Crash in sp-lpe-item.cpp when deleting object

Bug #1634645 reported by houz on 2016-10-18
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Inkscape
Undecided
Jabiertxof

Bug Description

When deleting one of the objects in the attached SVG a current build of revno 15175 segfaults in src/sp-lpe-item.cpp:517 due to this->getRepr() returning NULL.

Backtrace:

(gdb) bt
#0 0x00007ffff75d5e48 in SPLPEItem::removeAllPathEffects(bool) (this=0x2033460, keep_paths=<optimized out>)
    at /home/houz/programming/inkscape/inkscape/src/sp-lpe-item.cpp:517
#1 0x00007ffff75f3565 in SPObject::deleteObject(bool, bool) (this=this@entry=0x2033460, propagate=propagate@entry=false, propagate_descendants=propagate_descendants@entry=false)
    at /home/houz/programming/inkscape/inkscape/src/sp-object.cpp:489
#2 0x00007ffff74c34d6 in SPDocument::collectOrphans() (propagate=false, this=0x2033460)
    at /home/houz/programming/inkscape/inkscape/src/sp-object.h:464
#3 0x00007ffff74c34d6 in SPDocument::collectOrphans() (this=0x2033460)
    at /home/houz/programming/inkscape/inkscape/src/sp-object.h:435
#4 0x00007ffff74c34d6 in SPDocument::collectOrphans() (this=this@entry=0x135ddc0)
    at /home/houz/programming/inkscape/inkscape/src/document.cpp:288
#5 0x00007ffff74c20ae in Inkscape::DocumentUndo::maybeDone(SPDocument*, char const*, unsigned int, Glib::ustring const&) (doc=0x135ddc0, key=key@entry=0x0, event_type=event_type@entry=33, event_description=...)
    at /home/houz/programming/inkscape/inkscape/src/document-undo.cpp:150
#6 0x00007ffff74c260c in Inkscape::DocumentUndo::done(SPDocument*, unsigned int, Glib::ustring const&) (doc=<optimized out>, event_type=event_type@entry=33, event_description=...)
    at /home/houz/programming/inkscape/inkscape/src/document-undo.cpp:98
#7 0x00007ffff7536475 in sp_selection_delete(SPDesktop*) (desktop=0x139ca80)
    at /home/houz/programming/inkscape/inkscape/src/selection-chemistry.cpp:411
#8 0x00007ffff6fccd1a in sp_action_perform(SPAction*, void*) (impl=0x22fcd80)
    at /usr/include/sigc++-2.0/sigc++/signal.h:798
#9 0x00007ffff6fccd1a in sp_action_perform(SPAction*, void*) (this=<optimized out>)
    at /usr/include/sigc++-2.0/sigc++/signal.h:2804
#10 0x00007ffff6fccd1a in sp_action_perform(SPAction*, void*) (action=<optimized out>)
    at /home/houz/programming/inkscape/inkscape/src/helper/action.cpp:134
#11 0x00007ffff755683d in sp_shortcut_invoke(unsigned int, Inkscape::UI::View::View*) (shortcut=<optimized out>, view=0x139ca80) at /home/houz/programming/inkscape/inkscape/src/shortcuts.cpp:72
#12 0x00007ffff1abe46d in () at /usr/lib/x86_64-linux-gnu/libgtkmm-3.0.so.1
#13 0x00007fffefcab42c in () at /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#17 0x00007ffff59ebfaf in <emit signal ??? on instance 0x2f7d7a0 [gtkmm__GtkWindow]> (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at ././gobject/gsignal.c:3447
    #14 0x00007ffff59d0f75 in g_closure_invoke (closure=0x33a1f90, return_value=return_value@entry=0x7fffffffd6d0, n_param_values=2, param_values=param_values@entry=0x7fffffffd730, invocation_hint=invocation_hint@entry=0x7fffffffd6b0)
    at ././gobject/gclosure.c:804
    #15 0x00007ffff59e3053 in signal_emit_unlocked_R (node=node@entry=0x697b00, detail=detail@entry=0, instance=instance@entry=0x2f7d7a0, emission_return=emission_return@entry=0x7fffffffd840, instance_and_params=instance_and_params@entry=0x---Type <return> to continue, or q <return> to quit---q

houz (houz) wrote :
Shlomi Fish (shlomif-gmail) wrote :

I can reproduce this crash on inkscape trunk on mageia v6 x86-64. It does not happen with /usr/bin/inkscape which is 0.91.

Shlomi Fish (shlomif-gmail) wrote :

I've done a bisecting and seems like the commit that introduced the problem is 15148 (again I may add).

Jabiertxof (jabiertxof) on 2016-10-19
Changed in inkscape:
assignee: nobody → Jabiertxof (jabiertxof)
Jabiertxof (jabiertxof) wrote :

Fixed in r15179.

Changed in inkscape:
status: New → Fix Released
Jabiertxof (jabiertxof) wrote :

Thanks Shlomi and houz for fill the bug!

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Bug attachments