Select all or mouse drag selection causes coredump

[forcecore]

For some files, trying to select certain subset of objects will cause InkScape to crash.
Since this does not apply to all files, I've attached one that causes the crash.

Steps to reproduce:

Method1:
Using ctrl+a to select all objects at once causes the crash every time.

Method2:
Selecting single object with mouse click doesn't seem to produce crash.
However, selecting multiple objects with mouse drag causes the crash.
i) In the attached file, trying to select all object at once with mouse causes the crash.
ii) However it seems that only certain combinations of objects are causing the crash.
a) [67, 74] + red square dot = not crash
b) [67, 74] + blue circle + red square = crash
c) no text box + any red/blue dots = not crash
d) Remove the bluedot, then select all = not crash
e) Remove all the black line (two stub lines and the long line) then select all = not crash
f) Trying to select them all by shift clicking on the objects one by one will eventually cause the crash.

GDB output is as follows:

(gdb) file inkscape
Reading symbols from /usr/bin/inkscape...(no debugging symbols found)...done.
(gdb) run peakmin_intervals.svg
Starting program: /usr/bin/inkscape peakmin_intervals.svg
warning: no loadable sections found in added symbol-file system-supplied DSO at 0x7ffff7ffa000
warning: Could not load shared library symbols for linux-vdso.so.1.
Do you need "set solib-search-path" or "set sysroot"?
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/libthread_db.so.1".
[New Thread 0x7fffe5422700 (LWP 4749)]
[New Thread 0x7fffe4c21700 (LWP 4750)]
[New Thread 0x7fffd5250700 (LWP 4752)]

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff1373202 in vfprintf () from /usr/lib/libc.so.6
(gdb) bt
#0 0x00007ffff1373202 in vfprintf () from /usr/lib/libc.so.6
#1 0x00007ffff1420645 in __vasprintf_chk () from /usr/lib/libc.so.6
#2 0x00007ffff42239dc in g_vasprintf () from /usr/lib/libglib-2.0.so.0
#3 0x00007ffff4201090 in g_strdup_vprintf () from /usr/lib/libglib-2.0.so.0
#4 0x00007ffff420112c in g_strdup_printf () from /usr/lib/libglib-2.0.so.0
#5 0x0000000000a98083 in Inkscape::SelectionDescriber::_updateMessageFromSelection(Inkscape::Selection*) ()
#6 0x0000000000658c75 in Inkscape::Selection::_emitChanged(bool) ()
#7 0x0000000000a9746b in ?? ()
#8 0x00000000006283dc in sp_event_context_virtual_root_handler(SPEventContext*, _GdkEvent*)
    ()
#9 0x0000000000a374d1 in sp_desktop_root_handler(SPCanvasItem*, _GdkEvent*, SPDesktop*) ()
#10 0x00000000007ba97d in sp_marshal_BOOLEAN__POINTER ()
#11 0x00007ffff498a6a8 in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#12 0x00007ffff499c03d in ?? () from /usr/lib/libgobject-2.0.so.0
#13 0x00007ffff49a3a19 in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0
#14 0x00007ffff71a4118 in gtk_signal_emit () from /usr/lib/libgtk-x11-2.0.so.0
#15 0x000000000073c628 in ?? ()
#16 0x000000000073e994 in ?? ()
#17 0x00007ffff7037d85 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#18 0x00007ffff498a6a8 in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#19 0x00007ffff499bdfb in ?? () from /usr/lib/libgobject-2.0.so.0
#20 0x00007ffff49a3a19 in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0
#21 0x00007ffff49a4002 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#22 0x00007ffff7147ab4 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#23 0x00007ffff7036534 in gtk_propagate_event () from /usr/lib/libgtk-x11-2.0.so.0
#24 0x00007ffff70368eb in gtk_main_do_event () from /usr/lib/libgtk-x11-2.0.so.0
#25 0x00007ffff57d7c3c in ?? () from /usr/lib/libgdk-x11-2.0.so.0
#26 0x00007ffff41e4246 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#27 0x00007ffff41e4598 in ?? () from /usr/lib/libglib-2.0.so.0
#28 0x00007ffff41e499a in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#29 0x00007ffff70359d7 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#30 0x000000000062058c in sp_main_gui(int, char const**) ()
#31 0x0000000000603fcf in main ()
(gdb) quit
A debugging session is active.

        Inferior 1 [process 4743] will be killed.

Quit anyway? (y or n) y

I'm running InkScape 0.48.4 r9939 on an ArchLinux box on KDE4.
I've noticed that the windows port of InkScape (0.48.3.1) is not subject to this bug.

[su_v (suv-lp)]

Not reproduced with Inkscape 0.48.3.1, 0.48.4 and current trunk (r12692) on OS X 10.7.5.

> I'm running InkScape 0.48.4 r9939 on an ArchLinux box on KDE4.

Which theme engine do you use for GTK+ applications? Does the crash also occur with basic 'Raleigh'?

Other questions:
- Does it make a difference whether you have the document window 'maximized' or not?
- Does it make a difference if you reset the preferences to default?
  Steps: quit inkscape, rename ~/.config/inkscape/preferences.xml, launch inkscape again.
  Please attach the faulty preferences file if the crash does not happen with default settings.

[jazzynico (jazzynico)]

Not reproduced on Windows XP, Inkscape 0.48.4 and trunk revision 12698.

[forcecore (ssanzing2)]

- It still crashed with basic Raleigh
- The bug occurs whether InkScape is maximized or not.
- I removed ~/.config/inkscape directory completely, but the bug still occured.

I'll try reproducing the bug with other distros, like Mint.

[su_v (suv-lp)]

Not reproduced on Ubuntu 13.04 (VM, 64bit)(Unity) with Inkscape 0.48.4-0.1ubuntu2.

[forcecore (ssanzing2)]

Tried this on a fresh install of Arch Linux on a virtual machine and failed to reproduce this bug. (mesa)
Then I tried to reproduce the bug on KDE spin of Fedora 19 and it failed also. (nouveau driver)
Now I'm suspecting it has something to do with Nvidia graphics.

[forcecore (ssanzing2)]

I've completely moved my home directory to somewhere else and started from scratch (by copying /etc/skel). It solved this problem, but the only problem is that I don't know what caused this mess!

[forcecore (ssanzing2)]

Finally, the bug was reproduced on my Fedora 19 installation !

$ yum groupistall korea-support

$ locale -a | grep ko_KR
to check if ko_KR.utf8 is supported, then:

$ export LANG=ko_KR.utf8
$ inkscape interval.svg
Then ctrl+a, voila!

Also, by setting my locale to en_US.UTF-8 on my Arch Linux machine, I could walk-around this bug.

I think this bug will also apply to other locales such as Japanese or Chinese.

[su_v (suv-lp)]

New tests run on OS X 10.7.5 with this command:
$ LANG=ko_KR.UTF-8 inkscape interval.svg

- crash reproduced with Inkscape 0.48.3.1 and 0.48.4
- crash not reproduced with current trunk r12700 (GTK+/X11 and GTK+/Quartz tested)

Proposing to close as 'Fix Committed', milestone '0.49'.

@JazzyNico - any chance you could test how Windows trunk behaves with this locale?

[jazzynico (jazzynico)]

Tested with Korean locale on Windows XP:
-crash reproduced with inkscape 0.48.4.
-crash not reproduced with trunk revision 12701.