Crash when shift+clicking on arc/segment node (ellipse tool)

[Giovanni]

Inkscape closes when I shift+click on an arc/segment node (ellipse tool) to bring it to default shape.
Inkscape 0.91 - Win 10

[jazzynico (jazzynico)]

Confirmed, but if I understand your report correctly, it's a documented feature (see https://inkscape.org/fr/doc/keys091.html#d0e5159), not a bug.
Could you please confirm?

[Giovanni (giovanni-gianello)]

Hi. I mean that Inkscape crashes as soon as you shif+click on that node.

[jazzynico (jazzynico)]

Thanks for the clarification, Giovanni!

[jazzynico (jazzynico)]

Not reproduced on Xubuntu 15.10, Inkscape 0.91 and trunk rev. 14504.

[su_v (suv-lp)]

Not reproduced with:
- Inkscape 0.91 r13725 on Windows 7 Professional
- Inkscape 0.91 r13725, 0.91+devel r14503 on OS X 10.7.5.

I also failed to reproduce the similar/identical crash reported in the comments of bug #1262753 (though I can't parse the steps provided in comment #2 there, since a shape handle (e.g. of an arc or segment) cannot be selected with any tool, only highlighted on hover and grabbed for dragging). This report and bug #1262753 are probably about the same issue - I won't change the bug status though (nor link the report as duplicate to the older one): the reporter of this one assigned him-/herself to the report - so there's likely a patch incoming for this one by Giovanni (which will fix what looks like a Windows 10-specific issue), and both reports can then be further triaged based on the proposed fix for this one.

[Mutasem Barjawi (mutasemhb)]

Hello, I am a new user to Inkscape. I have Inkscape 0.91 r13725 installed on a Win10. I was able to reproduce this bug three times. I can simply reproduce the bug by:

1- Running Inkscape.
2- Drawing a circle. Choose a fill and a stroke colors.
3- Move the circular anchor to make an arc/segment.
4- Shift click on that anchor.
then it crashes.

[Mutasem Barjawi (mutasemhb)]

Please note that selecting the arc/segment and clicking on the toolbar icon that makes the shape a whole ellipse again works fine without problems.

[Alvin Penner (apenner)]

@Mutasem - which specific installation file did you use? there are three possibilities:
website : https://inkscape.org/en/download/windows/
file:
- inkscape-0.91.msi
- inkscape-0.91-1.exe
- inkscape-0.91-x64.msi

[Pedro (pedrospinto)]

If you shift+click on a star/polygon (to remove rounding), you get a crash as well.
Inkscape 0.91 - Win 10

[Pedro (pedrospinto)]

@apenner - used all three instalation packages on the same Win10 x64 machine.

- inkscape-0.91.msi - crashes silently
- inkscape-0.91-1.exe - shows error message (see attachment)
- inkscape-0.91-x64.msi - crashes silently

[jazzynico (jazzynico)]

Not reproduced on Windows XP (32-bit), Inkscape 0.91, trunk rev. 14998 (official devlibs) and trunk rev. 14640 (experimental gcc5.1 devlibs).

The following reports seem to be at least related:
Bug #1522085 "Crash when shift+clicking on arc/segment node (ellipse tool)"
Bug #1530272 "shift click on rounded star crashes"
Bug #1594877 "crashes on shift+click rectangle rounding"

@64-bit Windows users, could you please test an experimental version (based on updated dependencies) available at ftp://download.tuxfamily.org/inkscape/win64/ and report back if it's fixed or not? Thanks!

[Pedro (pedrospinto)]

@jazzynico, still crashing with Inkscape_0.91+devel_64bit_r14950. Not fixed.

[jazzynico (jazzynico)]

Not reproduced on Windows 7, Inkscape 0.91 (64-bit, this time). According to all related reports, the bug seems to affect Windows 10 only, not older versions.

[Alex Masita (alexmasita)]

This same exact issue happens on OS X El Capitan Version 10.11.2. A solution will sure be greatly appreciated.

[Alex Masita (alexmasita)]

Let me add that I am using InkScape 0.91.

[Alvin Penner (apenner)]

reproduced on Windows 10, Inkscape 0.92.2pre0 (973e216, 2017-07-25) (32 bit)

- it took about 6 or 7 tries, but I got a crash. Popup window indicating a crash, no DOS exit message

[Alvin Penner (apenner)]

Windows 10, Inkscape 0.92.2pre0 (973e216, 2017-07-25) (32 bit)

finally got a backtrace after many tries:

Program received signal SIGSEGV, Segmentation fault.
0x01759158 in libinkscape_base!_ZN16KnotHolderEntity11update_knotEv () from c:\program files (x86)\inkscape\libinkscape_base.dll
(gdb)
(gdb) bt
#0 0x01759158 in libinkscape_base!_ZN16KnotHolderEntity11update_knotEv ()
   from c:\program files (x86)\inkscape\libinkscape_base.dll
#1 0x0175bd08 in libinkscape_base!_ZN10KnotHolder20knot_clicked_handlerEP6SPKnotj ()
   from c:\program files (x86)\inkscape\libinkscape_base.dll
#2 0x01a7aad1 in libinkscape_base!_ZN4sigc8internal9slot_callINS_18bound_mem_functor2Iv10KnotHolderP6SPKnotjEEvJS5_jEE7call_itEPNS0_8slot_repERKS5_RKj () from c:\program files (x86)\inkscape\libinkscape_base.dll
#3 0x08bbabb0 in ?? ()
#4 0x0175b703 in libinkscape_base!_Z32sp_knot_handler_request_positionP9_GdkEventP6SPKnot ()
   from c:\program files (x86)\inkscape\libinkscape_base.dll
#5 0x012cd8ea in sp_marshal_BOOLEAN__POINTER () from c:\program files (x86)\inkscape\libinkscape_base.dll
#6 0x63c45f72 in ?? () from c:\program files (x86)\inkscape\libgobject-2.0-0.dll
#7 0x63c57459 in ?? () from c:\program files (x86)\inkscape\libgobject-2.0-0.dll
#8 0x63c5f25a in ?? () from c:\program files (x86)\inkscape\libgobject-2.0-0.dll
#9 0x63c5fa17 in ?? () from c:\program files (x86)\inkscape\libgobject-2.0-0.dll
#10 0x011ec504 in libinkscape_base!_Z24sp_canvas_item_compare_zP12SPCanvasItemS0_ ()
   from c:\program files (x86)\inkscape\libinkscape_base.dll
#11 0x011ee4cd in libinkscape_base!_ZN8SPCanvas13handle_buttonEP10_GtkWidgetP15_GdkEventButton ()
   from c:\program files (x86)\inkscape\libinkscape_base.dll
#12 0x0066f9f0 in ?? ()
#13 0x00bcec81 in ?? ()
#14 0xac8b0000 in ?? ()
#15 0x0000d424 in ?? ()
#16 0x34bca100 in ?? ()
#17 0xc08501f0 in ?? ()
#18 0x02a2840f in ?? () from c:\program files (x86)\inkscape\libtiff-5.dll
#19 0x01e88328 in libinkscape_base!_ZZNK11PairingHeapIPN4vpsc10ConstraintEE15combineSiblingsEP8PairNodeIS2_EE9treeArray ()
   from c:\program files (x86)\inkscape\libinkscape_base.dll
#20 0x0f04f883 in ?? ()
#21 0x00014b87 in ?? ()
Cannot access memory at address 0x458b0004
(gdb) c
Continuing.
[New Thread 3724.0x2e5c]

Program received signal SIGSEGV, Segmentation fault.
0x01759158 in libinkscape_base!_ZN16KnotHolderEntity11update_knotEv () from c:\program files (x86)\inkscape\libinkscape_base.dll
(gdb) c
Continuing.
[Inferior 1 (process 3724) exited with code 030000000005]
(gdb) c
The program is not being run.
(gdb) q

[Alvin Penner (apenner)]

somewhat more readable backtrace from Windows XP, Inkscape 0.92.2 (unknown)
built from
inkscape-0.92.x-5c3e80d38602051974509262c13d76a068a041e4.zip

........................................................
Program received signal SIGSEGV, Segmentation fault.
0x01d402da in KnotHolderEntity::update_knot() ()
   from c:\inkscape\build\inkscape\libinkscape_base.dll
(gdb) bt
#0 0x01d402da in KnotHolderEntity::update_knot() ()
   from c:\inkscape\build\inkscape\libinkscape_base.dll
#1 0x60000000 in ?? ()
#2 0x406d76db in ?? ()
#3 0xc0000000 in ?? ()
#4 0x4072ba99 in ?? ()
#5 0x00000000 in ?? ()
(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x01d402da in KnotHolderEntity::update_knot() ()
   from c:\inkscape\build\inkscape\libinkscape_base.dll
(gdb) c
Continuing.
[Inferior 1 (process 3328) exited with code 030000000005]

[Patrick Storz (ede123)]

I was finally able to reproduce the crash, but did not get anywhere with tracking down the cause.

It seems to crash somewhere in KnotHolder::update_knots() while iterating over all knots (maybe an invalid pointer?).

I was able to trigger the crash in Inkscape 0.92.x (cc100def57, 2018-03-31).
I was *not* able to trigger the crash in Inkscape 0.92+devel (be5af7e781, 2018-04-15)

Interestingly I could also not see a crash in Inkscape 0.92.x when running through gdb, so I have a feeling it might be timing-related and/or caused by referencing an invalid pointer.

Maybe we try to update a soon-to-be-deleted knot which succeeds sometimes but not always?

[Hachmann (marenhachmann)]

Could the bug be Windows-specific? I cannot reproduce on LM 18.3 with 0.92.x.

[Sylvain Beucler (beuc)]

This looks like a duplicate of #1594877