Crash (std::bad_alloc) on file load in SPObject::updateDisplay

[Chris Williams]

Environment:
Inkscape 0.47 on Gentoo (kernel 2.6.34), Xfce desktop. Greater detail at bottom.
Data:
Attached SVG

Details:
Worked on attached file for some hours yesterday, hacking about trying things out. Saved file. This morning no longer able to open the file. Crash information below (after rebuild to add debug syms, otherwise same software). Suspecting a basic corrupted file I also tried opening a version of the file run through xmllint with same result.

chrisw@newton ~ $ inkscape drawing-2.svg
terminate called after throwing an instance of 'std::bad_alloc'
  what(): std::bad_alloc

Emergency save activated!
Emergency save completed. Inkscape will close now.
If you can reproduce this crash, please file a bug at www.inkscape.org
with a detailed description of the steps leading to the crash, so we can fix it.

** (inkscape:11274): WARNING **: SPObject::updateDisplay(SPCtx *ctx, unsigned int flags) : throw in ((SPObjectClass *) G_OBJECT_GET_CLASS(this))->update(this, ctx, flags);
terminate called recursively
Aborted

Backtrace:
chrisw@newton ~ $ gdb /usr/bin/inkscape
GNU gdb (Gentoo 7.0.1 p1) 7.0.1
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "i686-pc-linux-gnu".
For bug reporting instructions, please see:
<http://bugs.gentoo.org/>...
Reading symbols from /usr/bin/inkscape...done.
(gdb) run drawing-2.svg
Starting program: /usr/bin/inkscape drawing-2.svg
[Thread debugging using libthread_db enabled]
terminate called after throwing an instance of 'std::bad_alloc'
  what(): std::bad_alloc

Program received signal SIGABRT, Aborted.
0xffffe424 in __kernel_vsyscall ()
(gdb) bt
#0 0xffffe424 in __kernel_vsyscall ()
#1 0x4104f880 in raise () from /lib/libc.so.6
#2 0x410510b5 in abort () from /lib/libc.so.6
#3 0x413349ff in __gnu_cxx::__verbose_terminate_handler() ()
   from /usr/lib/gcc/i686-pc-linux-gnu/4.4.3/libstdc++.so.6
#4 0x41332925 in ?? ()
   from /usr/lib/gcc/i686-pc-linux-gnu/4.4.3/libstdc++.so.6
#5 0x41332962 in std::terminate() ()
   from /usr/lib/gcc/i686-pc-linux-gnu/4.4.3/libstdc++.so.6
#6 0x41332aa1 in __cxa_throw ()
   from /usr/lib/gcc/i686-pc-linux-gnu/4.4.3/libstdc++.so.6
#7 0x4133312b in operator new(unsigned int) ()
   from /usr/lib/gcc/i686-pc-linux-gnu/4.4.3/libstdc++.so.6
#8 0x0865bb01 in __gnu_cxx::new_allocator<Path::path_lineto>::allocate (
    this=0x9949014, __position=..., __x=...)
    at /usr/lib/gcc/i686-pc-linux-gnu/4.4.3/include/g++-v4/ext/new_allocator.h:89
#9 std::_Vector_base<Path::path_lineto, std::allocator<Path::path_lineto> >::_M_allocate (this=0x9949014, __position=..., __x=...)
    at /usr/lib/gcc/i686-pc-linux-gnu/4.4.3/include/g++-v4/bits/stl_vector.h:140
#10 std::vector<Path::path_lineto, std::allocator<Path::path_lineto> >::_M_insert_aux (this=0x9949014, __position=..., __x=...)
    at /usr/lib/gcc/i686-pc-linux-gnu/4.4.3/include/g++-v4/bits/vector.tcc:322
#11 0x0865bc9a in std::vector<Path::path_lineto, std::allocator<Path::path_lineto> >::push_back (this=0x510a, __x=...)
    at /usr/lib/gcc/i686-pc-linux-gnu/4.4.3/include/g++-v4/bits/stl_vector.h:741
#12 0x0865a654 in Path::AddPoint (this=0x9948ff0, iPt=..., mvto=10)
    at livarot/Path.cpp:426
#13 0x08660398 in Path::ConvertEvenLines (this=0x9948ff0,
    treshhold=0.00057283863865472523) at livarot/PathConversion.cpp:778
#14 0x08670df8 in Path::Coalesce (this=0x9948ff0, tresh=0.0022913545546189009)
    at livarot/PathSimplify.cpp:1176
#15 0x0810c0b4 in sp_offset_set_shape (shape=0x92013e8) at sp-offset.cpp:519
#16 0x081180d8 in sp_shape_set_shape (shape=0x92013e8) at sp-shape.cpp:1093
#17 0x0810b0de in sp_offset_source_modified (item=0x92013e8)
    at sp-offset.cpp:1079
#18 0x0810c5eb in sigc::pointer_functor3<SPObject*, unsigned int, SPItem*, void>::operator() (rep=0x9220530, a_1=@0xbfffe884, a_2=@0xbfffe8b4)
    at /usr/include/sigc++-2.0/sigc++/functors/ptr_fun.h:185
#19 operator()<SPObject* const&, const unsigned int&, SPOffset*&> (
---Type <return> to continue, or q <return> to quit---
    rep=0x9220530, a_1=@0xbfffe884, a_2=@0xbfffe8b4)
    at /usr/include/sigc++-2.0/sigc++/adaptors/adaptor_trait.h:123
#20 operator()<SPObject* const&, const unsigned int&> (rep=0x9220530,
    a_1=@0xbfffe884, a_2=@0xbfffe8b4)
    at /usr/include/sigc++-2.0/sigc++/adaptors/bind.h:529
#21 sigc::internal::slot_call2<sigc::bind_functor<2, sigc::pointer_functor3<SPObject*, unsigned int, SPItem*, void>, SPOffset*, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil>, void, SPObject*, unsigned int>::call_it (
    rep=0x9220530, a_1=@0xbfffe884, a_2=@0xbfffe8b4)
    at /usr/include/sigc++-2.0/sigc++/functors/slot.h:173
#22 0x08107034 in sigc::internal::signal_emit2<void, SPObject*, unsigned int, sigc::nil>::emit (this=0x91e82a0, flags=127)
    at /usr/include/sigc++-2.0/sigc++/signal.h:1248
#23 sigc::signal2<void, SPObject*, unsigned int, sigc::nil>::emit (
    this=0x91e82a0, flags=127) at /usr/include/sigc++-2.0/sigc++/signal.h:2881
#24 SPObject::emitModified (this=0x91e82a0, flags=127) at sp-object.cpp:1385
#25 0x080f4325 in CGroup::onModified (this=0x91ffd48,
    flags=<value optimized out>) at sp-item-group.cpp:711
#26 0x080f57e4 in sp_group_modified (object=0x91e4b60, flags=95)
    at sp-item-group.cpp:220
#27 0x08106f90 in SPObject::emitModified (this=0x91e4b60, flags=95)
    at sp-object.cpp:1383
#28 0x080f4325 in CGroup::onModified (this=0x91b3198,
    flags=<value optimized out>) at sp-item-group.cpp:711
#29 0x080f57e4 in sp_group_modified (object=0x91b2098, flags=27)
    at sp-item-group.cpp:220
#30 0x08115c3f in sp_root_modified (object=0x91b2098, flags=27)
    at sp-root.cpp:565
#31 0x08106f90 in SPObject::emitModified (this=0x91b2098, flags=27)
    at sp-object.cpp:1383
#32 0x0808c38b in SPDocument::_emitModified (this=0x9296f60)
    at document.cpp:753
#33 0x0808c566 in SPDocument::_updateDocument (this=0x9296f60)
    at document.cpp:900
#34 0x0808c5d0 in sp_document_ensure_up_to_date (doc=0x9296f60)
    at document.cpp:918
#35 0x084e4f7a in SPDesktop::init (this=0x92b6d20, nv=0x91bd030,
    aCanvas=0x98e6078, widget=0x9928308) at desktop.cpp:184
#36 0x08300f4c in sp_desktop_widget_new (namedview=0x91bd030)
    at widgets/desktop-widget.cpp:1342
#37 0x08096e32 in sp_file_open (uri=..., key=0x0, add_to_recent=true,
    replace_empty=true) at file.cpp:243
---Type <return> to continue, or q <return> to quit---
#38 0x08088283 in sp_main_gui (argc=2, argv=0xbfffef84) at main.cpp:939
#39 0x081622d4 in Inkscape::NSApplication::Application::run (this=0xbfffeec8)
    at application/application.cpp:114
#40 0x080878e9 in main (argc=2, argv=0xbfffef84) at main.cpp:685
(gdb) quit

Detailed Environment:
=================================================================
                        System Settings
=================================================================
System uname: Linux-2.6.34-gentoo-r1-i686-Intel-R-_Core-TM-2_CPU_6400_@_2.13GHz-with-gentoo-1.12.13
Timestamp of tree: Sun, 08 Aug 2010 16:45:01 +0000
distcc 3.1 i686-pc-linux-gnu [enabled]
app-shells/bash: 4.0_p37
dev-java/java-config: 2.1.11
dev-lang/python: 2.6.5-r3, 3.1.2-r4
dev-util/cmake: 2.8.1-r2
sys-apps/baselayout: 1.12.13
sys-apps/sandbox: 1.6-r2
sys-devel/autoconf: 2.13, 2.65
sys-devel/automake: 1.7.9-r2, 1.8.5-r4, 1.9.6-r3, 1.10.3, 1.11.1
sys-devel/binutils: 2.20.1-r1
sys-devel/gcc: 4.3.4, 4.4.3-r2
sys-devel/gcc-config: 1.4.1
sys-devel/libtool: 2.2.6b
virtual/os-headers: 2.6.30-r1
ACCEPT_KEYWORDS="x86"
ACCEPT_LICENSE="* -@EULA"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O1 -pipe -ggdb"
CHOST="i686-pc-linux-gnu"
CXXFLAGS="-O1 -pipe -ggdb"
LANG="en_AU.UTF-8"
LDFLAGS="-Wl,-O1 -Wl,--as-needed"
MAKEOPTS="-j4"
=================================================================
                        Package Settings
=================================================================

media-gfx/inkscape-0.47 was built with the following:
USE="lcms mmx nls wmf -debug -dia -gnome -gs -inkjar -spell"
CFLAGS="-O1 -pipe -ggdb -fno-strict-aliasing"
CXXFLAGS="-O1 -pipe -ggdb -fno-strict-aliasing"

[Chris Williams (chrisw-psychogeeks)]

Firefox and ImageMagick render an image when given the file, but the image is not how it looked when saved.

[Alvin Penner (apenner)]

confirmed on Windows XP, Inkscape 0.48pre1 r9509 (Jun 21 2010)

exit message was :

** (inkscape.exe:1580): WARNING **: Unable to open linked file: \home\chrisw\iSt
ock_000007376424Medium.jpg

** (inkscape.exe:1580): WARNING **: SPObject::updateDisplay(SPCtx *ctx, unsigned
 int flags) : throw in ((SPObjectClass *) G_OBJECT_GET_CLASS(this))->update(this
, ctx, flags);

Emergency save activated!

the message about the .jpg file is not relevant, crash occurs even if the reference to the link is removed

[su_v (suv-lp)]

Reproduced with Inkscape 0.48+devel r9692 on OS X 10.5.8

Linking as duplicate to Bug #345371 “stroked and scaled Linked Offset text causes a crash upon open file”:
<https://bugs.launchpad.net/inkscape/+bug/345371>

Linked offsets below (in stack order) the referenced original path cause a crash when reopening the file in Inkscape.

Please add a comment here and revert the duplicate status if you don't agree and think these are different issues.

[su_v (suv-lp)]

Attaching "fixed" version that opens without crash in Inkscape, but no longer renders as was originally intended (originals of linked offsets have been moved 'below' the linked offset i.e. 'earlier' in the order the objects are stored in the SVG file).

[Chris Williams (chrisw-psychogeeks)]

Fantastic turnaround. Wasn't expecting a "fixed" version... thanks.
Agree with the linked duplicate; had not connected the crash to the text + linked offset myself.