Inkscape

GTK+/Quartz: crash in Gtk::Editable_Class::set_selection_bounds_vfunc_callback (after clipboard_unset(…) )

Bug #528632 reported by Wolf on 2010-02-26

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	Inkscape	Invalid	High	Unassigned

Bug Description

2 crashes with very similar messages occured when manipulating in the "Layer" and the "Pattern Fill" tool, likly when switching between the tool window and the drawing window:

#1: Tried to shift a layer downwards,
#2: tried to select another fill pattern

++++++++++++++++++++++++++++++++++++++++++++++++++++
example for error message:

Date/Time: 2010-02-26 17:09:10.134 +0100
OS Version: 10.4.11 (Build 8S165)
Report Version: 4

Command: inkscape-bin
Path: /Users/bub/Desktop/bzr-Inkscape.app/Contents/Resources/bin/inkscape-bin
Parent: Inkscape [307]

Version: ??? (???)

PID: 308
Thread: 0

Exception: EXC_BAD_ACCESS (0x0001)
Codes: KERN_INVALID_ADDRESS (0x0001) at 0xfbfc24c0

Thread 0 Crashed:
0 libstdc++.6.dylib 0x0358da7c __dynamic_cast + 72 (dyncast.cc:52)
1 libgtkmm-2.4.1.dylib 0x01a3bb08 Gtk::Editable_Class::set_selection_bounds_vfunc_callback(_GtkEditable*, int, int) + 88
2 libgtk-quartz-2.0.0.dylib 0x020f9540 clipboard_unset + 192
3 libgtk-quartz-2.0.0.dylib 0x020f9768 gtk_clipboard_set_contents + 184
4 libgtk-quartz-2.0.0.dylib 0x01f2503c gtk_entry_update_primary_selection + 156
5 libgtk-quartz-2.0.0.dylib 0x01f274b0 gtk_entry_realize + 432
6 libgobject-2.0.0.dylib 0x024ec014 g_closure_invoke + 436
7 libgobject-2.0.0.dylib 0x024fe96c signal_emit_unlocked_R + 1820
8 libgobject-2.0.0.dylib 0x0250030c g_signal_emit_valist + 2012
9 libgobject-2.0.0.dylib 0x02500580 g_signal_emit + 48
10 libgtk-quartz-2.0.0.dylib 0x020e50d0 gtk_widget_realize + 368
11 libgtk-quartz-2.0.0.dylib 0x020e5e24 gtk_widget_set_parent + 596
12 libgtk-quartz-2.0.0.dylib 0x020be014 gtk_tree_view_real_start_editing + 244
13 libgtk-quartz-2.0.0.dylib 0x020c4968 gtk_tree_view_button_press + 1448
14 libgtk-quartz-2.0.0.dylib 0x01fab464 _gtk_marshal_BOOLEAN__BOXED + 244
15 libgobject-2.0.0.dylib 0x024ec014 g_closure_invoke + 436
16 libgobject-2.0.0.dylib 0x024fefcc signal_emit_unlocked_R + 3452
17 libgobject-2.0.0.dylib 0x02500370 g_signal_emit_valist + 2112
18 libgobject-2.0.0.dylib 0x02500580 g_signal_emit + 48
19 libgtk-quartz-2.0.0.dylib 0x020dbfb0 gtk_widget_event_internal + 800
20 libgtk-quartz-2.0.0.dylib 0x01fa93cc gtk_propagate_event + 508
21 libgtk-quartz-2.0.0.dylib 0x01fa98d0 gtk_main_do_event + 1216
22 libgdk-quartz-2.0.0.dylib 0x023243b4 gdk_event_dispatch + 132
23 libglib-2.0.0.dylib 0x0287af10 g_main_context_dispatch + 656
24 libglib-2.0.0.dylib 0x0287f524 g_main_context_iterate + 1316
25 libglib-2.0.0.dylib 0x0287f934 g_main_loop_run + 884
26 libgtk-quartz-2.0.0.dylib 0x01fa87f0 gtk_main + 224
27 inkscape-bin 0x00006094 sp_main_gui(int, char const**) + 1248
28 inkscape-bin 0x00005434 main + 1260
29 inkscape-bin 0x00003924 _start + 760
30 inkscape-bin 0x00003628 start + 48

Thread 1:
0 libSystem.B.dylib 0x9001f48c select + 12
1 libglib-2.0.0.dylib 0x0288e180 g_poll + 368
2 libgdk-quartz-2.0.0.dylib 0x02323a78 select_thread_func + 296
3 libSystem.B.dylib 0x9002b908 _pthread_body + 96

Thread 2:
0 libSystem.B.dylib 0x90053f88 semaphore_timedwait_signal_trap + 8
1 libSystem.B.dylib 0x90053de4 pthread_cond_timedwait + 676
2 libgthread-2.0.0.dylib 0x00ff8f58 g_cond_timed_wait_posix_impl + 232
3 libglib-2.0.0.dylib 0x02851e88 g_async_queue_pop_intern_unlocked + 296
4 libglib-2.0.0.dylib 0x02852390 g_async_queue_timed_pop + 208
5 libglib-2.0.0.dylib 0x028ad21c g_thread_pool_thread_proxy + 652
6 libglib-2.0.0.dylib 0x028aa768 g_thread_create_proxy + 376
7 libSystem.B.dylib 0x9002b908 _pthread_body + 96

++++++++++++++++++++++++++++++++++++++++++++++++++++

Console:

(inkscape-bin:308): Gtk-WARNING **: Vorgegebener Überwachungstyp für lokale Ordner konnte nicht gefunden werden

Tags:

Revision history for this message

su_v (suv-lp) wrote on 2010-02-26:

I assume this is with Inkscape Quartz 0.47+devel - which revision number?
Which gtk2/gtkmm version was installed when creating the application package?

tags:

added: crash osx

Revision history for this message

Wolf (drechsel) wrote on 2010-02-27:

inkscape 0.47 AQUA, devel-r9101

port installed gtk*
The following ports are currently installed:
  gtk-doc @1.11_1
  gtk-doc @1.13_0 (active)
  gtk2 @2.18.6_0+darwin_8+no_x11+quartz (active)
  gtk2-clearlooks @0.6.2_0 (active)
  gtkmm @2.18.2_0 (active)

Revision history for this message

Gellule (gellule-xg) wrote on 2011-05-27:

Hi Wolf,
I am not sure I understand how to reproduce your issue. Could you please add some details?
Thanks,

Revision history for this message

Wolf (drechsel) wrote on 2011-05-28:

This is the way I could reproduce it:

* freshly launch inkscape
* enlarge the inkscape window to fit the whole screen (mine is 1600px)
* open the "layers" panel
* Add a new layer
* click the mouse in the layers panel - right hand side besides the new layer name (grey colour, very right side)
* BANG!!!

There seem to be a two distinguished situations:

a) click to the very right side of the layers panel and you can edit the layer name: nothing happens
b) click to the very right side of the layers panel and you just hit the grey area, which will not change to the blue editable box: Crash!

It seems to depend from the width of the inkscape window whether you end up with case a) or b).

Revision history for this message

su_v (suv-lp) wrote on 2011-05-28:

528632-bt-10241-gtk-quartz.txt Edit (1.5 KiB, text/plain)

Reproduced with Inkscape 0.48+devel r10241 on OS X 10.5.8 (GTK+/Quartz 2.24.4)

Changed in inkscape:
importance:	Undecided → High
status:	New → Confirmed

Revision history for this message

su_v (suv-lp) wrote on 2011-05-28:

inkscape-bin_2011-05-28-204959_LeWitt.crash Edit (31.9 KiB, text/plain)

Crash report (including list of loaded dylibs)

Revision history for this message

su_v (suv-lp) wrote on 2011-05-28:

> It seems to depend from the width of the inkscape
> window whether you end up with case a) or b).

Not confirmed - for me the steps to reproduce do not depend on the size/width of the window: it also happens when dragging a new document window to its smallest size, opening the layer dialog (window slightly expands to adjust for the minimal size of the docked layer dialog) and adding a second layer. The trigger seems to be timing-related (clicking twice on the same editable cell, but not as fast as a double-click).

Since the backtrace hints at an upstream problem, I tried to reproduce it with 'Tree View > Editable Cells' from 'gtk-demo': with both backends (quartz and x11) the same steps in gtk-demo trigger this malloc error (but no crash):

Starting program: /Volumes/green/mp-quartz/with-a-long-long-long-directory-name/bin/gtk-demo
Reading symbols for shared libraries . done
gtk-demo(28350,0xa0175720) malloc: *** error for object 0x1b32c: Non-aligned pointer being freed
*** set a breakpoint in malloc_error_break to debug

Breakpoint 1, 0x90e5e4a9 in malloc_error_break ()
(gdb) bt
#0 0x90e5e4a9 in malloc_error_break ()
#1 0x90e59497 in szone_error ()
#2 0x90d83503 in szone_free ()
#3 0x90d8336d in free ()
#4 0x0000857d in cell_edited ()
#5 0x00a0ef39 in g_closure_invoke ()
#6 0x00a210b3 in signal_emit_unlocked_R ()
#7 0x00a22741 in g_signal_emit_valist ()
#8 0x00a22a49 in g_signal_emit ()
#9 0x0045d01b in gtk_cell_renderer_text_editing_done ()
#10 0x00a0ef39 in g_closure_invoke ()
#11 0x00a210b3 in signal_emit_unlocked_R ()
#12 0x00a22741 in g_signal_emit_valist ()
#13 0x00a2686d in g_signal_emit_by_name ()
#14 0x00451e52 in gtk_cell_editable_editing_done ()
#15 0x00614d1b in gtk_tree_view_stop_editing ()
#16 0x0061a3bd in gtk_tree_view_button_press ()
#17 0x00502b1b in _gtk_marshal_BOOLEAN__BOXED ()
#18 0x00a0ef39 in g_closure_invoke ()
#19 0x00a21238 in signal_emit_unlocked_R ()
#20 0x00a22487 in g_signal_emit_valist ()
#21 0x00a22a49 in g_signal_emit ()
#22 0x006303c6 in gtk_widget_event_internal ()
#23 0x00500d18 in gtk_propagate_event ()
#24 0x0050132a in gtk_main_do_event ()
#25 0x000c6229 in gdk_event_dispatch ()
#26 0x00a8771d in g_main_context_dispatch ()
#27 0x00a8b5ab in g_main_context_iterate ()
#28 0x00a8b887 in g_main_loop_run ()
#29 0x00500261 in gtk_main ()
#30 0x00019f77 in main ()
(gdb) q
The program is running. Exit anyway? (y or n) y
LeWitt:mp-quartz suv$

> It seems to depend from the width of the inkscape
> window whether you end up with case a) or b).

Starting program: /Volumes/green/mp-quartz/with-a-long-long-long-directory-name/bin/gtk-demo 
Reading symbols for shared libraries . done
gtk-demo(28350,0xa0175720) malloc: *** error for object 0x1b32c: Non-aligned pointer being freed
*** set a breakpoint in malloc_error_break to debug

Breakpoint 1, 0x90e5e4a9 in malloc_error_break ()
(gdb) bt
#0  0x90e5e4a9 in malloc_error_break ()
#1  0x90e59497 in szone_error ()
#2  0x90d83503 in szone_free ()
#3  0x90d8336d in free ()
#4  0x0000857d in cell_edited ()
#5  0x00a0ef39 in g_closure_invoke ()
#6  0x00a210b3 in signal_emit_unlocked_R ()
#7  0x00a22741 in g_signal_emit_valist ()
#8  0x00a22a49 in g_signal_emit ()
#9  0x0045d01b in gtk_cell_renderer_text_editing_done ()
#10 0x00a0ef39 in g_closure_invoke ()
#11 0x00a210b3 in signal_emit_unlocked_R ()
#12 0x00a22741 in g_signal_emit_valist ()
#13 0x00a2686d in g_signal_emit_by_name ()
#14 0x00451e52 in gtk_cell_editable_editing_done ()
#15 0x00614d1b in gtk_tree_view_stop_editing ()
#16 0x0061a3bd in gtk_tree_view_button_press ()
#17 0x00502b1b in _gtk_marshal_BOOLEAN__BOXED ()
#18 0x00a0ef39 in g_closure_invoke ()
#19 0x00a21238 in signal_emit_unlocked_R ()
#20 0x00a22487 in g_signal_emit_valist ()
#21 0x00a22a49 in g_signal_emit ()
#22 0x006303c6 in gtk_widget_event_internal ()
#23 0x00500d18 in gtk_propagate_event ()
#24 0x0050132a in gtk_main_do_event ()
#25 0x000c6229 in gdk_event_dispatch ()
#26 0x00a8771d in g_main_context_dispatch ()
#27 0x00a8b5ab in g_main_context_iterate ()
#28 0x00a8b887 in g_main_loop_run ()
#29 0x00500261 in gtk_main ()
#30 0x00019f77 in main ()
(gdb) q
The program is running.  Exit anyway? (y or n) y
LeWitt:mp-quartz suv$

Revision history for this message

Gellule (gellule-xg) wrote on 2011-05-29:

I cannot reproduce the crash: I always end-up in Wolf's case b). I'm on OS X 10.6 (64bits), with:
gtk 2.24.4
gtkmm 2.24.0

Is 10.6 (64 bits) the only difference?

Revision history for this message

su_v (suv-lp) wrote on 2011-05-29:

> Is 10.6 (64 bits) the only difference?

System Info:
$ uname -a
Darwin LeWitt.local 9.8.0 Darwin Kernel Version 9.8.0: Wed Jul 15 16:55:01 PDT 2009; root:xnu-1228.15.4~1/RELEASE_I386 i386
$ port installed gtk2 gtkmm
The following ports are currently installed:
gtk2 @2.24.4_0+no_x11+quartz (active)
gtkmm @2.24.0_0 (active)
$ # compiler used for inkscape trunk
$ gcc-4.2 --version
i686-apple-darwin9-gcc-4.2.1 (GCC) 4.2.1 (Apple Inc. build 5577)

Revision history for this message

Wolf (drechsel) wrote on 2011-05-30:

#10

This ist my system:

bub$ port installed gtk2 gtkmm
The following ports are currently installed:
gtk2 @2.22.1_1+no_x11+quartz (active)
gtkmm @2.22.0_1 (active)

Martins-G4:~ bub$ uname -a
Darwin Martins-G4.local 9.8.0
Darwin Kernel Version 9.8.0: Wed Jul 15 16:57:01 PDT 2009;
root:xnu-1228.15.4~1/RELEASE_PPC Power Macintosh

Martins-G4:~ bub$ gcc --version
gcc (GCC) 4.4.5

I agree with ~suv #7:
It doesnt depend on window width on my machine either.

But there seem to be some circumstances under which the crash does not occur. Today it seems not to be time-related - one single click anywhere in the gray area is enough to kick the app.

Revision history for this message

su_v (suv-lp) wrote on 2012-07-23:

#11

528632-bt-r11562-64bit-osx.txt Edit (8.9 KiB, text/plain)

Apparently still present (as variation) on OS X 10.7.4 Lion with
- Inkscape 0.48+devel r11562 (64bit)
- glib2 2.33.6
- glibmm 2.33.3
- gtk2 2.24.11 (quartz backend)
- gtkmm 2.24.2

Steps used for attached backtrace:
0) mv ~/.config/inkscape{,-bkp}
1) launch inkscape
2) open 'Layers…' dialog
3) add new layer
4) add another new layer
-> crash when clicking on 'Add' in the floating dialog.

Workaround: crash can be prevented if using this gtk setting (via ~/.gtkrc-2.0):
gtk-entry-select-on-focus = 0

Revision history for this message

su_v (suv-lp) wrote on 2012-07-23:

#12

528632-bt-r11562-GTK3-64bit-osx.txt Edit (11.7 KiB, text/plain)

Also present on OS X 10.7.4 Lion with experimental GTK3 build (64bit):
- Inkscape 0.48+devel r11562 (64bit)
- glib2 2.33.6
- glibmm 2.33.3
- gtk3 3.5.8 (quartz backend)
- gtkmm3 3.5.6

su_v (suv-lp) on 2012-07-23

summary:	- Mac OS X aqua: __dynamic_cast + 72 (dyncast.cc:52) + GTK+/Quartz: crash in + Gtk::Editable_Class::set_selection_bounds_vfunc_callback after + clipboard_unset
summary:	GTK+/Quartz: crash in - Gtk::Editable_Class::set_selection_bounds_vfunc_callback after - clipboard_unset + Gtk::Editable_Class::set_selection_bounds_vfunc_callback (after + clipboard_unset(…) )

Revision history for this message

su_v (suv-lp) wrote on 2012-07-23:

#13

Any help (by someone familiar coding with GTK+/gtkmm) with investigating whether this is Inkscape triggering the crash (in the end), or - if not - with filing an upstream bug in either gtkmm or GTK+ itself would be highly appreciated.

su_v (suv-lp) on 2012-09-04

tags:

added: gtk-osx
removed: osx

Revision history for this message

su_v (suv-lp) wrote on 2012-10-01:

#14

Still present with GTK2/Quartz 2.24.13 and GTK3/Quartz 3.6.0 (tested on OS X 10.7.4).

Revision history for this message

su_v (suv-lp) wrote on 2013-01-07:

#15

Closing as 'Invalid' for now - assuming fixed upstream in GTK+: adding / renaming layers works in stable and trunk without crashing Inkscape if using most recent GTK+ versions.

- no longer reproduced with Inkscape stabe / trunk and GTK+/Quartz 2.24.14 built with two later patches from gtk-2-24 git
<http://git.gnome.org/browse/gtk+/commit/?h=gtk-2-24&id=4a8df7a33c298d22bf78b947d0e861fc03ec70e1>
<http://git.gnome.org/browse/gtk+/commit/?h=gtk-2-24&id=e3e055f8551ac8ee033f361261c849c612554184>
- not reproduced with Inkscape trunk and GTK+/Quartz 3.6.3