paste into cloned group reproducably crashes inkscape

Bug #1636533 reported by Jakub Steiner on 2016-10-25
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Inkscape
High
Mc

Bug Description

To crash Inkscape (tested with "Inkscape 0.92pre2 r" from F25 and flatpaked nightly "Inkscape 0.92pre1 r"):

1) Open both attached SVGs.
2) Copy the whole group from paper-sheet.svg (g7829) into clipboard
3) In the paper-sheets.svg, enter the master group that's cloned around the whole canvas (g7897) using Ctrl+Enter.
4) Paste

Crash occurs.

Jakub Steiner (jimmac-redhat) wrote :
Jakub Steiner (jimmac-redhat) wrote :

second example SVG required

Jakub Steiner (jimmac-redhat) wrote :
Download full text (6.0 KiB)

Probably unlikely to be useful, but here's a backtrace:

Thread 1 "inkscape" received signal SIGSEGV, Segmentation fault.
0x0000555555c3b822 in SPObject::childList(bool, SPObject::Action) ()
(gdb) bt
#0 0x0000555555c3b822 in SPObject::childList(bool, SPObject::Action) ()
#1 0x0000555555c8b0a3 in Inkscape::URIReference::_acceptObject(SPObject*) const ()
#2 0x0000555555c8a1b3 in Inkscape::URIReference::_setObject(SPObject*) ()
#3 0x0000555555c8ab07 in Inkscape::URIReference::attach(Inkscape::URI const&) ()
#4 0x0000555555c76b4d in SPIFilter::read(char const*) ()
#5 0x0000555555c65f83 in SPStyle::_mergeDecl(_CRDeclaration const*) ()
#6 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#7 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#8 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#9 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#10 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#11 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#12 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#13 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#14 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#15 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#16 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#17 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#18 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#19 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#20 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
---Type <return> to continue, or q <return> to quit---
#21 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#22 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#23 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#24 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#25 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#26 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#27 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#28 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#29 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#30 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#31 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#32 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#33 0x0000555555c65faa in SPStyle::_mergeDeclList(_CRDeclaration const*) ()
#34 0x0000555555c65fe9 in SPStyle::_mergeString(char const*) ()
#35 0x0000555555c6d8ab in SPStyle::read(SPObject*, Inkscape::XML::Node*) ()
#36 0x0000555555c3b30b in SPObject::set(unsigned int, char const*) ()
#37 0x0000555555c0c087 in SPItem::set(unsigned int, char const*) ()
#38 0x0000555555c21875 in SPLPEItem::set(unsigned int, char const*) ()
#39 0x0000555555c40638 i...

Read more...

su_v (suv-lp) wrote :

Based on tests with archived builds (on OS X 10.7.5):
- not reproduced with Inkscape 0.91 r13725,
- not reproduced with lp:inkscape rev <= 14244,
- reproduced with lp:inkscape rev >= 14245,
- reproduced with Inkscape 0.92pre2;
the reported crash on paste possibly was exposed with the changes in r14245:

Revision 14245: Fix for circular references detection in almost all cases, fixing bug #167247 and a few of its duplicates.
https://bazaar.launchpad.net/~inkscape.dev/inkscape/trunk/revision/14245

tags: added: clipboard crash regression
Changed in inkscape:
status: New → Confirmed
Mc (mc...) on 2016-10-25
Changed in inkscape:
assignee: nobody → Mc (mc...)
importance: Undecided → High
su_v (suv-lp) wrote :

Steps to reproduce crash from scratch:

1) launch inkscape (default prefs, default new doc)
2) draw a shape
3) apply a filter effect
4) group it (Ctrl+G), copy (Ctrl+C)
5) open new document (Ctrl+N)
6) draw a shape
7) group it (Ctrl+G), clone the group (Alt+D)
8) move clone aside
9) add a new layer (Ctrl+Shift+N)
10) move original group to new layer
11) enter group (Ctrl+Enter), paste (Ctrl+V)

Mc (mc...) on 2016-10-25
Changed in inkscape:
status: Confirmed → In Progress
Mc (mc...) wrote :

pushed in trunk r15193 and 0.92 r15138.

Changed in inkscape:
status: In Progress → Fix Committed
Qantas94Heavy (qantas94heavy) wrote :

Fix released in Inkscape 0.92.1.

Changed in inkscape:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers