regression in r10983: crash when opening more than one docked dialog

[su_v]

Steps to reproduce:

1) launch Inkscape with new prefs, default template
2) open 'Layers…' dialog ('Shift+Ctrl+L')
3) open 'Align & Distribute…' dialog ('Shift+Ctrl+A')

-> crash (full backtrace attached)

Reproduced with r10983 and later revisions on:
- OS X 10.7.2 (64bit), debug build (-g -O0), Apple llvm-gcc-4.2
- OS X 10.7.2 (64bit), optimized build (-O2), Apple llvm-gcc-4.2
- OS X 10.7.2 (64bit), optimized build (-O2), FSF GCC 4.6.2
Dependencies:
  glib2 2.30.2, glibmm 2.28.2, gtk2/x11 2.24.10, gtkmm 2.24.2

Oddly, not reproduced with same revisions on:
- Mac OS X 10.5.8 (32bit), debug build (-g -O0), Apple GCC 4.2.1
- Mac OS X 10.5.8 (32bit), optimized build (-O2), Apple GCC 4.2.1
Dependencies:
  glib2 2.28.8, glibmm 2.28.0, gtk2/x11 2.24.4, gtkmm 2.24.0

Not reproduced with Quartz backend either:
- Mac OS X 10.5.8 (32bit), optimized build (-O2), Apple GCC 4.2.1
Dependencies:
  glib2 2.28.8, glibmm 2.28.2, gtk2/quartz 2.24.10, gtkmm 2.24.2

[Alex Valavanis (valavanisalex)]

This is odd... as far as I can tell, G_CONST_RETURN is just #defined to const! Looks like it may be an upstream glib bug, perhaps?!

[su_v (suv-lp)]

> Looks like it may be an upstream glib bug, perhaps?!

Any idea how I could figure that out? I don't really know what to be searching for in glib's bug tracker or elsewhere …

The crashes don't occur if I partially revert the changes from 10983 (see attached diff).
(Note: not asking to revert the changes in trunk: I'm fine with using the diff locally for now, until someone else can reproduce this on a different system)

[Alex Valavanis (valavanisalex)]

I'm not very familiar with glib, so I don't really know the best way to figure this out. I had a quick look through the glib repo, but didn't see anything obvious.

Does anyone else have any ideas? :-S

[jazzynico (jazzynico)]

Not reproduced on Windows XP, Inkscape trunk revision 10992.

[su_v (suv-lp)]

The build log for most recent Oneiric 64bit build of trunk (inkscape.dev PPA) indicates to me that the problem is not really a glib bug, but an issue with the GDL sources in Inkscape:
<https://launchpadlibrarian.net/93162544/buildlog_ubuntu-oneiric-amd64.inkscape-trunk_1%3A0.48%2Bdevel%2B10992%2B30~oneiric1_FAILEDTOBUILD.txt.gz>

<quote>
Finished at 20120217-1248
Build needed 00:29:26, 1721220k disk space
Can't open average time db /var/debbuild/avg-build-times
Can't open average space db /var/debbuild/avg-build-space
Function `g_relation_new' implicitly converted to pointer at libgdl/gdl-dock-object.c:902
Function `g_relation_select' implicitly converted to pointer at libgdl/gdl-dock-object.c:924
Function `g_tuples_index' implicitly converted to pointer at libgdl/gdl-dock-object.c:925

Our automated build log filter detected the problem(s) above that will
likely cause your package to segfault on architectures where the size of
a pointer is greater than the size of an integer, such as ia64 and amd64.

This is often due to a missing function prototype definition.

Since use of implicitly converted pointers is always fatal to the application
on ia64, they are errors. Please correct them for your next upload.

More information can be found at:
http://wiki.debian.org/ImplicitPointerConversions
</quote>

[Clayton Walker (clayton.walker)]

Reproduced on MacOSX 10.6.8, SnowLeopard, 64bit.
Standard MacPorts libs;
cairo @1.10.2_4+no_x11+quartz+universal (active)
pango @1.28.4_2+no_x11+quartz+universal (active)
glib2 @2.30.2_2+universal (active)

Revision 10992.

Opened any two random dockable windows, and inkscape crashes.
If inkscape is opened with a diolog box remembered by default, trying to add just one more crashes inkscape as well.

[jazzynico (jazzynico)]

Not reproduced on Ubuntu 11.04, Inkscape 10922.
Old libs are not affected apparently.

[su_v (suv-lp)]

@JazzyNico - based on the quote from the build service (comment #6), the system arch/cpu type seems to matter, too.

[Alex Valavanis (valavanisalex)]

OK, I get it now... you're right, it's a gdl issue, not a glib issue.

The GRelation API has been deprecated since glib 2.26, so I guess the G_DISABLE_DEPRECATED definition is causing the function g_relation_* declarations to disappear so the missing functions are assumed to return an integer. According to the Debian notes highlighted by ~suv in comment #6, and #9, we can summarise that the problem will occur with any 64-bit platform with glib >= 2.26.

Easy solution: Get rid of G_DISABLE_DEPRECATED to re-enable building on all affected platforms.

Proper solution: Replace use of the GRelation API in GDL and forward the changes upstream.

[Alex Valavanis (valavanisalex)]

Reported upstream to gdl. I *think* it would be possible to replace the dock_register GRelation in GDL with an array of structs that contain the nickname and type fields.

[Alex Valavanis (valavanisalex)]

Here's a draft patch that I think should fix the issue. Please could others test it before I commit? (note that I can't reproduce the original bug!) I have forwarded it to upstream GDL too.

[su_v (suv-lp)]

Testing with debug build on OS X 10.7.2 (64bit), llvm-gcc-4.2:

Originally reported crash no longer occurs, but Inkscape crashes after repeating the steps (opening multiple dialogs in the dock) in the same session (somewhat inconsistent to reproduce though):
1) open layers dialog
2) open align&distribute dialog
3) close align&distribute dialog
4) close layers dialog
5) open layers dialog
6) open align&distribute dialog

-> crash (backtraces attached).

Note: some sequences result in many repeated console messages when the crash occurs, for example:
(inkscape:63976): GLib-GObject-WARNING **: value "-224" of type `gint' is invalid or out of range for property `preferred-height' of type `gint'
and produce a seemingly endless backtrace.

There are also these warnings when compiling 'src/libgdl/gld-dock-object.o'
(with llvm-gcc-4.2 as well as FSF GCC 4.6.2):

  CC libgdl/gdl-dock-object.o
../../src/libgdl/gdl-dock-object.c: In function 'gdl_dock_object_class_init':
../../src/libgdl/gdl-dock-object.c:112:24: warning: variable 'container_class' set but not used [-Wunused-but-set-variable]
../../src/libgdl/gdl-dock-object.c: In function 'gdl_dock_object_foreach_detach':
../../src/libgdl/gdl-dock-object.c:298:48: warning: unused parameter 'user_data' [-Wunused-parameter]
../../src/libgdl/gdl-dock-object.c: In function 'gdl_dock_object_dock_unimplemented':
../../src/libgdl/gdl-dock-object.c:462:55: warning: unused parameter 'requestor' [-Wunused-parameter]
../../src/libgdl/gdl-dock-object.c:463:55: warning: unused parameter 'position' [-Wunused-parameter]
../../src/libgdl/gdl-dock-object.c:464:55: warning: unused parameter 'other_data' [-Wunused-parameter]
../../src/libgdl/gdl-dock-object.c: In function 'gdl_dock_object_real_present':
../../src/libgdl/gdl-dock-object.c:473:46: warning: unused parameter 'child' [-Wunused-parameter]
../../src/libgdl/gdl-dock-object.c: In function 'gdl_dock_param_get_type':
../../src/libgdl/gdl-dock-object.c:875:9: warning: missing initializer [-Wmissing-field-initializers]
../../src/libgdl/gdl-dock-object.c:875:9: warning: (near initialization for 'tinfo.base_init') [-Wmissing-field-initializers]
../../src/libgdl/gdl-dock-object.c: In function 'gdl_dock_object_set_type_for_nick':
../../src/libgdl/gdl-dock-object.c:1005:12: warning: initialization discards 'const' qualifier from pointer target type [enabled by default]

[su_v (suv-lp)]

Console messages vary depending on which dialog was reopened last: another example are thousands of these:

(inkscape:64056): GLib-GObject-CRITICAL **: g_object_new: assertion `G_TYPE_IS_OBJECT (object_type)' failed

resulting in an endless backtrace I cancelled:

(inkscape:64056): GLib-GObject-CRITICAL **: g_object_new: assertion `G_TYPE_IS_OBJECT (object_type)' failed

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00007fff5f3fffe8
0x00007fff8ae5a74e in __vfprintf ()
(gdb) bt
#0 0x00007fff8ae5a74e in __vfprintf ()
#1 0x00007fff8aea5270 in vasprintf_l ()
#2 0x000000010572b7ee in g_vasprintf ()
#3 0x0000000105707edf in g_strdup_vprintf ()
#4 0x00000001056f1079 in g_logv ()
#5 0x00000001056f1224 in g_log ()
#6 0x00000001056f13ad in g_return_if_fail_warning ()
#7 0x0000000105226e25 in g_object_new ()
#8 0x0000000100f7b611 in gdl_dock_item_dock (object=0x108043000, requestor=0x1094a6500, position=GDL_DOCK_TOP, other_data=0x0) at gdl-dock-item.c:1489
#9 0x0000000100f8fc12 in gdl_marshal_VOID__OBJECT_ENUM_BOXED (closure=0x107a9a900, return_value=0x0, n_param_values=4, param_values=0x1063fe800, invocation_hint=0x7fff5f401150, marshal_data=0x100f7ae90) at libgdlmarshal.c:165
#10 0x000000010521fb3c in g_closure_invoke ()
#11 0x000000010522f359 in signal_emit_unlocked_R ()
#12 0x000000010523037b in g_signal_emit_valist ()
#13 0x00000001052309b4 in g_signal_emit ()
#14 0x0000000100f6d525 in gdl_dock_object_dock (object=0x108043000, requestor=0x1094a6500, position=GDL_DOCK_TOP, other_data=0x0) at gdl-dock-object.c:635
#15 0x0000000100f76215 in gdl_dock_add_item (dock=0x1063cf570, item=0x1094a6500, placement=GDL_DOCK_TOP) at gdl-dock.c:1225
#16 0x0000000100f744f4 in gdl_dock_add (container=0x1063cf570, widget=0x1094a6500) at gdl-dock.c:693
#17 0x000000010521fb3c in g_closure_invoke ()
#18 0x000000010522f359 in signal_emit_unlocked_R ()
#19 0x000000010523037b in g_signal_emit_valist ()
#20 0x00000001052309b4 in g_signal_emit ()
#21 0x0000000100f7bdd6 in gdl_dock_item_dock (object=0x108043000, requestor=0x1094a6500, position=GDL_DOCK_TOP, other_data=0x0) at gdl-dock-item.c:1595
#22 0x0000000100f8fc12 in gdl_marshal_VOID__OBJECT_ENUM_BOXED (closure=0x107a9a900, return_value=0x0, n_param_values=4, param_values=0x1063ffb60, invocation_hint=0x7fff5f401d90, marshal_data=0x100f7ae90) at libgdlmarshal.c:165
#23 0x000000010521fb3c in g_closure_invoke ()
#24 0x000000010522f359 in signal_emit_unlocked_R ()
#25 0x000000010523037b in g_signal_emit_valist ()
#26 0x00000001052309b4 in g_signal_emit ()
#27 0x0000000100f6d525 in gdl_dock_object_dock (object=0x108043000, requestor=0x1094a6500, position=GDL_DOCK_TOP, other_data=0x0) at gdl-dock-object.c:635
#28 0x0000000100f76215 in gdl_dock_add_item (dock=0x1063cf570, item=0x1094a6500, placement=GDL_DOCK_TOP) at gdl-dock.c:1225
#29 0x0000000100f744f4 in gdl_dock_add (container=0x1063cf570, widget=0x1094a6500) at gdl-dock.c:693
#30 0x000000010521fb3c in g_closure_invoke ()
#31 0x000000010522f359 in signal_emit_unlocked_R ()
#32 0x000000010523037b in g_signal_emit_valist ()
#33 0x00000001052309b4 in g_signal_emit ()
#34 0x0000000100f7bdd6 in gdl_dock_i...

[Alex Valavanis (valavanisalex)]

Hopefully this is fixed in lp:inkscape r11013. Please let me know if the bug persists.

[Alex Valavanis (valavanisalex)]

I've also forwarded the patch upstream (see linked GDL report)

[su_v (suv-lp)]

@Alex - many thx for the fix: crash as originally reported, and crash as reported in comments #13-15 no longer reproduced with Inkscape 0.48+devel r11014 using these builds for testing:
- OS X 10.7.2 (64bit), debug build (-g -O0), Apple llvm-gcc-4.2
- OS X 10.7.2 (64bit), optimized build (-O2), Apple llvm-gcc-4.2
- OS X 10.7.2 (64bit), optimized build (-O2), FSF GCC 4.6.2
Dependencies:
  glib2 2.30.2, glibmm 2.28.2, gtk2/x11 2.24.10, gtkmm 2.24.2

[Alex Valavanis (valavanisalex)]

Patch accepted upstream: will make it into GDL 3.4