Redoing an undone removed path effect gives segfault

Bug #1694111 reported by Parcly Taxel on 2017-05-28
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Inkscape
Undecided
Jabiertxof

Bug Description

(Trisquel 7.0, Inkscape r15710)

(1) Open the attached file
(2) Remove the path effect from the path
(3) Undo and redo

Program received signal SIGSEGV, Segmentation fault.
__GI___libc_free (mem=0x81) at malloc.c:2929
2929 malloc.c: No such file or directory.

Sample backtrace:

#0 __GI___libc_free (mem=0x81) at malloc.c:2929
#1 0x00007ffff684a678 in Inkscape::LivePathEffect::LPEObjectReference::unlink (this=0x892c340) at /home/parclytaxel/Documents/Computing/inkscape/src/live_effects/lpeobject-reference.cpp:79
#2 0x00007ffff6fd305a in SPLPEItem::set (this=0x7c8eaa0, key=20, value=0x0) at /home/parclytaxel/Documents/Computing/inkscape/src/sp-lpe-item.cpp:134
#3 0x00007ffff701a566 in SPShape::set (this=0x7c8eaa0, key=20, value=0x0) at /home/parclytaxel/Documents/Computing/inkscape/src/sp-shape.cpp:112
#4 0x00007ffff700eade in SPPath::set (this=0x7c8eaa0, key=20, value=0x0) at /home/parclytaxel/Documents/Computing/inkscape/src/sp-path.cpp:239
#5 0x00007ffff7003d59 in SPObject::setKeyValue (this=0x7c8eaa0, key=20, value=0x0) at /home/parclytaxel/Documents/Computing/inkscape/src/sp-object.cpp:980
#6 0x00007ffff7003e21 in SPObject::readAttr (this=0x7c8eaa0, key=0xbeff50 "inkscape:path-effect") at /home/parclytaxel/Documents/Computing/inkscape/src/sp-object.cpp:997
#7 0x00007ffff7003e61 in SPObject::repr_attr_changed (key=0xbeff50 "inkscape:path-effect", is_interactive=false, data=0x7c8eaa0) at /home/parclytaxel/Documents/Computing/inkscape/src/sp-object.cpp:1005
#8 0x00007ffff6dc4ed4 in Inkscape::XML::(anonymous namespace)::VectorNodeObserver::notifyAttributeChanged (this=0x380fd40, node=..., name=3525, old_value=..., new_value=...) at /home/parclytaxel/Documents/Computing/inkscape/src/xml/composite-node-observer.cpp:144
#9 0x00007ffff6dc4bd3 in Inkscape::XML::CompositeNodeObserver::notifyAttributeChanged (this=0x44ee140, node=..., name=3525, old_value=..., new_value=...) at /home/parclytaxel/Documents/Computing/inkscape/src/xml/composite-node-observer.cpp:94
#10 0x00007ffff6ddb1c0 in Inkscape::XML::SimpleNode::setAttribute (this=0x44ee0f0, name=0xbeff50 "inkscape:path-effect", value=0x0) at /home/parclytaxel/Documents/Computing/inkscape/src/xml/simple-node.cpp:397
#11 0x00007ffff6dc6c1f in (anonymous namespace)::LogPerformer::notifyAttributeChanged (this=0x7ffff7dd5df0 <(anonymous namespace)::LogPerformer::instance()::singleton>, node=..., name=3525, new_value=...) at /home/parclytaxel/Documents/Computing/inkscape/src/xml/event.cpp:113
#12 0x00007ffff6dc7101 in Inkscape::XML::EventChgAttr::_replayOne (this=0x382ea80, observer=...) at /home/parclytaxel/Documents/Computing/inkscape/src/xml/event.cpp:226
#13 0x00007ffff6dc8034 in Inkscape::XML::Event::replayOne (this=0x382ea80, observer=...) at /home/parclytaxel/Documents/Computing/inkscape/src/xml/event.h:111
#14 0x00007ffff6dc6f38 in Inkscape::XML::replay_log_to_observer (log=0x382ea00, observer=...) at /home/parclytaxel/Documents/Computing/inkscape/src/xml/event.cpp:189
#15 0x00007ffff6dc7012 in sp_repr_replay_log (log=0x382ea00) at /home/parclytaxel/Documents/Computing/inkscape/src/xml/event.cpp:208
#16 0x00007ffff6e2bd4d in Inkscape::DocumentUndo::redo (doc=0x13ca3c0) at /home/parclytaxel/Documents/Computing/inkscape/src/document-undo.cpp:310
#17 0x00007ffff6ee26b2 in sp_redo (desktop=0x140ba80) at /home/parclytaxel/Documents/Computing/inkscape/src/selection-chemistry.cpp:1208
#18 0x00007ffff6f5f167 in Inkscape::EditVerb::perform (action=0x23375c0, data=0x12) at /home/parclytaxel/Documents/Computing/inkscape/src/verbs.cpp:956
#19 0x00007ffff6f6e63f in sigc::pointer_functor2<SPAction*, void*, void>::operator() (this=0x234b2e8, _A_a1=@0x234b2f8: 0x23375c0, _A_a2=@0x234b2f0: 0x12) at /usr/include/sigc++-2.0/sigc++/functors/ptr_fun.h:147
#20 0x00007ffff6f6e42f in sigc::adaptor_functor<sigc::pointer_functor2<SPAction*, void*, void> >::operator()<SPAction*&, void*&> (this=0x234b2e0, _A_arg1=@0x234b2f8: 0x23375c0, _A_arg2=@0x234b2f0: 0x12) at /usr/include/sigc++-2.0/sigc++/adaptors/adaptor_trait.h:103
#21 0x00007ffff6f6e1ce in sigc::bind_functor<-1, sigc::pointer_functor2<SPAction*, void*, void>, void*, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil>::operator()<SPAction*&> (this=0x234b2d8, _A_arg1=@0x234b2f8: 0x23375c0) at /usr/include/sigc++-2.0/sigc++/adaptors/bind.h:1122
#22 0x00007ffff6f6df21 in sigc::bind_functor<-1, sigc::bind_functor<-1, sigc::pointer_functor2<SPAction*, void*, void>, void*, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil>, SPAction*, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil>::operator() (this=0x234b2d0) at /usr/include/sigc++-2.0/sigc++/adaptors/bind.h:1110
#23 0x00007ffff6f6d9df in sigc::internal::slot_call0<sigc::bind_functor<-1, sigc::bind_functor<-1, sigc::pointer_functor2<SPAction*, void*, void>, void*, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil>, SPAction*, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil>, void>::call_it (rep=0x234b2a0) at /usr/include/sigc++-2.0/sigc++/functors/slot.h:103
#24 0x00007ffff66430f7 in sigc::internal::signal_emit0<void, sigc::nil>::emit (impl=0x234b280) at /usr/include/sigc++-2.0/sigc++/signal.h:776
#25 0x00007ffff664349e in sigc::signal0<void, sigc::nil>::emit (this=0x2337618) at /usr/include/sigc++-2.0/sigc++/signal.h:2673
#26 0x00007ffff6725cad in sp_action_perform (action=0x23375c0) at /home/parclytaxel/Documents/Computing/inkscape/src/helper/action.cpp:134
#27 0x00007ffff6f10c32 in sp_shortcut_invoke (shortcut=50331738, view=0x140ba80) at /home/parclytaxel/Documents/Computing/inkscape/src/shortcuts.cpp:72
#28 0x00007ffff675292e in on_window_key_press (event=0x3d61b10) at /home/parclytaxel/Documents/Computing/inkscape/src/helper/window.cpp:30
#29 0x00007ffff675313d in sigc::pointer_functor1<_GdkEventKey*, bool>::operator() (this=0x2e067c8, _A_a1=@0x7fffffffd728: 0x3d61b10) at /usr/include/sigc++-2.0/sigc++/functors/ptr_fun.h:111
#30 0x00007ffff67530c9 in sigc::adaptor_functor<sigc::pointer_functor1<_GdkEventKey*, bool> >::operator()<_GdkEventKey* const&> (this=0x2e067c0, _A_arg1=@0x7fffffffd728: 0x3d61b10) at /usr/include/sigc++-2.0/sigc++/adaptors/adaptor_trait.h:84
#31 0x00007ffff6752fa4 in sigc::internal::slot_call1<sigc::pointer_functor1<_GdkEventKey*, bool>, bool, _GdkEventKey*>::call_it (rep=0x2e06790, a_1=@0x7fffffffd728: 0x3d61b10) at /usr/include/sigc++-2.0/sigc++/functors/slot.h:137
#32 0x00007ffff454559b in ?? () from /usr/lib/x86_64-linux-gnu/libgtkmm-3.0.so.1
#33 0x00007ffff37f9c4c in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#34 0x00007ffff19583b8 in g_closure_invoke () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#35 0x00007ffff1969fd1 in ?? () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#36 0x00007ffff19716f9 in g_signal_emit_valist () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#37 0x00007ffff1971ce2 in g_signal_emit () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#38 0x00007ffff3922974 in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#39 0x00007ffff37f81af in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#40 0x00007ffff37f991a in gtk_main_do_event () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#41 0x0000000000424522 in snooper (event=0x3d61b10) at /home/parclytaxel/Documents/Computing/inkscape/src/main.cpp:1008
#42 0x00007ffff33fdc22 in ?? () from /usr/lib/x86_64-linux-gnu/libgdk-3.so.0
#43 0x00007ffff4e18e04 in g_main_context_dispatch () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#44 0x00007ffff4e19048 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#45 0x00007ffff4e1930a in g_main_loop_run () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#46 0x00007ffff37f8e25 in gtk_main () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#47 0x00000000004246de in sp_main_gui (argc=1, argv=0x7fffffffdf58) at /home/parclytaxel/Documents/Computing/inkscape/src/main.cpp:1045
#48 0x0000000000423f66 in main (argc=1, argv=0x7fffffffdf58) at /home/parclytaxel/Documents/Computing/inkscape/src/main.cpp:782

The same segmentation fault appears to happen even during normal use of the program, if the program is used long enough. In some cases it can be triggered by joining nodes of different paths together, or even drawing a path.

description: updated
Jabiertxof (jabiertxof) wrote :

fixed in r.15713. Thanks for report!

Changed in inkscape:
assignee: nobody → Jabiertxof (jabiertxof)
status: New → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Bug attachments