Comment 2 for bug 1585270

Revision history for this message
Mc (mc...) wrote :

relevant bt:

#0 0x00007ffff6997b8c in Geom::Affine::operator[] (this=0x300000000258, i=0) at /home/mc/inkscape2/base/inkscape/src/2geom/affine.h:94
#1 0x00007ffff4238aa3 in Geom::Point::operator*= (this=0x7fffffffdd10, m=...) at /home/mc/inkscape2/base/inkscape/src/2geom/point.cpp:210
#2 0x00007ffff69993c2 in Geom::operator* (lhs=..., rhs=...) at /home/mc/inkscape2/base/inkscape/src/2geom/utils.h:59
#3 0x00007ffff71ca666 in SPDesktop::w2d (this=0x300000000000, p=...) at /home/mc/inkscape2/base/inkscape/src/desktop.cpp:1772
#4 0x00007ffff724d3da in sp_knot_handler_request_position (event=0x7279280, knot=0x3335f00) at /home/mc/inkscape2/base/inkscape/src/knot.cpp:366
#5 0x00007ffff6d6e824 in Inkscape::UI::Tools::sp_event_context_snap_watchdog_callback (data=0x73ea1b0) at /home/mc/inkscape2/base/inkscape/src/ui/tools/tool-base.cpp:1334

#0 to #4 have the problem that knot->desktop is an invalid pointer.

#5 calls check_if_knot_deleted(knot)
  which shows
  ** (inkscape:10081): WARNING **: Accessed knot after it was freed at 0x3335f00
... and proceeds to the crash (seriously, this should be an error, not a warning).

I did not find why the knot was considered freed.

Making check_if_knot_deleted return a boolean and putting in #5
---
if (check_if_knot_deleted(knot))
    break;
---
stops the node dragging process and prevents the crash but it's not a real fix.