trunk: crash on undo of editing text with linked offset (rev >= 14199)

[su_v]

Undoing edits of a text object with a linked offset - for example undoing the insertion of characters - causes Inkscape to crash, but only if the file with the text&offset was (re-)loaded from disk.

Steps to reproduce:
1) launch trunk (default prefs, new document)
2) create a regular text
3) create a linked offset of the text
4) save
5) revert the file (or close and reopen)
6) insert two characters into the text
7) undo text edit (Ctrl+Z twice)

--> crash on second (last) undo:
** (inkscape:19414): WARNING **: Document was modified while being updated after undo operation

** (inkscape:19414): WARNING **: Event: Set attribute inkscape:original to "<snipped>" on #<Element:0x0x11431a1c0>

** (inkscape:19414): WARNING **: Document was modified while being updated after undo operation

** (inkscape:19414): WARNING **: Event: Set attribute inkscape:original to "<snipped>" on #<Element:0x0x11431a1c0>

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000000
0x00000001000a28ca in perform_document_update (doc=@0x112274c30) at ../../src/document-undo.cpp:230
230 Inkscape::Event* undo_stack_top = (Inkscape::Event *)doc.priv->undo->data;

First encountered with Inkscape 0.91+devel r14236 on OS X 10.7.5.

Based on tests with archived builds:
- not reproduced with rev <= 14198,
- reproduced with rev >= 14200;
this seems to be a regression likely introduced with the changes in r14199:
http://bazaar.launchpad.net/~inkscape.dev/inkscape/trunk/changes/14200

Revision 12199: bug #1357805 + bug #1227193 revisited
http://bazaar.launchpad.net/~inkscape.dev/inkscape/trunk/revision/14199

[jazzynico (jazzynico)]

Reproduced on Windows XP (32 bit), Inkcape trunk rev. 14237.

[jazzynico (jazzynico)]

@Liam, would you be willing to investigate that regression please?

[su_v (suv-lp)]

AFAICT the crash only happens if the text edits are the first entries in the undo history - if there had been edits before that in the current session, undoing one step beyond the text edits does restore the text edit changes for the linked offset unexpectedly and incorrectly, but does not trigger the crash right away either: setting bug importance to 'Medium' for now.

[su_v (suv-lp)]

Update: retesting with newer archived builds:
- reproduced with rev <= 14519,
- not reproduced with rev >= 14522;
possibly the changes in rev 14520 prevent the crash.

Changelog:
https://bazaar.launchpad.net/~inkscape.dev/inkscape/trunk/changes/14522

Revision 14520:
Merge glib_hunt: cppification and removal of many glib GList/GSList/GHashTable
https://bazaar.launchpad.net/~inkscape.dev/inkscape/trunk/revision/14520

[su_v (suv-lp)]

Closing, since the crash does no longer reproduce.

@Liam - feel free to reopen if you think it was closed in error. The remaining console messages (on Undo) are likely not related to the original regression reported here.