various crashes with color extensions

Bug #1333445 reported by Liam P. White on 2014-06-23
14
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Inkscape
High
Liam P. White

Bug Description

Attaching file from ~suv. Can also be reproduced with our icons.svg.

Using various color extensions (sometimes they need to be applied multiple times) crashes Inkscape. Similar behavior occurs with the Align and Distribute dialog.

I recorded three different crashes, two leading me to believe it is a memory issue. Tav believes it is a threading issue.

1: ERROR:src/document.cpp:980:void SPDocument::bindObjectToRepr(Inkscape::XML::Node *, SPObject *): assertion failed: (g_hash_table_lookup(priv->reprdef, repr) != NULL)

2: *** Error in `inkscape': free(): invalid pointer: 0x00000000092da560 ***

3: Program received signal SIGSEGV, Segmentation fault.
0x00000000007451c1 in SPStyle::cascade (this=0x9306850, parent=0x90a4ce0) at src/style.cpp:890
890 _properties[i]->cascade( parent->_properties[i] );

Note that the last one can be averted by jumping over the crashing line in gdb, with "jump +1".

Liam P. White (liampwhite) wrote :
Liam P. White (liampwhite) wrote :

Earlier email from Tav:

> I think this is thread related. If I put print statements in
> SPObject::releaseReferences(), I see that it is being called multiple
> times at the same time.
>
> A couple other things I've noticed:
>
> I can't reproduce the problem with small files.
>
> Making small changes to the code changes where the crash is happening.

su_v (suv-lp) on 2014-06-23
Changed in inkscape:
importance: Undecided → High
milestone: none → 0.91
description: updated
su_v (suv-lp) wrote :

Crash with color extensions reproduced with current trunk (on OS X 10.7.5) as discussed on #inkscape-devel (irc).

Changed in inkscape:
status: New → Confirmed
jazzynico (jazzynico) wrote :

No need to apply a color extension to reproduce the bug. On Windows XP, Inkscape trunk revision 13445, opening the icon.svg file (or the one attached comment #1) and closing it just after it is loaded triggers the crash.

IMHO, the crash with the extensions is due to the fact that the extension system creates a temporary file, then applies the effect, loads the document and then delete the temporary file (which is equivalent to a File>Close and thus crashes the application).

jazzynico (jazzynico) wrote :

Also note that closing a document leads to known memory issues. See:
Bug #235371 "Memory is not cleared after file is closed"
Bug #1194871 "Huge Memory consumption by extension and pipe not closed"

Liam P. White (liampwhite) wrote :

I believe that this has been fixed in lp:inkscape r13474.

Changed in inkscape:
status: Confirmed → Fix Committed
assignee: nobody → Liam P. White (inkscapebrony)
jazzynico (jazzynico) wrote :

Fix confirmed on Windows XP, Inkscape trunk revision 13484, thank you very much, Liam!

I'm going to investigate some other reports that may also be fixed thanks to your patch.

Bryce Harrington (bryce) on 2015-02-21
Changed in inkscape:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Bug attachments