr trunk Inkscape already crashes when grouping the selection (3 circles and 1 connector).

The backtrace is also different.

[su_v (suv-lp)]

The crash described in comment #3 with Inkscape 0.47+devel seems to be a different issue (an updated connector tool was merged after the release of 0.47) and can be reproduced e.g. by just deleting a shape that has been set to be avoided by connectors. It seems not directly related to the group/ungroup command:

console message from Inkscape 0.487+devel r9231:
Assertion failed: (!_router->shapeInQueuedActionList(this)), function ~ShapeRef, file libavoid/shape.cpp, line 81.

@Alex - could we change the summary to what action crashes Inkscape? The backtrace reference to LivePathEffect::LPEObjectReference seems somewhat random to me because nowhere in your steps to reproduce are any LivePathEffects involved and it also differs from the one I get with Inkscape 0.47 on OS X (comment #2).

[Alex Valavanis (valavanisalex)]

@~suv, done! Feel free to rephrase the title if you can think of a better summary

[Apport retracing service (apport)]

StacktraceTop:
 sp_lpe_item_get_effect_list (lpeitem=<value optimized out>)
 sp_lpe_item_has_broken_path_effect (
 sp_genericellipse_set_shape (shape=0x4813120)
 sp_arc_modified (object=0x4813120,
 SPObject::emitModified (this=0x4813120, flags=73)

[Michael Wybrow (mjwybrow)]

FWIW, the crash mentioned in comment #4 when deleting an avoided object was the same bug as #590047, and is now fixed.

Still looking into this bug...

[Alex Valavanis (valavanisalex)]

I can no longer reproduce this crash with inkscape_0.48.0-1ubuntu1.

@~suv can you still reproduce this?

[su_v (suv-lp)]

@Alex - I never could reproduce the crash (as originally reported for Inkscape 0.47) with Inkscape 0.47+devel after the merge of the connector tool update (see comments #3 and #4).

Inkscape 0.48.0 and 0.48+devel r9775 on OS X 10.5.8 do not crash when grouping and ungrouping the three objects with 'connector-avoid' attribute set.

The crash when grouping objects with 'connector-avoid' attributes mentioned in comment #3 was fixed in trunk in r9709 and the fix was backported to the 0.48 branch before the release (r9654).

0.48.x branch:
<http://bazaar.launchpad.net/%7Einkscape.dev/inkscape/RELEASE_0_48_BRANCH/revision/9654>

trunk:
<http://bazaar.launchpad.net/~inkscape.dev/inkscape/trunk/revision/9709>

[Alex Valavanis (valavanisalex)]

OK, I think we can safely mark this is being fixed in 0.48.0 and downstream derivatives. It certainly seems to have been fixed for me.