Crash after selecting the "Create 3D Boxes" tool and dragging a sample box (inkscape trunk)

Bug #1620253 reported by Shlomi Fish
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Inkscape
Fix Released
High
Unassigned

Bug Description

In Inkscape trunk, after built and installed in Mageia Linux x86-64 v6, after I select the "Create 3D Boxes" tool from the toolbar, and drag to create a sample box in the document I am getting a crash. I built inkscape using this script:

««««««
#!/bin/bash
build_type=''
if test "$DEBUG" = 1 ; then
    build_type='-DCMAKE_BUILD_TYPE=Debug'
fi
flags='-DWITH_GTK3_EXPERIMENTAL=ON'
# flags=''

ninja='-G Ninja'
if test "$NO_NINJA" = 1 ; then
    ninja=''
fi

cmake $ninja $build_type -DCMAKE_INSTALL_PREFIX="$HOME/apps/graphics/inkscape-trunk" -DENABLE_LCMS=ON -DCMAKE_CXX_FLAGS="-fpermissive" -DENABLE_POPPLER=ON -DENABLE_POPPLER_CAIRO=ON -DWITH_DBUS=ON $flags "$@"
»»»»»»

And the backtrace is:

<<<<<<<<<<
Thread 1 "inkscape" received signal SIGSEGV, Segmentation fault.
0x0000000000000000 in ?? ()
Missing separate debuginfos, use: debuginfo-install lib64nss-mdns2-0.10-16.mga6.x86_64
(gdb) bt
#0 0x0000000000000000 in ()
#1 0x00007ffff74a1cc2 in Inkscape::XML::SimpleNode::changeOrder(Inkscape::XML::Node*, Inkscape::XML::Node*) ()
    at /home/shlomif/apps/graphics/inkscape-trunk/bin/../lib/inkscape/libinkscape_base.so
#2 0x00007ffff74ab861 in box3d_set_z_orders(SPBox3D*) ()
    at /home/shlomif/apps/graphics/inkscape-trunk/bin/../lib/inkscape/libinkscape_base.so
#3 0x00007ffff7176345 in Inkscape::UI::Tools::Box3dTool::drag(unsigned int) ()
    at /home/shlomif/apps/graphics/inkscape-trunk/bin/../lib/inkscape/libinkscape_base.so
#4 0x00007ffff7177398 in Inkscape::UI::Tools::Box3dTool::root_handler(_GdkEvent*) ()
    at /home/shlomif/apps/graphics/inkscape-trunk/bin/../lib/inkscape/libinkscape_base.so
#5 0x00007ffff71ca0da in Inkscape::UI::Tools::sp_event_context_virtual_root_handler(Inkscape::UI::Tools::ToolBase*, _GdkEvent*) ()
    at /home/shlomif/apps/graphics/inkscape-trunk/bin/../lib/inkscape/libinkscape_base.so
#6 0x00007ffff74bda69 in sp_desktop_root_handler(SPCanvasItem*, _GdkEvent*, SPDesktop*) ()
    at /home/shlomif/apps/graphics/inkscape-trunk/bin/../lib/inkscape/libinkscape_base.so
#7 0x00007ffff703db84 in sp_marshal_BOOLEAN__POINTER ()
    at /home/shlomif/apps/graphics/inkscape-trunk/bin/../lib/inkscape/libinkscape_base.so
#11 0x00007ffff5cd9812 in <emit signal ??? on instance ???> (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at gsignal.c:3441
    #8 0x00007ffff5cbef05 in g_closure_invoke (closure=0x2bcf050, return_value=return_value@entry=0x7fffffffc2b0, n_param_values=2, param_values=param_values@entry=0x7fffffffc1d0, invocation_hint=invocation_hint@entry=0x7fffffffc170)
    at gclosure.c:804
    #9 0x00007ffff5cd07f1 in signal_emit_unlocked_R (node=<optimized out>, detail=detail@entry=0, instance=instance@entry=0x2af9250, emission_return=emission_return@entry=0x7fffffffc2b0, instance_and_params=instance_and_params@entry=0x7fffffffc1d0) at gsignal.c:3629
---Type <return> to continue, or q <return> to quit---
    #10 0x00007ffff5cd8f83 in g_signal_emit_valist (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>, var_args=var_args@entry=0x7fffffffc378) at gsignal.c:3395
#12 0x00007ffff6f54624 in SPCanvas::emitEvent(_GdkEvent*) ()
    at /home/shlomif/apps/graphics/inkscape-trunk/bin/../lib/inkscape/libinkscape_base.so
#13 0x00007ffff6f54e03 in SPCanvas::handle_motion(_GtkWidget*, _GdkEventMotion*) ()
    at /home/shlomif/apps/graphics/inkscape-trunk/bin/../lib/inkscape/libinkscape_base.so
#18 0x00007ffff5cd9812 in <emit signal ??? on instance ???> (instance=instance@entry=0x7f24a0, signal_id=<optimized out>, detail=detail@entry=0)
    at gsignal.c:3441
    #14 0x00007fffefd54e6c in _gtk_marshal_BOOLEAN__BOXED (closure=0x67bbf0, return_value=0x7fffffffc610, n_param_values=<optimized out>, param_values=0x7fffffffc6c0, invocation_hint=<optimized out>, marshal_data=<optimized out>)
    at gtkmarshalers.c:86
    #15 0x00007ffff5cbef05 in g_closure_invoke (closure=closure@entry=0x67bbf0, return_value=return_value@entry=0x7fffffffc610, n_param_values=2, param_values=param_values@entry=0x7fffffffc6c0, invocation_hint=invocation_hint@entry=0x7fffffffc660) at gclosure.c:804
    #16 0x00007ffff5cd0d9e in signal_emit_unlocked_R (node=<optimized out>, detail=detail@entry=0, instance=instance@entry=0x7f24a0, emission_return=emission_return@entry=0x7fffffffc7a0, instance_and_params=instance_and_params@entry=0x7fffffffc6c0) at gsignal.c:3667
    #17 0x00007ffff5cd8f83 in g_signal_emit_valist (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>, var_args=var_args@entry=0x7fffffffc868) at gsignal.c:3395
#19 0x00007fffefe8eba4 in gtk_widget_event_internal (widget=0x7f24a0, event=0x359c260) at gtkwidget.c:7731
#20 0x00007fffefd521ce in propagate_event (topmost=<optimized out>, event=<optimized out>, widget=0x7f24a0) at gtkmain.c:2545
#21 0x00007fffefd521ce in propagate_event (widget=<optimized out>, event=0x359c260, captured=<optimized out>, topmost=0x0) at gtkmain.c:2647
#22 0x00007fffefd53ff0 in gtk_main_do_event (event=0x359c260) at gtkmain.c:1878
#23 0x00007fffef8975c5 in _gdk_event_emit (event=event@entry=0x359c260)
---Type <return> to continue, or q <return> to quit---
    at gdkevents.c:73
#24 0x00007fffef8c37d2 in gdk_event_source_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>) at gdkeventsource.c:367
#25 0x00007ffff4a841d7 in g_main_context_dispatch (context=0x7efeb0)
    at gmain.c:3154
#26 0x00007ffff4a841d7 in g_main_context_dispatch (context=context@entry=0x7efeb0) at gmain.c:3769
#27 0x00007ffff4a84408 in g_main_context_iterate (context=0x7efeb0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3840
#28 0x00007ffff4a84722 in g_main_loop_run (loop=0x39c1590) at gmain.c:4034
#29 0x00007fffefd53245 in gtk_main () at gtkmain.c:1269
#30 0x0000000000407146 in sp_main_gui(int, char const**) ()
#31 0x00007fffed55d600 in __libc_start_main (main=
    0x4050e0 <main>, argc=1, argv=0x7fffffffcd18, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffcd08)
    at libc-start.c:289
#32 0x0000000000405619 in _start () at ../sysdeps/x86_64/start.S:118
(gdb) q

>>>>>>>>>>

Revision history for this message
Shlomi Fish (shlomif-gmail) wrote :
Download full text (27.8 KiB)

Here is a better backtrace with debug symbols on and bt full:

(gdb) bt full
#0 0x0000000000000000 in ()
#1 0x00007ffff6e769e8 in Inkscape::XML::SimpleNode::changeOrder(Inkscape::XML::Node*, Inkscape::XML::Node*) (this=0x47112d0, generic_child=0x4786c10, generic_ref=0x2e9c040)
    at /home/shlomif/Download/unpack/graphics/inkscape/inkscape/src/xml/simple-node.cpp:482
        __PRETTY_FUNCTION__ = "virtual void Inkscape::XML::SimpleNode::changeOrder(Inkscape::XML::Node*, Inkscape::XML::Node*)"
        child = 0x7fffffffb860
        ref = 0x7fffffffb860
        prev = 0x2e9c0e0
        tracker =
            {<Inkscape::Debug::EventTrackerBase> = {_vptr.EventTrackerBase = 0x7fffffffb830, _active = 123}, <No data fields>}
        next = 0x7fffffffb860
#2 0x00007ffff70590d5 in SPItem::lowerToBottom() (this=0x3cfa870)
    at /home/shlomif/Download/unpack/graphics/inkscape/inkscape/src/sp-item.cpp:331
        ref = 0x2e9c040
        bottom =
            {static stateful_value_traits = false, members_ = {nodeptr_ = 0x2e9c0e0}}
#3 0x00007ffff6e807bd in box3d_set_z_orders(SPBox3D*) (box=0x2e9c000)
    at /home/shlomif/Download/unpack/graphics/inkscape/inkscape/src/box3d.cpp:1092
        i = 0
        sides =
          std::map with 6 elements = {[0] = 0x2e959a0, [1] = 0x7841c90, [2] = 0x3cfa870, [3] = 0x7851410, [4] = 0x7853ce0, [5] = 0x78564e0}
        side = {first = 2, second = }
#4 0x00007ffff69e9754 in Inkscape::UI::Tools::Box3dTool::drag(unsigned int) (this=0x2e92e70)
    at /home/shlomif/Download/unpack/graphics/inkscape/inkscape/src/ui/tools/box3d-tool.cpp:559
        __PRETTY_FUNCTION__ = "void Inkscape::UI::Tools::Box3dTool::drag(guint)"
#5 0x00007ffff69e84da in Inkscape::UI::Tools::Box3dTool::root_handler(_GdkEvent*---Type <return> to continue, or q <return> to quit---
) (this=0x2e92e70, event=0x3856280)
    at /home/shlomif/Download/unpack/graphics/inkscape/inkscape/src/ui/tools/box3d-tool.cpp:294
        motion_w =
            {<boost::additive<Geom::Point, boost::totally_ordered<Geom::Point, boost::multiplicative<Geom::Point, double, Geom::MultipliableNoncommutative<Geom::Point, Geom::Affine, Geom::MultipliableNoncommutative<Geom::Point, Geom::Translate, Geom::MultipliableNoncommutative<Geom::Point, Geom::Rotate, Geom::MultipliableNoncommutative<Geom::Point, Geom::Scale, Geom::MultipliableNoncommutative<Geom::Point, Geom::HShear, Geom::MultipliableNoncommutative<Geom::Point, Geom::VShear, Geom::MultipliableNoncommutative<Geom::Point, Geom::Zoom, Geom::EmptyClass> > > > > > >, boost::detail::false_t>, boost::detail::empty_base<Geom::Point>, boost::detail::true_t>, boost::detail::empty_base<Geom::Point>, boost::detail::true_t>> = {<boost::additive1<Geom::Point, boost::totally_ordered<Geom::Point, boost::multiplicative<Geom::Point, double, Geom::MultipliableNoncommutative<Geom::Point, Geom::Affine, Geom::MultipliableNoncommutative<Geom::Point, Geom::Translate, Geom::MultipliableNoncommutative<Geom::Point, Geom::Rotate, Geom::MultipliableNoncommutative<Geom::Point, Geom::Scale, Geom::MultipliableNoncommutative<Geom::Point, Geom::HShear, Geom::MultipliableNoncommutative<Geom::Point, Geom::VShear, Geom::MultipliableNoncommutative<Ge...

Revision history for this message
Shlomi Fish (shlomif-gmail) wrote :

A bisect shows that the commit that introduced this problem is:

------------------------------------------------------------
revno: 15047 [merge]
committer: Adrian Boguszewski <email address hidden>
branch nick: inkscape
timestamp: Tue 2016-08-09 11:58:51 +0200
message:
  Merged gsoc work. Created better data structure for selections, replaced SPObject children list, improved spray tool, split tests to separate executables
diff:

jazzynico (jazzynico)
Changed in inkscape:
importance: Undecided → High
tags: added: 3dbox crash
tags: added: regression
Revision history for this message
Shlomi Fish (shlomif-gmail) wrote :

This is a tentative, symptomatic, patch to fix the problem against inksacpe trunk. There may be other problematic places that I didn't fix yet and it's possible that an automated test is in order.

I hereby disclaim any implicit or explicit ownership of my changes and place them under your choice of CC-zero/public domain/X11L/GPLv2+/any other approved open source licence.

Revision history for this message
Mc (mc...) wrote :

Adrian, could you double-check it? To see if it's the best fix considering your diff and/or if it can happen elsewhere after your merge

Thanks

Revision history for this message
Adrian Boguszewski (adrianboguszewski) wrote :

No problem. I will check it in a few days

Changed in inkscape:
assignee: nobody → Adrian Boguszewski (adrianboguszewski)
Revision history for this message
Adrian Boguszewski (adrianboguszewski) wrote :

Fixed in rev 15114

Changed in inkscape:
status: New → Incomplete
status: Incomplete → Fix Committed
Mc (mc...)
Changed in inkscape:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.