Crash on forward reference in SVG file

[Erik Heinz]

This bug can be triggered as follows:

1. Start inkscape to create an empty document,
2. Create a text object,
3. Create a e.g. circle,
4. Place the text object on the circle with "put on path",
5. Save the image as SVG.

When trying to open this SVG file by inkscape, it crashes with "Inkscape encountered an internal error and will close now".

While examining the SVG file, I found that the text object is defined _before_ the circle object it references by a "xlink:href". I am not sure if this is allowed by the SVG standard, but probably yes.

Inkscape, so it seems, has problems with this kind of forward reference. If I move the text object after the circle object using a text editor, inkscape can again load the file.

This was tested with inkscape master, version 2018-08-28.

Hope this help.

Best regards,
Erik

[Alvin Penner (apenner)]

- reproduced on Windows 10, Inkscape 0.92+devel (d890608, 2018-08-21) using the attached file.

- not reproduced on Windows 10, Inkscape 0.92.3 (f709311, 2018-08-13)

[Alvin Penner (apenner)]

backtrace:
[New Thread 1360.0x2594]

Program received signal SIGSEGV, Segmentation fault.
0x6a5dcf67 in libinkscape_base!_ZNK7SPCurve4copyEv () from c:\app\temp\inkscape_devel\libinkscape_base.dll
(gdb) bt
#0 0x6a5dcf67 in libinkscape_base!_ZNK7SPCurve4copyEv () from c:\app\temp\inkscape_devel\libinkscape_base.dll
#1 0x6a886498 in libinkscape_base!_ZN9SPUsePath14refresh_sourceEv () from c:\app\temp\inkscape_devel\libinkscape_base.dll
#2 0x6a883e3e in libinkscape_base!_Z23refresh_textpath_sourceP10SPTextPath ()
   from c:\app\temp\inkscape_devel\libinkscape_base.dll
#3 0x6a88490d in libinkscape_base!_ZN10SPTextPath6updateEP5SPCtxj () from c:\app\temp\inkscape_devel\libinkscape_base.dll
#4 0x6a85571e in libinkscape_base!_ZN8SPObject13updateDisplayEP5SPCtxj () from c:\app\temp\inkscape_devel\libinkscape_base.dll
#5 0x6a8811ff in libinkscape_base!_ZN6SPText6updateEP5SPCtxj () from c:\app\temp\inkscape_devel\libinkscape_base.dll
#6 0x6a85571e in libinkscape_base!_ZN8SPObject13updateDisplayEP5SPCtxj () from c:\app\temp\inkscape_devel\libinkscape_base.dll
#7 0x6a82ad87 in libinkscape_base!_ZN7SPGroup6updateEP5SPCtxj () from c:\app\temp\inkscape_devel\libinkscape_base.dll
#8 0x6a85571e in libinkscape_base!_ZN8SPObject13updateDisplayEP5SPCtxj () from c:\app\temp\inkscape_devel\libinkscape_base.dll
#9 0x6a82ad87 in libinkscape_base!_ZN7SPGroup6updateEP5SPCtxj () from c:\app\temp\inkscape_devel\libinkscape_base.dll
#10 0x6a869aeb in libinkscape_base!_ZN6SPRoot6updateEP5SPCtxj () from c:\app\temp\inkscape_devel\libinkscape_base.dll
#11 0x6a85571e in libinkscape_base!_ZN8SPObject13updateDisplayEP5SPCtxj () from c:\app\temp\inkscape_devel\libinkscape_base.dll
#12 0x6ac8ddfc in libinkscape_base!_ZN10SPDocument14ensureUpToDateEv () from c:\app\temp\inkscape_devel\libinkscape_base.dll
#13 0x6ac97a3b in libinkscape_base!_Z12sp_file_openRKN4Glib7ustringEPN8Inkscape9Extension9ExtensionEbb ()
   from c:\app\temp\inkscape_devel\libinkscape_base.dll
#14 0x6ac9c76a in libinkscape_base!_Z19sp_file_open_dialogRN3Gtk6WindowEPvS2_ ()
   from c:\app\temp\inkscape_devel\libinkscape_base.dll
#15 0x6ad72686 in libinkscape_base!_ZN8Inkscape8FileVerb7performEP8SPActionPv ()
   from c:\app\temp\inkscape_devel\libinkscape_base.dll
#16 0x6af8ba97 in libinkscape_base!_ZN4sigc8internal9slot_callINS_12bind_functorILin1ENS2_ILin1ENS_16pointer_functor2IP8SPActionPvvEES6_NS_3nilES8_S8_S8_S8_S8_EES5_S8_S8_S8_S8_S8_S8_EEvJEE7call_itEPNS0_8slot_repE ()
   from c:\app\temp\inkscape_devel\libinkscape_base.dll
#17 0x6a6ea2c9 in libinkscape_base!_Z17sp_action_performP8SPActionPv () from c:\app\temp\inkscape_devel\libinkscape_base.dll
#18 0x63c45f03 in ?? () from c:\app\temp\inkscape_devel\libgobject-2.0-0.dll
#19 0x63c5836d in ?? () from c:\app\temp\inkscape_devel\libgobject-2.0-0.dll
#20 0x63c60007 in ?? () from c:\app\temp\inkscape_devel\libgobject-2.0-0.dll
#21 0x63c60857 in ?? () from c:\app\temp\inkscape_devel\libgobject-2.0-0.dll
#22 0x668fe539 in ?? () from c:\app\temp\inkscape_devel\libgtk-3-0.dll
#23 0x667ca089 in ?? () from c:\app\temp\inkscape_devel\libgtk-3-0.dll
#24 0x667ca2e4 in ?? () from c:\app\temp\inkscape_devel\libgtk-3-0.dll
#25 0x667af779 in ?? () from c:\app\t...

[Nathan Lee (nathan.lee)]

Fixed for 1.0, was reported on GitLab https://gitlab.com/inkscape/inbox/-/issues/134 , fixed by abf707b5bc033615b24f7048fcccaa3a9a5148c6