3D box Crash on OS X

[John Faith]

Inkscape built from the 0.46 source crashes immediately when using the 3D box tool on OS X 10.3.9.

Steps to reproduce:
- Create a new drawing
- Select the 3D box tool from the toolbar
- Mouse-down in the drawing and drag
- Crash

The output on the console and gdb backtrace are:

Program received signal EXC_BAD_ACCESS, Could not access memory.
0x005a2834 in std::_Rb_tree<SPBox3D*, std::pair<SPBox3D* const, bool>, std::_Select1st<std::pair<SPBox3D* const, bool> >, std::less<SPBox3D*>, std::allocator<std::pair<SPBox3D* const, bool> > >::find(SPBox3D* const&) ()
(gdb) bt
#0 0x005a2834 in std::_Rb_tree<SPBox3D*, std::pair<SPBox3D* const, bool>, std::_Select1st<std::pair<SPBox3D* const, bool> >, std::less<SPBox3D*>, std::allocator<std::pair<SPBox3D* const, bool> > >::find(SPBox3D* const&) ()
#1 0x0004eae4 in persp3d_add_box_transform(Persp3D*, SPBox3D*) ()
#2 0x005b5ac8 in sigc::internal::slot_call2<sigc::bind_functor<-1, sigc::pointer_functor3<SPObject*, SPObject*, SPBox3D*, void>, SPBox3D*, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil>, void, SPObject*, SPObject*>::call_it(sigc::internal::slot_rep*, SPObject* const&, SPObject* const&) ()
#3 0x005a81c0 in sigc::internal::signal_emit2<void, SPObject*, SPObject*, sigc::nil>::emit(sigc::internal::signal_impl*, SPObject* const&, SPObject* const&) ()
#4 0x0006ef28 in Inkscape::URIReference::_setObject(SPObject*) ()
#5 0x0006eab4 in Inkscape::URIReference::attach(Inkscape::URI const&) ()
#6 0x000799f0 in box3d_set(SPObject*, unsigned, char const*) ()
#7 0x00021574 in sp_object_repr_attr_changed(Inkscape::XML::Node*, char const*, char const*, char const*, bool, void*) ()
#8 0x0069dcdc in Inkscape::XML::(anonymous namespace)::VectorNodeObserver::notifyAttributeChanged(Inkscape::XML::Node&, unsigned, Inkscape::Util::ptr_shared<char>, Inkscape::Util::ptr_shared<char>) ()
#9 0x00446de8 in Inkscape::XML::CompositeNodeObserver::notifyAttributeChanged(Inkscape::XML::Node&, unsigned, Inkscape::Util::ptr_shared<char>, Inkscape::Util::ptr_shared<char>) ()
#10 0x00445050 in Inkscape::XML::SimpleNode::setAttribute(char const*, char const*, bool) ()
#11 0x00079e94 in box3d_write(SPObject*, Inkscape::XML::Node*, unsigned) ()
#12 0x00102450 in sp_box3d_drag(Box3DContext&, unsigned) ()
#13 0x0010197c in sp_box3d_context_root_handler(SPEventContext*, _GdkEvent*) ()
#14 0x0004ced8 in sp_event_context_root_handler(SPEventContext*, _GdkEvent*) ()
#15 0x002c9e74 in sp_marshal_BOOLEAN__POINTER ()
#16 0x018cad4c in g_closure_invoke ()
#17 0x018dea90 in signal_emit_unlocked_R ()
#18 0x018ddd48 in g_signal_emit_valist ()
#19 0x02fe12a0 in gtk_signal_emit ()
#20 0x0029c3bc in emit_event(SPCanvas*, _GdkEvent*) ()
#21 0x0029c71c in sp_canvas_motion(_GtkWidget*, _GdkEventMotion*) ()
#22 0x02f41aa8 in _gtk_marshal_BOOLEAN__BOXED ()
#23 0x018cad4c in g_closure_invoke ()
#24 0x018dec70 in signal_emit_unlocked_R ()
#25 0x018ddd48 in g_signal_emit_valist ()
#26 0x018ddfa4 in g_signal_emit ()
#27 0x030f7908 in gtk_widget_event_internal ()
#28 0x030f71f4 in gtk_widget_event ()
#29 0x02f3f864 in gtk_propagate_event ()
#30 0x02f3dbcc in gtk_main_do_event ()
#31 0x018576c4 in gdk_event_dispatch ()
#32 0x029f4754 in g_main_dispatch ()
#33 0x029f4d5c in g_main_context_iterate ()
#34 0x029efe80 in g_main_loop_run ()
#35 0x02f3cd50 in gtk_main ()
...

[Maximilian Albert (cilix)]

So do I understand correctly that this happens on the 0.46 stable branch? I haven't checked that out yet (because I thought it would work the same as the main branch) but will have a look. Does the problem also exist in the main branch? Do you have a precise SVN revision where it fails (and maybe even one where it worked)? Thanks!

[John Faith (jfaith7)]

Yes, this is on "RELEASE_0_46_BRANCH" and the crash happens in svn revision 17911. I also see a crash on the trunk with revision 17396. I'm pretty sure I have seen 3D box work in this OS X environment, but unfortunately I do not have the older binary.

I hear that this crash does not occur with 0.46 on newer versions of OS X, but it might be worth following up with someone who can quickly test.

I have rebuilt 0.46 branch sources with debug symbols and am trying to get more info. If you have any ideas of where to look for trouble, or where to throw a printf, please let me know.

[John Olsen (johnny-automatic)]

no problems using OSX Leopard 10.5.2 - works as expected.

[Benoit Chesneau (bchesneau)]

same bug on openbsd 4.3-current: Selecting 3d toolbox, clicking on inkscape window, Inkscape open a dialog box and then X crash.

[Rygle (rygle)]

This is possibly related to a similar 3D box crash on Win32. A patch was release for that yesterday, and it is already appliled in trunk.

Here's the bug with the patch in there. https://bugs.launchpad.net/inkscape/+bug/208738

Can someone try building a new version on OSX from the latest trunk, which already has the patch, and from the 0.46 branch with the patch added?

[Rygle (rygle)]

John and others, can you please keep the bug about the Tiger build updated? It seems you must be able to build on versions earlier than 10.5.x.

There are links in that bug, particularly the nabble one, that will connect you with others trying to do a Tiger release. Thanks.

https://bugs.launchpad.net/inkscape/+bug/209058

[Maximilian Albert (cilix)]

@Rygle: To be candid, I doubt that the patch from bug 208738 fixes this issue. The backtrace looks rather different and the scenarios for the crash are different, too (of course, I'll be glad if someone reports otherwise).

I'll have a look at this one but it will be more difficult to track down since I don't have access to an OS X machine. John, I may get back to your offer to provide debugging information. I'll let you know when I have any clue what could be causing this. May be a while, though :-/

[Rygle (rygle)]

Seems there's a 10.4.x build up as of this morning.
http://downloads.sourceforge.net/inkscape/Inkscape-0.46-2.TIGER.UNIVERSAL.dmg

And here;
http://www.nabble.com/Official-Inkscape-0.46-OSX-package-for-Tiger-(10.4)-users-td16

[Benoit Chesneau (bchesneau)]

@Rygle it doesn't change anything on openbsd. I attached the patch I've done on 0.42 release.

[Benoit Chesneau (bchesneau)]

0.46 obviously ;)

[Rygle (rygle)]

Some people are having trouble starting up, even with the official 10.4 build. See here for progress;

http://www.nabble.com/Official-Inkscape-0.46-OSX-package-for-Tiger-(10.4)-users-td16382045.html

[John Faith (jfaith7)]

I tested the set of patches in patch-3dbox.tgz on the 0.46 branch on OS X 10.3.9, but unfortunately, I still get a crash as soon as the 3D box tool is used.

[Benoit Chesneau (bchesneau)]

maybe status could be set as confirmed. Do you need more log and such things ?

[John Faith (jfaith7)]

This crash seems to be caused by the Persp3D::boxes_transformed std::map member not being initialized (gcc3 limitation?). Changing boxes_transformed from a map to a pointer to a map and using 'new' to create it seems to fix this crash.

Also see launchpad bug 185689 for a similar std::map related OS X 10.3.9-only crash.

[MenTaLguY (mental-deactivatedaccount)]

Not a gcc limitation, but a GObject one. C++ constructors/destructors for members of GObject-derived classes don't get called automatically.

[Benoit Chesneau (bchesneau)]

this patch fix crash on OpenBSD. thanks :)

[John Faith (jfaith7)]

Fix committed in SVN main trunk revision 18200.