paste into cloned group reproducably crashes inkscape

[Jakub Steiner]

To crash Inkscape (tested with "Inkscape 0.92pre2 r" from F25 and flatpaked nightly "Inkscape 0.92pre1 r"):

1) Open both attached SVGs.
2) Copy the whole group from paper-sheet.svg (g7829) into clipboard
3) In the paper-sheets.svg, enter the master group that's cloned around the whole canvas (g7897) using Ctrl+Enter.
4) Paste

Crash occurs.

[Jakub Steiner (jimmac-redhat)]

second example SVG required

[Jakub Steiner (jimmac-redhat)]

Probably unlikely to be useful, but here's a backtrace:

Thread 1 "inkscape" received signal SIGSEGV, Segmentation fault.
0x0000555555c3b822 in SPObject::childList(bool, SPObject::Action) ()
(gdb) bt
#0 0x0000555555c3b822 in SPObject::childList(bool, SPObject::Action) ()
#1 0x0000555555c8b0a3 in Inkscape::URIReference::_acceptObject(SPObject*) const ()
#2 0x0000555555c8a1b3 in Inkscape::URIReference::_setObject(SPObject*) ()
#3 0x0000555555c8ab07 in Inkscape::URIReference::attach(Inkscape::URI const&) ()
#4 0x0000555555c76b4d in SPIFilter::read(char const*) ()
#5 0x0000555555c65f83 in SPStyle::_mergeDecl(_CRDeclaration const*) ()
#6 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#7 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#8 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#9 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#10 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#11 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#12 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#13 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#14 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#15 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#16 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#17 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#18 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#19 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#20 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
---Type <return> to continue, or q <return> to quit---
#21 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#22 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#23 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#24 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#25 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#26 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#27 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#28 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#29 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#30 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#31 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#32 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#33 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#34 0x0000555555c65fe9 in SPStyle::_mergeString(char const*) ()
#35 0x0000555555c6d8ab in SPStyle::read(SPObject*, Inkscape::XML::Node*) ()
#36 0x0000555555c3b30b in SPObject::set(unsigned int, char const*) ()
#37 0x0000555555c0c087 in SPItem::set(unsigned int, char const*) ()
#38 0x0000555555c21875 in SPLPEItem::set(unsigned int, char const*) ()
#39 0x0000555555c40638 i...

[su_v (suv-lp)]

Based on tests with archived builds (on OS X 10.7.5):
- not reproduced with Inkscape 0.91 r13725,
- not reproduced with lp:inkscape rev <= 14244,
- reproduced with lp:inkscape rev >= 14245,
- reproduced with Inkscape 0.92pre2;
the reported crash on paste possibly was exposed with the changes in r14245:

Revision 14245: Fix for circular references detection in almost all cases, fixing bug #167247 and a few of its duplicates.
https://bazaar.launchpad.net/~inkscape.dev/inkscape/trunk/revision/14245

[su_v (suv-lp)]

Steps to reproduce crash from scratch:

1) launch inkscape (default prefs, default new doc)
2) draw a shape
3) apply a filter effect
4) group it (Ctrl+G), copy (Ctrl+C)
5) open new document (Ctrl+N)
6) draw a shape
7) group it (Ctrl+G), clone the group (Alt+D)
8) move clone aside
9) add a new layer (Ctrl+Shift+N)
10) move original group to new layer
11) enter group (Ctrl+Enter), paste (Ctrl+V)

[Mc (mc...)]

pushed in trunk r15193 and 0.92 r15138.

[Qantas94Heavy (qantas94heavy)]

Fix released in Inkscape 0.92.1.