trunk: crash on delete containing layer

[Liam P. White]

This came to my attention after the following: http://sta.sh/01sci2ur9gts

Steps to reproduce (r13295, default prefs):
1. If no layer exists, create a layer.
2. Create a sublayer.
3. Remove the main layer

--> crash

[su_v (suv-lp)]

On OS X 10.7.5:
- crash not reproduced with 0.48.4 r9939, r10025
- crash reproduced with 0.48+devel rev >= 12727

Console warning with stable branch:
** (inkscape:22703): CRITICAL **: void SPDesktop::setCurrentLayer(SPObject*): assertion `SP_IS_GROUP(object)' failed

Console warning with rev >=12532 and <= 12726:
** (inkscape-12532:22745): CRITICAL **: void Inkscape::LayerModel::setCurrentLayer(SPObject*): assertion 'currentRoot() == object || (currentRoot() && currentRoot()->isAncestorOf(object))' failed

[Liam P. White (liampwhite)]

Attached patch fully fixes the issue (no more warnings, no more crashing).

1. The code stores the old layer temporarily and looks for the next one to set as the active layer.
2. It incorrectly identifies the existing layer's last child as the new layer. BAD
3. The old layer gets deleted. Destructor called, children deleted as well.
4. Dangling pointer to freed memory at child address
5. Object is attempted to be used (typeof operator for __dynamic_cast())
6. crash

The patch interferes at step 2 by detecting if the layer to be made active is the last child of the old layer. If it is, it throws it out as a possibility and prevents the warning/crash.

[Liam P. White (liampwhite)]

Proposing for backport since it eliminates the warning generated here in all situations, and also improves stability (unreferenced memory may be cleaned up, causing a crash in certain cases).

[su_v (suv-lp)]

Patch from comment #3 tested successfully on OS X 10.7.5 with 0.48+devel r13301.

Attached proposed backported diff for lp:inkscape/0.48.x tested successfully with 0.48.4 r10025 on OS X 10.7.5.

[jazzynico (jazzynico)]

Patch from comment #4 tested successfully on Crunchbang Waldorf, Inkscape trunk revision 13301 [1].

Patch from comment #5 tested successfully on Crunchbang Waldorf, Inkscape 0.48.x revision 10025.

[1] Note that I ran into a crash when testing the layers dialog with the patched trunk (*** glibc detected *** inkscape: malloc(): smallbin double linked list corrupted), but I'm not sure it's related to the patch (it happened only once when deleting a layer, and I can't find a way to reproduce it).

[Liam P. White (liampwhite)]

Fix committed in r13323.

[Krzysztof Kosinski (tweenk)]

Patch applied to stable in r10037.