various crashes with color extensions

[Liam P. White]

Attaching file from ~suv. Can also be reproduced with our icons.svg.

Using various color extensions (sometimes they need to be applied multiple times) crashes Inkscape. Similar behavior occurs with the Align and Distribute dialog.

I recorded three different crashes, two leading me to believe it is a memory issue. Tav believes it is a threading issue.

1: ERROR:src/document.cpp:980:void SPDocument::bindObjectToRepr(Inkscape::XML::Node *, SPObject *): assertion failed: (g_hash_table_lookup(priv->reprdef, repr) != NULL)

2: *** Error in `inkscape': free(): invalid pointer: 0x00000000092da560 ***

3: Program received signal SIGSEGV, Segmentation fault.
0x00000000007451c1 in SPStyle::cascade (this=0x9306850, parent=0x90a4ce0) at src/style.cpp:890
890 _properties[i]->cascade( parent->_properties[i] );

Note that the last one can be averted by jumping over the crashing line in gdb, with "jump +1".

[Liam P. White (liampwhite)]

Earlier email from Tav:

> I think this is thread related. If I put print statements in
> SPObject::releaseReferences(), I see that it is being called multiple
> times at the same time.
>
> A couple other things I've noticed:
>
> I can't reproduce the problem with small files.
>
> Making small changes to the code changes where the crash is happening.

[su_v (suv-lp)]

Crash with color extensions reproduced with current trunk (on OS X 10.7.5) as discussed on #inkscape-devel (irc).

[jazzynico (jazzynico)]

No need to apply a color extension to reproduce the bug. On Windows XP, Inkscape trunk revision 13445, opening the icon.svg file (or the one attached comment #1) and closing it just after it is loaded triggers the crash.

IMHO, the crash with the extensions is due to the fact that the extension system creates a temporary file, then applies the effect, loads the document and then delete the temporary file (which is equivalent to a File>Close and thus crashes the application).

[jazzynico (jazzynico)]

Also note that closing a document leads to known memory issues. See:
Bug #235371 "Memory is not cleared after file is closed"
Bug #1194871 "Huge Memory consumption by extension and pipe not closed"

[Liam P. White (liampwhite)]

I believe that this has been fixed in lp:inkscape r13474.

[jazzynico (jazzynico)]

Fix confirmed on Windows XP, Inkscape trunk revision 13484, thank you very much, Liam!

I'm going to investigate some other reports that may also be fixed thanks to your patch.