Inkscape R10539 crashes while opening SVGs created with 0.48.1

[uwesch]

Inkscape development version R10539 crashes while opening SVGs who are created with the stable version 0.48.1.
System: Windows Vista 32Bit
See further information in the screenshot.

Inkscape crashes with "Assertion failed!"
File: src/display/nr-filter-gaussian.cpp
Line:545
Expression: false

[jazzynico (jazzynico)]

Does it happen with all files created with 0.48.1, or only those containing filters?
Could you please attach an example file?
Thanks.

[uwesch (uwesch)]

For example it is my creation for the about contest for 0.48

[su_v (suv-lp)]

Reproduced with Inkscape 0.38+devel r10539 on Mac OS X 10.5.8 (i386) with the attached sample SVG file.

Console message:
Assertion failed: (false), function gaussian_pass_FIR, file display/nr-filter-gaussian.cpp, line 545.

Backtrace (build with '-g -O0', cairo 1.10.2) attached

[su_v (suv-lp)]

Crash also reproduced with lasted revision (r9598) of the cairo-rendering branch (before it was merged into trunk).

[su_v (suv-lp)]

Additional tests to confirm the regression in the cairo-renderer:
crash not reproduced with Inkscape 0.48.1, 0.48.2 and 0.48+devel r10325 (last revision of trunk before the merge of the cairo-rendering branch)

[Jaspervdg (jaspervdg)]

Will take a look this evening (western europe). The problem appears to be related to the surface format, which is weird, as we generally don't use that many, but it might just be that something isn't initialized properly or something like that.

If possible a reduced test case would be great (helps a lot in narrowing down the problem).

[Jaspervdg (jaspervdg)]

I've had a look and a 0x0 buffer is fed to the Gaussian blur filter, and certain parts apparently can't deal with that. However, I'm not quite sure why it's being fed a 0x0 buffer in the first place (it really shouldn't), so perhaps Krzysztof can have a look?

I'm attaching a reduced test case. Note that removing the groups before the filtered path prevents the problem from happening... (At least on my machine.) This is reflected in the buffer sizes, if the groups are removed the filter code reports no 0x0 buffer sizes, while with the groups present it reports a 0x0 buffer just before it crashes.

[Krzysztof Kosinski (tweenk)]

The text elements in group #g45355 have zero font-size. This causes singular transforms to be computed for those elements. When they are rendered, the Cairo context is fed with this singular transform. This puts the context and the surface in an error state. In particular, this means CAIRO_FORMAT_INVALID is returned from the call to cairo_image_surface_get_format().

I added sanity checks to disable rendering of elements with singular transforms, which should fix the problem.

[Krzysztof Kosinski (tweenk)]

Note - the fix is not in trunk yet as I want to merge the caching branch soon, which will fix this and a few other problems.

[su_v (suv-lp)]

Test file from recent bug #827192 crashes current trunk with the same console message and backtrace:
<https://bugs.launchpad.net/inkscape/+bug/827192/+attachment/2282156/+files/large_transform_matrix_sample_crashing.svg>

[Krzysztof Kosinski (tweenk)]

Current trunk no longer crashes on either of those files, closing.