Segfault, assertion failed when running extensions

[Rena Kunisaki]

In 2013 Mar 26 trunk build, applying any extension causes a message on the console:
inkscape: malloc.c:3790: _int_malloc: Assertion `(unsigned long)(size) >= (unsigned long)(nb)' failed.

If it's the first time you used an extension, it usually still works; the second time it will crash.

[jazzynico (jazzynico)]

Not reproduced on Windows XP, Inkscape trunk revision 12253.

Could you please give your operating system ?
Does it happen with a specific file? If so, could you please attach it to the report?

[Rena Kunisaki (i-am-inuyasha)]

OS is Lubuntu 12.10 x64. I tried just opening Inkscape and drawing some shapes and couldn't get it to happen, but it seems to happen reliably any time I open a .svg file and edit it, though not for every object either.

[Rena Kunisaki (i-am-inuyasha)]

This file seems to be able to reproduce it reliably. Click on the crescent moon shape on the character's head and go to Extensions -> Color -> Brighter. The first time, several objects disappear from the document; the second time, Inkscape crashes, though doesn't always produce a backtrace.

[Alvin Penner (apenner)]

similar to Bug 1106031 ?

[Rena Kunisaki (i-am-inuyasha)]

Likely the same issue; for me it seems to happen with nearly all extensions (including some I wrote in Lua using the stdin/stdout interface), and I understand live preview is applying the extension as well (just displaying it rather than actually replacing the active document), so it sounds like that's describing the same problem.

[jazzynico (jazzynico)]

Confirmed on Windows XP with the file attached comment #4.
Not sure it is exactly similar to Bug 1106031. I'll try to get a backtrace on Debian later to confirm.

[jazzynico (jazzynico)]

Also reproduced on Debian testing, Inkscape trunk revision 12260.
Not exactly the same backtrace as in Bug 1106031, but likely to be related though.

[jazzynico (jazzynico)]

Reproduced on Windows XP, Inkscape trunk revision 12526. Crashes as soon as an extension is applied, no need to apply twice.

And even worse, it now crashes in gdb when you select the drawing.
Backtrace:
Program received signal SIGSEGV, Segmentation fault.
0x00e083f1 in __dynamic_cast ()
(gdb) bt
#0 0x00e083f1 in __dynamic_cast ()
#1 0x07d0bcc8 in ?? ()
#2 0x011d0be8 in typeinfo for Geom::Path ()
#3 0x07d0bcc8 in ?? ()
...

[Alvin Penner (apenner)]

running Windows XP, Inkscape rev 12517. when I use the file lunamon.svg I often get this crash, sometimes just while loading the file. Attached is a modified version of this file, which does not crash for me. I can apply Color Extensions with no crash.

In this file, I removed this reference to a file that does not exist on my machine.

    <image
       y="334.50504"
       x="238.57144"
       id="image4829"
       height="350"
       width="300"
       xlink:href="file:///home/hyperhacker/img/avatar/lunamonsidethingy.png" />

[su_v (suv-lp)]

A couple of backtraces with r12526 (various builds on OS X), using the original SVG file:
<https://www.dropbox.com/sh/qzui9auxtbce3pt/uKPiV6LaPS>

The crashes appear to be somewhat random: on load, on select, while applying an extension repeatedly or on quit (after applying an extension).

[su_v (suv-lp)]

On 2013-09-18 19:41 +0200, Alvin Penner wrote:
> running Windows XP, Inkscape rev 12517. when I use the file
> lunamon.svg I often get this crash, sometimes just while loading the
> file. Attached is a modified version of this file, which does not
> crash for me. I can apply Color Extensions with no crash.
>
> In this file, I removed this reference to a file that does not exist
> on my machine.

Possibly related to the observations by Alvin (removing the link to an image not present on the local system): Somewhere between r12511 and r12517 Inkscape appears to have lost the ability to render the 'Linked Image not found' placeholder graphic for missing linked images.

If this triggers the recently described crashes with the original SVG file, it's a new bug / regression and not related to the original report.

[su_v (suv-lp)]

AFACIT crashes triggered by links to missing images are fixed in r12531 (tested on Ubuntu 12.10 and OS X 10.7.5):
<http://thread.gmane.org/gmane.comp.graphics.inkscape.devel/41304/focus=41369>

[su_v (suv-lp)]

Needs retesting with builds >= 12531

[Alvin Penner (apenner)]

Windows XP, Inkscape rev 12549
- after loading the original file lunamon.svg, I can no longer reproduce the crash, running Extensions->Color->Brighter.