Crash while editing truncated flowed text

Bug #1029690 reported by Thangalin on 2012-07-26
This bug affects 3 people
Affects Status Importance Assigned to Milestone

Bug Description

1. Edit some existing text in Calibri font (90 point). E.g., "YOU'RE RIGHT"
2. Copy the "heavy check mark" from
3. Position the text editing cursor between the two words.
4. Use CTRL+v to paste the heavy check mark.
5. Press the up-arrow.

Program received signal SIGSEGV, Segmentation fault.
0x000000000064bd4a in Inkscape::Text::Layout::iterator::prevLineCursor (
    this=0x344cc08, n=<value optimized out>)
    at libnrtype/Layout-TNG-OutIter.cpp:762
762 libnrtype/Layout-TNG-OutIter.cpp: No such file or directory.
        in libnrtype/Layout-TNG-OutIter.cpp

Inkscape 0.48 on Linux (Kubuntu).

Linux 2.6.35-30-generic #54-Ubuntu SMP Tue Jun 7 18:41:54 UTC 2011 x86_64 GNU/Linux

su_v (suv-lp) wrote :

> Inkscape 0.48 on Linux (Kubuntu).

Which version of Inkscape 0.48 do you have installed (see Inkscape menu 'Help > About Inkscape')?
Which distro version of Kubuntu (Ubuntu) do you have installed?

tags: added: crash
Changed in inkscape:
importance: Undecided → High
su_v (suv-lp) wrote :

Crash not reproduced with Inkscape and 0.48+devel r11573 on OS X 10.7.4
(tested with both backends of GTK+ and Pango: X11, Quartz)

Other variations tested:
- copy&pasting the character from 'Glyphs' dialog (from 'Range: Dingbat')
- inserting the character via Unicode input method (Ctrl+U 2714)

su_v (suv-lp) wrote :

Font 'Calibri' used for repeating the 'Steps to reproduce' had been installed (extracted) from Microsoft's PowerPoint Viewer 2007:

Version Version 1.02
Unique name Microsoft: Calibri: 2005
Manufacturer Microsoft Corporation
Designer Luc(as) de Groot
Copyright © 2006 Microsoft Corporation. All Rights Reserved.

su_v (suv-lp) wrote :

Since the 'Calibri' font I have installed doesn't include the Unicode symbol 'HEAVY CHECK MARK' itself, the actual glyph - used to render it on-canvas - is (silently) substituted; AFAICT from the fallback font (DejaVu Sans).

su_v (suv-lp) wrote :

SVG file used for the tests

su_v (suv-lp) wrote :

Searching the web, this bug filed for Inkscape 0.48.1 on RedHat seems to be about the same issue:

Thangalin (thangalin) wrote :

$ cat /etc/issue
Ubuntu 10.10 \n \l

Inkscape 0.48+devel r10022

The SVG file attached to this bug won't produce the problem. I have attached a video showing how to reproduce the problem.

Pasting the glyph causes the text box to go red, indicating that there's text, but it cannot be shown (likely because the text box itself is too short to display the full text string).

At the end of the video, Inkscape will crash if I press the up arrow.

Thangalin (thangalin) wrote :

Pasting the glyph is a red herring. I can just press the up arrow after changing the font size to 90px and cause a crash.

su_v (suv-lp) on 2012-07-27
summary: - Crash while text editing
+ Crash while editing truncated flowed text
su_v (suv-lp) wrote :

Crash reproduced with Inkscape 0.48+devel r11573 on OS X 10.7.4
(Glib 2.32.4, GTK+/X11 2.24.10, pango 1.30.1)

1) create flowed text, type some text (neither font family nor font size matters)
2) decrease the frame of the flowed text (e.g. in height) until none of the text fits into the frame anymore (i.e. all text is truncated)
3) press up arrow key

-> crash

Changed in inkscape:
status: New → Confirmed
Martin Spacek (mspacek) wrote :

I can confirm the same behaviour in Inkscape ( package) in Xubuntu 12.10 (amd64). Reproducing it is easy. Just make a very small text box (I use FreeSans as my default typeface), change the typeface size to say 144 px, type some stuff in it (nothing shows up), then hit the up key. Crash! I get this in apport:

 Segfault happened at: 0x859a93 <_ZN8Inkscape4Text6Layout8iterator14prevLineCursorEi+147>: mov 0x10(%rax,%rcx,8),%edi
 PC (0x00859a93) ok
 source "0x10(%rax,%rcx,8)" (0x1808140b58) not located in a known VMA region (needed readable region)!
 destination "%edi" ok
SegvReason: reading unknown VMA
Title: inkscape crashed with SIGSEGV in Inkscape::Text::Layout::iterator::prevLineCursor()

Apport's .crash file (minus the huge core dump field) is attached.

Martin Spacek (mspacek) wrote :

I've upgraded to 0.48.4 for quantal via the inkscape PPA (0.48.4+27~ubuntu12.10.1), and I still get the same crash. It does however seem a bit harder to trigger, maybe due to a change in shortcut key handling?

Martin Spacek (mspacek) wrote :

I also get this crash when testing the latest dev version (0.49~devel+13288+15~ubuntu12.10.1) from ppa:cafuego/inkscape.

ScislaC (scislac) on 2014-08-18
Changed in inkscape:
milestone: none → 0.91
su_v (suv-lp) wrote :

Moving to milestone 0.92: while a fix would be nice to have, it is not really a recent regression introduced in the 0.91.x series: the steps to reproduce in comment #9 also crash with stable 0.48.x builds.

Changed in inkscape:
milestone: 0.91 → 0.92
su_v (suv-lp) wrote :

Crash as described in comment #9:
- reproduced with rev <= 14126
- not reproduced with r14127

Closing as 'Fix committed' (bug #1391374 and this one - bug #1029690 - probably could have been marked as duplicate, at least they are fixed by the same commit).

Changed in inkscape:
assignee: nobody → Mc (mc...)
status: Confirmed → Fix Committed
su_v (suv-lp) wrote :

Fixed in 0.91.x by the backport of r14127 for bug #1391374 in rev 13791.

Changed in inkscape:
milestone: 0.92 → 0.91.1
jazzynico (jazzynico) on 2017-01-28
Changed in inkscape:
milestone: 0.91.1 → 0.92
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.