unbounded recursion with markers in a stylesheet

Bug #261786 reported by desrt on 2008-08-27
Affects Status Importance Assigned to Milestone
Martin Owens

Bug Description

  Installed: 0.46-0ubuntu2
(ubuntu hardy)

this document crashes inkscape due to an unbounded recursion:

<?xml version='1.0'?>

<svg xmlns='http://www.w3.org/2000/svg'>
  <style type='text/css'>
      marker-start: url(#ouch);
  <marker id='ouch'>
    <path d='M 0 0 V 4'/>

  <path d='M 0 0 V 4'/>

i'm guessing the infinite recursion is caused by the fact that the stylesheet is trying to apply the marker to the path statement in the marker itself....

tags: added: crash
su_v (suv-lp) wrote :

reproduced with Inkscape 0.47+devel r9096 on OS X 10.5.8

Changed in inkscape:
importance: Undecided → High
status: New → Confirmed
su_v (suv-lp) wrote :
Martin Owens (doctormo) wrote :

I tracked through the infinite loop. The first problem is that the style sets a shape which is tries to render infinitely:

sp_shape.cpp:828 sp_shape_update_marker_view (shape, s);

 If that's dealt with it loops forever on bbox calculation because markers add to the bbox too.

sp_shape.cpp:545 bbox |= marker_item->visualBounds(tr);

So, that's just a rabbit hole. Instead I attacked the Shape->hasMarkers() with a simple for each parent, if parent is marker, this shape has no markers logic. This means we do not allow marker children to have markers. But it fixes this bug and I don't mind the restriction.

Changed in inkscape:
status: Confirmed → Fix Committed
assignee: nobody → Martin Owens (doctormo)
su_v (suv-lp) wrote :

Martin Owens updated bug status:
> status: Confirmed → Fix Committed


Changed in inkscape:
milestone: none → 0.49
Bryce Harrington (bryce) on 2015-02-21
Changed in inkscape:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers