Crash when pasting object with custom swatch as fill/stroke paint into new document (rev >= 14245)

[su_v]

Current trunk crashes when copy&pasting an object with a custom swatch as fill (or stroke) paint into another document.

Steps to reproduce:
1) launch current trunk
2) draw a rectangle
3) convert the fill of the rectangle to custom swatch
   (click on the 'Swatch' button in 'Fill and Stroke')
4) copy rectangle (Ctrl+C)
5) open new document (Ctrl+N)
6) paste (Ctrl+V)

--> crash on paste:
(inkscape:83732): glibmm-ERROR **:
unhandled exception (type std::exception) in signal handler:
what: basic_string::_S_construct NULL not valid

Program received signal SIGTRAP, Trace/breakpoint trap.
0x0000000105ee8cfb in _g_log_abort ()
(gdb) bt
#0 0x0000000105ee8cfb in _g_log_abort ()
#1 0x0000000105ee85f8 in g_logv ()
#2 0x000000010480375b in g_error ()
#3 0x000000010480364f in Glib::exception_handlers_invoke ()
#4 0x0000000103c3d215 in (anonymous namespace)::Widget_signal_key_press_event_callback ()
#5 0x00000001040d5ea8 in _gtk_marshal_BOOLEAN__BOXED ()
#6 0x0000000105e70e29 in g_closure_invoke ()
#7 0x0000000105e839f8 in signal_emit_unlocked_R ()
#8 0x0000000105e8478f in g_signal_emit_valist ()
#9 0x0000000105e84a9a in g_signal_emit ()
#10 0x00000001041cede1 in gtk_widget_event_internal ()
#11 0x00000001040d4157 in gtk_propagate_event ()
#12 0x00000001040d3e11 in gtk_main_do_event ()
#13 0x00000001000037ed in snooper (event=0x117560b40) at ../../src/main.cpp:1009
#14 0x00000001044776ed in gdk_event_dispatch ()
#15 0x0000000105ee24b7 in g_main_context_dispatch ()
#16 0x0000000105ee2778 in g_main_context_iterate ()
#17 0x0000000105ee29fd in g_main_loop_run ()
#18 0x00000001040d3796 in gtk_main ()
#19 0x0000000100002f07 in sp_main_gui (argc=1, argv=0x7fff5fbff408) at ../../src/main.cpp:1075
#20 0x00000001000026e0 in main (argc=1, argv=0x7fff5fbff408) at ../../src/main.cpp:789

First encountered with Inkscape 0.91+devel r14357 on Ubuntu 14.04 LTS and OS X 10.7.5 (while testing bug #1495060); not reproduced with stable Inkscape 0.91 r13725.

Based on tests with archived builds:
- not reproduced with rev <= 14244,
- reproduced with rev >= 14245;
the crash seems to have been exposed after the changes in
Revision 14245: Fix for circular references detection in almost all cases, fixing bug #167247 and a few of its duplicates.
https://bazaar.launchpad.net/~inkscape.dev/inkscape/trunk/revision/14245

Notes:
- no crash when pasting within the same document
- no crash when pasting e.g. a rectangle with gradient fill into new document
- inkscape does not create an emergency-saved file if crash is triggered (-> risk of data loss)

[Mc (mc...)]

only difference between a pasted xml that crashes and one that does not is that the swatch has an osb:paint where the gradient has an inkscape:collect (not sure why the swatch does not have it too, since it appears in the xml editor) -but i still do not understand why said rev creates the crash-

traced the problem with gdb back to src/document.cpp:
1517 priv->resources_changed_signals[q].emit();
(3 "continue" before the crashing one)

(sounds like an existing valid signal, so whatever receives it must trigger the crash(?))
(if someone has any previous experience debugging signals, i will gladly take it)

[Mc (mc...)]

Ok, got it. the signal gets emitted when the objects has an osb:paint added to it, but the *order* of the attributes is crucial, and in this configuration the id is set after the osb:paint because reasons.

So when the signal gets emitted, the object has *no id*, hence the crash. I'm not sure how to solve that or in which other configurations it will occur.

(On an unrelated note, i still dunno what said rev has to do with all of that)

[su_v (suv-lp)]

Fix committed in rev 14367 - thanks a lot, Mc!