Crash application without any message after saving image as Windows Metafile .wmf

[Ololuki]

I try to save attached file "diody.svg" as Windows Metafile .wmf and then Inkscape crashes
windows 7
Inkscape 0.91 r13725

[su_v (suv-lp)]

Please provide details about
1) the installer used for Inkscape 0.91: 32bit or 64bit?
2) the chosen WMF export settings

[su_v (suv-lp)]

Crash not reproduced with Inkscape 0.91 r13725 on OS X 10.7.5 using default WMF export settings (new prefs), see attached WMF file.

[Alvin Penner (apenner)]

- crash reproduced on Windows 7 (32 bit), Inkscape 0.91 r13725 (Jan 30 2015)
- file save type was Windows Metafile, export options all unchecked
- no DOS error messages

- crash not reproduced if I use the export option "Convert text to Paths", result attached here.

[Alvin Penner (apenner)]

- exactly same behavior seen on Windows XP, Inkscape 0.91+devel r14569 (Jan 9 2016)
- in this case, I get the backtrace below, when leaving all options unchecked

Program received signal SIGSEGV, Segmentation fault.
0x00760606 in U_WMREXTTEXTOUT_set ()
(gdb) bt
#0 0x00760606 in U_WMREXTTEXTOUT_set ()
#1 0xf75cb90b in ?? ()
#2 0x40b85c81 in ?? ()
#3 0x0023c570 in ?? ()
#4 0x00000001 in ?? ()
#5 0x00000000 in ?? ()
(gdb)

[su_v (suv-lp)]

Crash reproduced on OS X 10.7.5 with 0.91 r13725 and 0.91+devel r14584 as described by Alvin (i.e. if all WMF export options are unchecked).

[su_v (suv-lp)]

Backtrace with debug build 0.91+devel r14556 attached.

[Alvin Penner (apenner)]

attached is a reduced test case which produces the same crash. The crash may be related to some non-Ascii text characters in a tspan element. The relevant hex code is shown below.

000830 20 20 20 20 69 64 3D 22-74 73 70 61 6E 34 31 36 id="tspan416
000840 32 22 3E EF A3 A9 3C 2F-74 73 70 61 6E 3E 0A 20 2">´ú®</tspan>?

The three non-Ascii codes are 'EF A3 A9'.

[David Mathog (mathog)]

I could not reproduce the crash on my test system. Could not update and build the current release on 12.04 because it failed the requirement for bdw-gc 7.2. Currently updating to 14.04, but that is going to take a while. In the meantime, can somebody with a "crashable" configuration please do the following:

1. move the text into the drawing and see if it makes a difference. On my system diody_reduced has the text far outside
the drawing area.
2. list the WMF save options that are checked, especially the "Map Unicode" options. (I tried a bunch of combinations but
none of them crashed.)
3. Change the font to something other than "Symbol" and see if it makes a difference.

[Alvin Penner (apenner)]

attached is a modified file with the text moved so that it is visible. The text is an 'a' with a tilde symbol.
this crashes whenever the option "convert text to paths' is unchecked.

[Alvin Penner (apenner)]

attached is a modified file with the text modified so that it is a normal 'a'.
 this does not crash when exported as wmf

[Alvin Penner (apenner)]

fwiw, the corresponding emf output does not crash under any circumstances as far as I can tell, so it might be worthwhile to just duplicate the emf procedure in the wmf code.

[David Mathog (mathog)]

I still cannot get this to crash on my system!

Just upgraded to Ubuntu 14.04 (32 bit)

In Inkscape build directory:

bzr revert
bzr update
bzr revno
#14593
./configure
make clean
make
src/inkscape /tmp/diody_visible_crash.wmf
# save as, WMF "text to paths" checked, everything else unchecked.

No problem. Also no problem opening the wmf file that was created.

The character shown on my system is "copyright" though, not a with a tilde. Modified the no crash
one with U00E3 as the sole character. save svg. save as WMF, still no problem.

If you have a copy of inkscape compiled with -g, please try setting a breakpoint at wmf-print.emf:1517, load diody_visible_crash.svg, save it as wmf. On my system
with only option "text to paths" checked it never hits that point. With nothing checked it does,
and rtl=1,xpos=319,ypos (optimized out), ndx=1, *adx=66

IF "text to path" is set it isn't ever supposed to call PrintWmf::text(), which holds line 1517. Far upstream it is supposed
to convert the glyphs to strokes and call other routines. My best guess is that for some reason that upstream conversion
is failing, perhaps because of differences in fonts on our systems, and this case is unhandled so it does call text() but with invalid parameters.

[David Mathog (mathog)]

Sorry, typo, that was supposed to be:

src/inkscape /tmp/diody_visible_crash.svg

[Alvin Penner (apenner)]

as stated above, you need to uncheck all options

[David Mathog (mathog)]

I'm shooting blind here, but somebody who can reproduce the problem please give this patch a try.

[David Mathog (mathog)]

The patch of the last message was committed as revision 14594. Worst case, it should be harmless, best case it fixes this bug.

[Alvin Penner (apenner)]

fix confirmed on rev 14600, thanks David!

[Martin Owens (doctormo)]

Already backported