Crash when selecting undo while drawing a shape

[Alex Valavanis]

Binary package hint: inkscape

Inkscape crashes if the following sequence is followed:

* Open Inkscape from a console
* Draw a primitive shape
* Start drawing a second shape, but do not finish it (i.e. don't let go of the left mouse button)
* While still holding the left mouse button, press the right mouse button to open the context menu and select the Undo option from the top of the list
 > The console shows... WARNING **: Event: Set attribute style to "fill:#ffffff;fill-opacity:1;stroke:#000000;stroke-width:1.29999995;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none" on #<Element:0x0x42173d0>
* Try to draw a third shape.
 > Inkscape crashes with an internal error dialog.

This was reported long ago in Debian Inkscape 0.44-1, and I discovered that it still occurs in 0.47.0-1ubuntu2 on Ubuntu lucid alpha 3.

Backtrace and other details attached.

ProblemType: Crash
Architecture: amd64
CrashCounter: 1
Date: Sun Mar 7 10:41:45 2010
DistroRelease: Ubuntu 10.04
EcryptfsInUse: Yes
ExecutablePath: /usr/bin/inkscape
InstallationMedia: Ubuntu 10.04 "Lucid Lynx" - Alpha amd64 (20091209)
NonfreeKernelModules: nvidia
Package: inkscape 0.47.0-1ubuntu2
ProcCmdline: inkscape
ProcEnviron:
 SHELL=/bin/bash
 LANG=en_GB.utf8
ProcVersionSignature: Ubuntu 2.6.32-15.22-generic
Signal: 7
SourcePackage: inkscape
StacktraceTop:
 SPObject::updateRepr (this=0x3effad0, flags=2) at sp-object.cpp:1193
 sp_star_finish (sc=0x5318920)
 sp_star_context_finish (ec=0x5318920)
 SPDesktop::set_event_context (this=0x1d30c00,
 tools_switch (dt=0x1d30c00,
Title: inkscape crashed with signal 7 in SPObject::updateRepr()
Uname: Linux 2.6.32-15-generic x86_64
UserGroups: adm admin cdrom dialout lpadmin plugdev sambashare

[Apport retracing service (apport)]

StacktraceTop:
 SPObject::updateRepr (this=0x3effad0, flags=2) at sp-object.cpp:1193
 sp_star_finish (sc=0x5318920)
 sp_star_context_finish (ec=0x5318920)
 SPDesktop::set_event_context (this=0x1d30c00,
 tools_switch (dt=0x1d30c00,

[Alex Valavanis (valavanisalex)]

I reported this, so I don't want to set the status to "confirmed". Can anyone upstream confirm this?

[Alex Valavanis (valavanisalex)]

I still experience this with inkscape_0.48.0-1ubuntu1 in Maverick

[su_v (suv-lp)]

In parts reproduced with Inkscape 0.48+devel r9772 on OS X 10.5.8:

Crash not consistently reproduced when drawing the third shape (the only crash I got so far was once when closing Inkscape after drawing the third shape), but same console messages when undoing within the tool context, e.g.:

** (inkscape-bin:95734): WARNING **: Incomplete undo transaction:

** (inkscape-bin:95734): WARNING **: Event: Set attribute style to "fill-opacity:1;color:#000000;fill-rule:nonzero;marker:none;visibility:visible;display:inline;overflow:visible;enable-background:accumulate;opacity:1;stroke:none;fill:#808080" on #<Element:0x0x5ca6f70>

** (inkscape-bin:95734): WARNING **: Event: Added #<Element:0x0x421c670> to #<Element:0x0x5ca6f70> after #<Element:0x0x5c9f170>

** (inkscape-bin:95734): WARNING **: Event: Set attribute id to "rect2405" on #<Element:0x0x5ca6f70>

** (inkscape-bin:95734): WARNING **: Event: Set attribute width to "0" on #<Element:0x0x5ca6f70>

** (inkscape-bin:95734): WARNING **: Event: Set attribute height to "0" on #<Element:0x0x5ca6f70>

** (inkscape-bin:95734): WARNING **: Event: Set attribute x to "0" on #<Element:0x0x5ca6f70>

** (inkscape-bin:95734): WARNING **: Event: Set attribute y to "0" on #<Element:0x0x5ca6f70>

** (inkscape-bin:95734): WARNING **: Event: Set attribute style to "color:#000000;fill:#808080;fill-opacity:1;fill-rule:nonzero;stroke:none;marker:none;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" on #<Element:0x0x5ca6f70>

(inkscape-bin:95734): GLib-GObject-WARNING **: invalid unclassed pointer in cast to `SPRect'

(inkscape-bin:95734): GLib-GObject-WARNING **: invalid unclassed pointer in cast to `SPObject'

** (inkscape-bin:95734): CRITICAL **: SPObject* sp_object_ref(SPObject*, SPObject*): assertion `SP_IS_OBJECT(object)' failed

** (inkscape-bin:95734): CRITICAL **: SPObject* sp_object_unref(SPObject*, SPObject*): assertion `SP_IS_OBJECT(object)' failed

[jazzynico (jazzynico)]

Same error messages on Windows XP, Inkscape 0.47 and 0.48, but no crash (tested with all shapes).

[Alex Valavanis (valavanisalex)]

I can no longer reproduce this, using inkscape_0.48.0-1ubuntu1.2 in Maverick or inkscape_0.48.1-2ubuntu2 in Natty...

I get the same error messages in the console, but Inkscape no longer crashes. Can anyone else reproduce this, or shall I just go ahead and close the report.

[Alex Valavanis (valavanisalex)]

I can't reproduce this in recent versions of Ubuntu, or in Debian Squeeze. I'll close the report for now. If anyone can find a way of reproducing the problem. please feel free to reopen the report.