Crash after selecting the "Create 3D Boxes" tool and dragging a sample box (inkscape trunk)

Bug #1620253 reported by Shlomi Fish on 2016-09-05
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Inkscape
High
Unassigned

Bug Description

In Inkscape trunk, after built and installed in Mageia Linux x86-64 v6, after I select the "Create 3D Boxes" tool from the toolbar, and drag to create a sample box in the document I am getting a crash. I built inkscape using this script:

««««««
#!/bin/bash
build_type=''
if test "$DEBUG" = 1 ; then
    build_type='-DCMAKE_BUILD_TYPE=Debug'
fi
flags='-DWITH_GTK3_EXPERIMENTAL=ON'
# flags=''

ninja='-G Ninja'
if test "$NO_NINJA" = 1 ; then
    ninja=''
fi

cmake $ninja $build_type -DCMAKE_INSTALL_PREFIX="$HOME/apps/graphics/inkscape-trunk" -DENABLE_LCMS=ON -DCMAKE_CXX_FLAGS="-fpermissive" -DENABLE_POPPLER=ON -DENABLE_POPPLER_CAIRO=ON -DWITH_DBUS=ON $flags "$@"
»»»»»»

And the backtrace is:

<<<<<<<<<<
Thread 1 "inkscape" received signal SIGSEGV, Segmentation fault.
0x0000000000000000 in ?? ()
Missing separate debuginfos, use: debuginfo-install lib64nss-mdns2-0.10-16.mga6.x86_64
(gdb) bt
#0 0x0000000000000000 in ()
#1 0x00007ffff74a1cc2 in Inkscape::XML::SimpleNode::changeOrder(Inkscape::XML::Node*, Inkscape::XML::Node*) ()
    at /home/shlomif/apps/graphics/inkscape-trunk/bin/../lib/inkscape/libinkscape_base.so
#2 0x00007ffff74ab861 in box3d_set_z_orders(SPBox3D*) ()
    at /home/shlomif/apps/graphics/inkscape-trunk/bin/../lib/inkscape/libinkscape_base.so
#3 0x00007ffff7176345 in Inkscape::UI::Tools::Box3dTool::drag(unsigned int) ()
    at /home/shlomif/apps/graphics/inkscape-trunk/bin/../lib/inkscape/libinkscape_base.so
#4 0x00007ffff7177398 in Inkscape::UI::Tools::Box3dTool::root_handler(_GdkEvent*) ()
    at /home/shlomif/apps/graphics/inkscape-trunk/bin/../lib/inkscape/libinkscape_base.so
#5 0x00007ffff71ca0da in Inkscape::UI::Tools::sp_event_context_virtual_root_handler(Inkscape::UI::Tools::ToolBase*, _GdkEvent*) ()
    at /home/shlomif/apps/graphics/inkscape-trunk/bin/../lib/inkscape/libinkscape_base.so
#6 0x00007ffff74bda69 in sp_desktop_root_handler(SPCanvasItem*, _GdkEvent*, SPDesktop*) ()
    at /home/shlomif/apps/graphics/inkscape-trunk/bin/../lib/inkscape/libinkscape_base.so
#7 0x00007ffff703db84 in sp_marshal_BOOLEAN__POINTER ()
    at /home/shlomif/apps/graphics/inkscape-trunk/bin/../lib/inkscape/libinkscape_base.so
#11 0x00007ffff5cd9812 in <emit signal ??? on instance ???> (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at gsignal.c:3441
    #8 0x00007ffff5cbef05 in g_closure_invoke (closure=0x2bcf050, return_value=return_value@entry=0x7fffffffc2b0, n_param_values=2, param_values=param_values@entry=0x7fffffffc1d0, invocation_hint=invocation_hint@entry=0x7fffffffc170)
    at gclosure.c:804
    #9 0x00007ffff5cd07f1 in signal_emit_unlocked_R (node=<optimized out>, detail=detail@entry=0, instance=instance@entry=0x2af9250, emission_return=emission_return@entry=0x7fffffffc2b0, instance_and_params=instance_and_params@entry=0x7fffffffc1d0) at gsignal.c:3629
---Type <return> to continue, or q <return> to quit---
    #10 0x00007ffff5cd8f83 in g_signal_emit_valist (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>, var_args=var_args@entry=0x7fffffffc378) at gsignal.c:3395
#12 0x00007ffff6f54624 in SPCanvas::emitEvent(_GdkEvent*) ()
    at /home/shlomif/apps/graphics/inkscape-trunk/bin/../lib/inkscape/libinkscape_base.so
#13 0x00007ffff6f54e03 in SPCanvas::handle_motion(_GtkWidget*, _GdkEventMotion*) ()
    at /home/shlomif/apps/graphics/inkscape-trunk/bin/../lib/inkscape/libinkscape_base.so
#18 0x00007ffff5cd9812 in <emit signal ??? on instance ???> (instance=instance@entry=0x7f24a0, signal_id=<optimized out>, detail=detail@entry=0)
    at gsignal.c:3441
    #14 0x00007fffefd54e6c in _gtk_marshal_BOOLEAN__BOXED (closure=0x67bbf0, return_value=0x7fffffffc610, n_param_values=<optimized out>, param_values=0x7fffffffc6c0, invocation_hint=<optimized out>, marshal_data=<optimized out>)
    at gtkmarshalers.c:86
    #15 0x00007ffff5cbef05 in g_closure_invoke (closure=closure@entry=0x67bbf0, return_value=return_value@entry=0x7fffffffc610, n_param_values=2, param_values=param_values@entry=0x7fffffffc6c0, invocation_hint=invocation_hint@entry=0x7fffffffc660) at gclosure.c:804
    #16 0x00007ffff5cd0d9e in signal_emit_unlocked_R (node=<optimized out>, detail=detail@entry=0, instance=instance@entry=0x7f24a0, emission_return=emission_return@entry=0x7fffffffc7a0, instance_and_params=instance_and_params@entry=0x7fffffffc6c0) at gsignal.c:3667
    #17 0x00007ffff5cd8f83 in g_signal_emit_valist (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>, var_args=var_args@entry=0x7fffffffc868) at gsignal.c:3395
#19 0x00007fffefe8eba4 in gtk_widget_event_internal (widget=0x7f24a0, event=0x359c260) at gtkwidget.c:7731
#20 0x00007fffefd521ce in propagate_event (topmost=<optimized out>, event=<optimized out>, widget=0x7f24a0) at gtkmain.c:2545
#21 0x00007fffefd521ce in propagate_event (widget=<optimized out>, event=0x359c260, captured=<optimized out>, topmost=0x0) at gtkmain.c:2647
#22 0x00007fffefd53ff0 in gtk_main_do_event (event=0x359c260) at gtkmain.c:1878
#23 0x00007fffef8975c5 in _gdk_event_emit (event=event@entry=0x359c260)
---Type <return> to continue, or q <return> to quit---
    at gdkevents.c:73
#24 0x00007fffef8c37d2 in gdk_event_source_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>) at gdkeventsource.c:367
#25 0x00007ffff4a841d7 in g_main_context_dispatch (context=0x7efeb0)
    at gmain.c:3154
#26 0x00007ffff4a841d7 in g_main_context_dispatch (context=context@entry=0x7efeb0) at gmain.c:3769
#27 0x00007ffff4a84408 in g_main_context_iterate (context=0x7efeb0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3840
#28 0x00007ffff4a84722 in g_main_loop_run (loop=0x39c1590) at gmain.c:4034
#29 0x00007fffefd53245 in gtk_main () at gtkmain.c:1269
#30 0x0000000000407146 in sp_main_gui(int, char const**) ()
#31 0x00007fffed55d600 in __libc_start_main (main=
    0x4050e0 <main>, argc=1, argv=0x7fffffffcd18, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffcd08)
    at libc-start.c:289
#32 0x0000000000405619 in _start () at ../sysdeps/x86_64/start.S:118
(gdb) q

>>>>>>>>>>

Shlomi Fish (shlomif-gmail) wrote :
Download full text (27.8 KiB)

Here is a better backtrace with debug symbols on and bt full:

(gdb) bt full
#0 0x0000000000000000 in ()
#1 0x00007ffff6e769e8 in Inkscape::XML::SimpleNode::changeOrder(Inkscape::XML::Node*, Inkscape::XML::Node*) (this=0x47112d0, generic_child=0x4786c10, generic_ref=0x2e9c040)
    at /home/shlomif/Download/unpack/graphics/inkscape/inkscape/src/xml/simple-node.cpp:482
        __PRETTY_FUNCTION__ = "virtual void Inkscape::XML::SimpleNode::changeOrder(Inkscape::XML::Node*, Inkscape::XML::Node*)"
        child = 0x7fffffffb860
        ref = 0x7fffffffb860
        prev = 0x2e9c0e0
        tracker =
            {<Inkscape::Debug::EventTrackerBase> = {_vptr.EventTrackerBase = 0x7fffffffb830, _active = 123}, <No data fields>}
        next = 0x7fffffffb860
#2 0x00007ffff70590d5 in SPItem::lowerToBottom() (this=0x3cfa870)
    at /home/shlomif/Download/unpack/graphics/inkscape/inkscape/src/sp-item.cpp:331
        ref = 0x2e9c040
        bottom =
            {static stateful_value_traits = false, members_ = {nodeptr_ = 0x2e9c0e0}}
#3 0x00007ffff6e807bd in box3d_set_z_orders(SPBox3D*) (box=0x2e9c000)
    at /home/shlomif/Download/unpack/graphics/inkscape/inkscape/src/box3d.cpp:1092
        i = 0
        sides =
          std::map with 6 elements = {[0] = 0x2e959a0, [1] = 0x7841c90, [2] = 0x3cfa870, [3] = 0x7851410, [4] = 0x7853ce0, [5] = 0x78564e0}
        side = {first = 2, second = }
#4 0x00007ffff69e9754 in Inkscape::UI::Tools::Box3dTool::drag(unsigned int) (this=0x2e92e70)
    at /home/shlomif/Download/unpack/graphics/inkscape/inkscape/src/ui/tools/box3d-tool.cpp:559
        __PRETTY_FUNCTION__ = "void Inkscape::UI::Tools::Box3dTool::drag(guint)"
#5 0x00007ffff69e84da in Inkscape::UI::Tools::Box3dTool::root_handler(_GdkEvent*---Type <return> to continue, or q <return> to quit---
) (this=0x2e92e70, event=0x3856280)
    at /home/shlomif/Download/unpack/graphics/inkscape/inkscape/src/ui/tools/box3d-tool.cpp:294
        motion_w =
            {<boost::additive<Geom::Point, boost::totally_ordered<Geom::Point, boost::multiplicative<Geom::Point, double, Geom::MultipliableNoncommutative<Geom::Point, Geom::Affine, Geom::MultipliableNoncommutative<Geom::Point, Geom::Translate, Geom::MultipliableNoncommutative<Geom::Point, Geom::Rotate, Geom::MultipliableNoncommutative<Geom::Point, Geom::Scale, Geom::MultipliableNoncommutative<Geom::Point, Geom::HShear, Geom::MultipliableNoncommutative<Geom::Point, Geom::VShear, Geom::MultipliableNoncommutative<Geom::Point, Geom::Zoom, Geom::EmptyClass> > > > > > >, boost::detail::false_t>, boost::detail::empty_base<Geom::Point>, boost::detail::true_t>, boost::detail::empty_base<Geom::Point>, boost::detail::true_t>> = {<boost::additive1<Geom::Point, boost::totally_ordered<Geom::Point, boost::multiplicative<Geom::Point, double, Geom::MultipliableNoncommutative<Geom::Point, Geom::Affine, Geom::MultipliableNoncommutative<Geom::Point, Geom::Translate, Geom::MultipliableNoncommutative<Geom::Point, Geom::Rotate, Geom::MultipliableNoncommutative<Geom::Point, Geom::Scale, Geom::MultipliableNoncommutative<Geom::Point, Geom::HShear, Geom::MultipliableNoncommutative<Geom::Point, Geom::VShear, Geom::MultipliableNoncommutative<Ge...

Shlomi Fish (shlomif-gmail) wrote :

A bisect shows that the commit that introduced this problem is:

------------------------------------------------------------
revno: 15047 [merge]
committer: Adrian Boguszewski <email address hidden>
branch nick: inkscape
timestamp: Tue 2016-08-09 11:58:51 +0200
message:
  Merged gsoc work. Created better data structure for selections, replaced SPObject children list, improved spray tool, split tests to separate executables
diff:

jazzynico (jazzynico) on 2016-09-06
Changed in inkscape:
importance: Undecided → High
tags: added: 3dbox crash
tags: added: regression
Shlomi Fish (shlomif-gmail) wrote :

This is a tentative, symptomatic, patch to fix the problem against inksacpe trunk. There may be other problematic places that I didn't fix yet and it's possible that an automated test is in order.

I hereby disclaim any implicit or explicit ownership of my changes and place them under your choice of CC-zero/public domain/X11L/GPLv2+/any other approved open source licence.

Mc (mc...) wrote :

Adrian, could you double-check it? To see if it's the best fix considering your diff and/or if it can happen elsewhere after your merge

Thanks

No problem. I will check it in a few days

Changed in inkscape:
assignee: nobody → Adrian Boguszewski (adrianboguszewski)

Fixed in rev 15114

Changed in inkscape:
status: New → Incomplete
status: Incomplete → Fix Committed
Mc (mc...) on 2016-09-12
Changed in inkscape:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers