inkscape 0.48 crashes in sp_stroke_style_line_update() when drawing with opened "Fill and Stroke" dialog

[Marcel Meyer]

After updating to inkscape 0.48 / gentoo / amd64 inkscape crashes when I create a new shape with the "Fill and Stroke" dialog opened. Just start inkscape, open the dialog and then draw a rectangle. Doing this with gdb reveals this:

[...]
(inkscape:6396): Gtk-CRITICAL **: gtk_misc_set_alignment: assertion `GTK_IS_MISC (misc)' failed

(inkscape:6396): Gtk-CRITICAL **: gtk_misc_set_alignment: assertion `GTK_IS_MISC (misc)' failed

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7c6e9c8 in sp_stroke_style_line_update (spw=0x7ffffc768100, sel=0xf8c28e10) at widgets/stroke-style.cpp:1007
1007 widgets/stroke-style.cpp: No such file or directory.
        in widgets/stroke-style.cpp
(gdb) bt
#0 0x00007ffff7c6e9c8 in sp_stroke_style_line_update (spw=0x7ffffc768100, sel=0xf8c28e10) at widgets/stroke-style.cpp:1007
#1 0x00007ffff385804f in IA__g_closure_invoke (closure=0x7ffffc9e8190, return_value=0x0, n_param_values=3, param_values=0x7ffffee55230,
    invocation_hint=0x7fffffffd020) at gclosure.c:767
#2 0x00007ffff386da03 in signal_emit_unlocked_R (node=0x7ffffb6f8fa0, detail=0, instance=0x7ffffcf75b20, emission_return=0x0,
    instance_and_params=0x7ffffee55230) at gsignal.c:3248
#3 0x00007ffff386f121 in IA__g_signal_emit_valist (instance=0x7ffffcf75b20, signal_id=<value optimized out>, detail=0, var_args=0x7fffffffd1f0)
    at gsignal.c:2981
#4 0x00007ffff386f663 in IA__g_signal_emit (instance=0x7ffffe1a7110, signal_id=2, detail=4221718288) at gsignal.c:3038
#5 0x00007ffff385804f in IA__g_closure_invoke (closure=0x7ffffc9cb650, return_value=0x0, n_param_values=3, param_values=0x7ffffee55190,
    invocation_hint=0x7fffffffd410) at gclosure.c:767
#6 0x00007ffff386da03 in signal_emit_unlocked_R (node=0x7ffff84a9f30, detail=0, instance=0x7ffff8456230, emission_return=0x0,
    instance_and_params=0x7ffffee55190) at gsignal.c:3248
#7 0x00007ffff386f121 in IA__g_signal_emit_valist (instance=0x7ffff8456230, signal_id=<value optimized out>, detail=0, var_args=0x7fffffffd5e0)
    at gsignal.c:2981
#8 0x00007ffff386f663 in IA__g_signal_emit (instance=0x7ffffe1a7110, signal_id=2, detail=4221718288) at gsignal.c:3038
#9 0x00007ffff7697036 in Inkscape::Selection::_emitModified (this=0x7ffffe1a7110, flags=2) at selection.cpp:90
#10 0x00007ffff769720a in Inkscape::Selection::_emit_modified (selection=0x7ffffe1a7110) at selection.cpp:83
#11 0x00007ffff358e8c4 in g_main_dispatch (context=0x7ffff84471e0) at gmain.c:1960
#12 IA__g_main_context_dispatch (context=0x7ffff84471e0) at gmain.c:2513
#13 0x00007ffff3592588 in g_main_context_iterate (context=0x7ffff84471e0, block=1, dispatch=1, self=<value optimized out>) at gmain.c:2591
#14 0x00007ffff3592ba5 in IA__g_main_loop_run (loop=0x7ffff91ac990) at gmain.c:2799
#15 0x00007ffff4e4e427 in IA__gtk_main () at gtkmain.c:1219
#16 0x00007ffff764a3a5 in sp_main_gui (argc=1, argv=0x7fffffffdc38) at main.cpp:983
#17 0x00007ffff76496e1 in main (argc=1, argv=<value optimized out>) at main.cpp:719
(gdb)

[roothorick (8-roothorick-gmail-com)]

Gentoo amd64 running 0.48 here... just tried it, no segfault. Post your:

# emerge --info
# equery list gtk (you may have to emerge gentoolkit)

[Marcel Meyer (meyerm-launchpad)]

Sure,

meyerm@yavin ~ $ emerge --info
Portage 2.1.8.3 (hardened/linux/amd64/10.0/no-multilib, gcc-4.4.4, glibc-2.12.1-r1, 2.6.34-gentoo-r1 x86_64)
=================================================================
System uname: Linux-2.6.34-gentoo-r1-x86_64-Intel-R-_Core-TM-2_Duo_CPU_P9600_@_2.66GHz-with-gentoo-2.0.1
Timestamp of tree: Wed, 08 Sep 2010 08:45:02 +0000
app-shells/bash: 4.1_p7
dev-java/java-config: 2.1.11
dev-lang/python: 2.6.5-r3, 3.1.2-r4
dev-util/cmake: 2.8.1-r2
sys-apps/baselayout: 2.0.1
sys-apps/openrc: 0.6.3
sys-apps/sandbox: 2.3-r1
sys-devel/autoconf: 2.13, 2.65-r1
sys-devel/automake: 1.8.5-r4, 1.9.6-r3, 1.10.3, 1.11.1
sys-devel/binutils: 2.20.1-r1
sys-devel/gcc: 4.3.5, 4.4.4-r1
sys-devel/gcc-config: 1.4.1 ...

[Marcel Meyer (meyerm-launchpad)]

Any new ideas? Just had to create a graphic for a paper and finally gave up on my computer. I reinstalled 0.47 to be able to work here but would be willing to toy around with a reinstallation of 0.48 if anybody wants to try something.

[Jonathan Stickel (jjstickel)]

I get this same behavior with Inkscape 0.48, but I am on a Mac using macports. My details are: intel core 2 Duo (64 bit), Mac OS X 10.6.4. All macports dependencies are compiled with the x86_64 architecture. The first part of my crash log is pasted below. It also crashes at "sp_stroke_style_line_update". Any help will be appreciated!

Process: inkscape [79592]
Path: /opt/local/bin/inkscape
Identifier: inkscape
Version: ??? (???)
Code Type: X86-64 (Native)
Parent Process: bash [14161]

Date/Time: 2010-11-05 08:59:11.268 -0600
OS Version: Mac OS X 10.6.4 (10F569)
Report Version: 6

Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000005394018
Crashed Thread: 0 Dispatch queue: com.apple.main-thread

Thread 0 Crashed: Dispatch queue: com.apple.main-thread
0 inkscape 0x00000001003d2d39 sp_stroke_style_line_update(Gtk::Container*, Inkscape::Selection*) + 537
...

[su_v (suv-lp)]

@Jonathan:
1) Could you attach the full backtrace of the system-generated crash report? Or launch inkscape from gdb and do a backtrace there after the SIGSEGV occurs?

2) sp_stroke_style_line_update(…)
Also, could you please add a list of what steps you do leading up to the crash? (as detailed as possibly: like for example 1) open new doc 2) switch to the rectangle tool 3) draw rectangle 4) open fill&stroke, stroke style tab 5) change the width of the current stroke using the mouse wheel, without actually clicking into the entry box 6) click on one of the snap buttons --> crash)

3) Have you tested if the crash still happens if you launch inkscape with default settings? (Quit inkscape, rename or move '~/.config/inkscape/preferences.xml', restart inkscape)

[su_v (suv-lp)]

@Jonathan -
4) Is your build (via MacPorts) up-to-date? Which versions of gtk2, gtkmm, glib do you have installed? Also, which theme-engine is used by inkscape (or other gtk apps)?

5) Do you also get many of these console messages:
Gtk-CRITICAL **: gtk_misc_set_alignment: assertion `GTK_IS_MISC (misc)' failed on Start

[Jonathan Stickel (jjstickel)]

Here is the backtrace:

$ gdb inkscape
...
(gdb) run
Starting program: /opt/local/bin/inkscape
Reading symbols for shared libraries .+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++.................................................................................................warning: Could not find object file "/opt/local/var/macports/build/_opt_local_var_macports_sources_svn.macports.org_trunk_dports_archivers_bzip2/work/bzip2-1.0.6/blocksort.o" - no debug information available for "blocksort.c".
< some more warnings; I don't think they are important >
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0000000005394018
0x00000001003d2d39 in sp_stroke_style_line_update ()
(gdb) bt
#0 0x00000001003d2d39 in sp_stroke_style_line_update ()
#1 0x000000010246bd92 in g_closure_invoke ()
#2 0x000000010248125b in signal_emit_unlocked_R ()
#3 0x0000000102482c84 in g_signal_emit_valist ()
#4 0x0000000102483054 in g_signal_emit ()
#5 0x000000010246bd92 in g_closure_invoke ()
#6 0x000000010248125b in signal_emit_unlocked_R ()
#7 0x0000000102482c84 in g_signal_emit_valist ()
#8 0x0000000102483054 in g_signal_emit ()
#9 0x0000000100106a4c in Inkscape::Selection::_emitModified ()
#10 0x0000000100106c0a in Inkscape::Selection::_emit_modified ()
#11 0x00000001024ed919 in g_main_context_dispatch ()
#12 0x00000001024f0fb1 in g_main_context_iterate ()
#13 0x00000001024f12c5 in g_main_loop_run ()
#14 0x00000001019dfd90 in gtk_main ()
#15 0x0000000100030370 in sp_main_gui ()
#16 0x000000010002f9ee in main ()
(gdb)

I am kind of inexperienced at this level of debugging (i.e. using gdb), and so let me know what else I can provide.

[Jonathan Stickel (jjstickel)]

Answer your other questions:

- I can make it crash doing exactly as described in the original report:
a) I start inkscape; I click on "fill/stroke" in the lower left corner to open the fill stroke dialog tool; I draw a rectangle (or circle) - inkscape immediately crashes.
b) It also crashes if I first make the circle (without the fill diaglog tool open), and then I try to change the fill of the circle.
c) It also crashes if I draw a line and then try to change the width of the line.

- Crashes still occur if I move ~/.config/inkscape elsewhere temporarily.

- My macports is up-to-date:
gtk2 @2.22.0_0+x11
gtkmm @2.20.3_0
glib2 @2.26.0_1
I don't know about a theme-engine. How would I check?

- The only console message I see (before the crash) is
Xlib: extension "RANDR" missing on display "/tmp/launch-eMygxI/org.x:0".
Which is a known non-issue on Mac OS X.

[su_v (suv-lp)]

> I don't know about a theme-engine. How would I check?

Does inkscape, installed via MacPorts (command line version, not packaged as app), look the same as when running the packaged version (0.48.0) from sf.net (which uses a custom Clearlooks-based theme)?
If they look the same, do you have a '~/.gtkrc-2.0' file (gtk settings, including themes, for all gtk+ applications)? (Inkscape.app looks for this file, and if it exists, doesn't load the custom theme from inside the application package).

[su_v (suv-lp)]

Setting status to 'Confirmed': crash reported with Inkscape 0.48 on
- Gentoo / amd64
- Mac OS X 10.6.4 ( x86_64), Intel C2D

Possibly related (?) issue:
Bug #612360 “Inkscape crashes when clicking fill/stroke tool” (only happens in one user account, not in others)
<https://bugs.launchpad.net/inkscape/+bug/612360>

[Jonathan Stickel (jjstickel)]

I do not have a ~/.gtkrc-2.0 file. The icons look the same as the downloadable app (although the background is lighter in the app). BTW, the downloadable app does not crash, just the macports compiled version. Maybe this has something to do with 64 bit vs. 32 bit? Is the app version 64 bit?

[su_v (suv-lp)]

> although the background is lighter in the app
My question was about this (the widgets); most of the icons on the toolbars are from Inkscape, not the theme. I have uploaded a screenshot of three basic examples here: <http://imgh.us/inkscape-themes-1.png>

> Is the app version 64 bit?
No, Universal (PPC, i386).

[Jonathan Stickel (jjstickel)]

>My question was about this (the widgets); most of the icons on the toolbars are from Inkscape, not the theme. I have uploaded a screenshot of three basic examples here: <http://imgh.us/inkscape-themes-1.png>

OK, now I understand. My macports compiled version is using the GTK+ default widgets.

[su_v (suv-lp)]

JFTR: crash not reproduced on Mac OS X 10.5.8 (i386) with Inkscape 0.48 (official package) and local builds (Inkscape 0.48+devel, as osxapp) with not quite up-to-date MacPorts:
- gtk2 @2.20.1_0+x11 + patch from MacPorts ticket #24948 ,
- gtkmm @2.18.2_0,
- glib2 @2.24.1,
- various theme engines
  (gtk-engines2 @2.18.5_0, gtk2-aurora @1.5.1_0, gtk2-murrine @0.90.3_0))

[su_v (suv-lp)]

Related or possibly duplicate report:
Bug #672111 “Operations in Fill/Stroke dialog results in SEGV (on a 64bit Mac)”
<https://bugs.launchpad.net/inkscape/+bug/672111>

[su_v (suv-lp)]

Not reproduced with inkscape 0.48.0 installed with up-to-date MacPorts (2010-11-09) on OS X 10.5.8 (i386),
 gtk2: 2.22.0
 gtkmm: 2.20.3
 glib2: 2.26.0
 glibmm: 2.24.2
 gdk-pixbuf2: 2.22.1

-> issue very likely related to 64bit.

[Jonathan Stickel (jjstickel)]

Same behavior with inkscape-0.48.1.

[Marcel Meyer (meyerm-launchpad)]

Unfortunately inkscape 0.47 can no longer be build with an up-to-date libpng. So I have the problem of neither beeing able to use 0.48.1 (because of the crash) nor 0.47 (because of the building troubles).

Can we as users somehow be of any more help to identify the bug? Thank you very much.

[Gellule (gellule-xg)]

It looks like the issue was in the definition of the "modify_selection" signal. It is supposed to take as arguments a pointer followed by an enum, but the marshaller used has the reversed order. My guess is that on 32bit platforms, UINT and POINTER have the same size and it wasn't an issue, whereas on 64bit they don't, hence the crash. The attached patch fixed the issue (I also had) for me.

[Jon A. Cruz (jon-joncruz)]

Fix committed to trunk in revision 10237.

[Marcel Meyer (meyerm-launchpad)]

Thank you very much, Julien. This patch prevents the crash when changing the stroke!

Unfortunately it is still crashing when I just filled some form with a linear gradient and try to assign it another filling pattern (0.48.1 with your patch).

Is it connected or do we need another bug report?

Thanks
Marcel

meyerm@yavin :-( $ inkscape

Emergency save activated!

Emergency save document locations:
  /home/meyerm/New document 1.2011_05_27_13_10_02.0.svg
Emergency save completed. Inkscape will close now.
If you can reproduce this crash, please file a bug at www.inkscape.org
with a detailed description of the steps leading to the crash, so we can fix it.
Segmentation fault
[~]
meyerm@yavin :-( $ gdb inkscape
GNU gdb (Gentoo 7.2 p1) 7.2
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu".
For bug reporting instructions, please see:
<http://bugs.gentoo.org/>...
Reading symbols from /usr/bin/inkscape...Reading symbols from /usr/lib64/debug/usr/bin/inkscape.debug...done.
done.
(gdb) run
Starting program: /usr/bin/inkscape
Traceback (most recent call last):
  File "/usr/share/gdb/auto-load/usr/lib64/gcc/x86_64-pc-linux-gnu/4.5.2/libstdc++.so.6.0.14-gdb.py", line 59, in <module>
    from libstdcxx.v6.printers import register_libstdcxx_printers
ImportError: No module named libstdcxx.v6.printers
[Thread debugging using libthread_db enabled]

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff35b0c0f in g_type_class_ref (type=4165292080) at gtype.c:2879
2879 gtype.c: No such file or directory.
        in gtype.c
(gdb) bt
#0 0x00007ffff35b0c0f in g_type_class_ref (type=4165292080) at gtype.c:2879
#1 0x00007ffff76bdba0 in sp_painter_free (painter=0x7ffffbb05900) at sp-paint-server.cpp:144
#2 0x00007ffff7768627 in nr_arena_shape_update (item=0x7ffffb4d2000, area=0x0, gc=0x7fffffffad10, state=<value optimized out>, reset=<value optimized out>)
    at display/nr-arena-shape.cpp:321
#3 0x00007ffff776141d in nr_arena_item_invoke_update (item=0x7ffffb4d2000, area=0x0, gc=<value optimized out>, state=510, reset=0)
    at display/nr-arena-item.cpp:257
#4 0x00007ffff7763402 in nr_arena_group_update (item=0x7ffff8bfbbd0, area=0x0, gc=0x7fffffffaed0, state=510, reset=0) at display/nr-arena-group.cpp:176
#5 0x00007ffff776141d in nr_arena_item_invoke_update (item=0x7ffff8bfbbd0, area=0x0, gc=<value optimized out>, state=510, reset=0)
    at display/nr-arena-item.cpp:257
#6 0x00007ffff7763402 in nr_arena_group_update (item=0x7ffff8bfbd20, area=0x0, gc=0x7fffffffb090, state=510, reset=0) at display/nr-arena-group.cpp:176
#7 0x00007ffff776141d in nr_arena_item_invoke_update (item=0x7ffff8bfbd20, area=0x0, gc=<value optimized out>, state=510, reset=0)
    at display/nr-arena-item.cpp:257
#8 0x00007ffff7763402 in nr_arena_group_update (item=0x7ffff8bfbe70, area=0x0, gc=0x7fffffffb250, state=510, reset=0) at display/nr-arena-group.cpp:176
#9 0x00007f...

[su_v (suv-lp)]

@Marcel - afaict no need for a new report - its already reported in
Bug #778441 “Gradients crashing Inkscape 0.48 on OpenBSD/FreeBSD (amd64)”
<https://bugs.launchpad.net/inkscape/+bug/778441>

The patch in related (or duplicate)
Bug #743530 “inkscape coredumps on opening SVG files with gradients (FreeBSD amd64)”
<https://bugs.launchpad.net/inkscape/+bug/743530>
is currently being reviewed…

[Marcel Meyer (meyerm-launchpad)]

Awesome, thank you. It works :-)

[cxcampb (ccampbell95-gmail)]

I am not a programmer - have upgraded outdated mac ports but this bug still occurs. Is it still being open?

[su_v (suv-lp)]

cxcampb wrote:
> Is it still being open?

The bug status "Fix Committed" means that the fix to this bug was committed to the current development branch and to the 0.48.x branch (as indicated by the Milestone "Inkscape 0.48.2"). It will be part of the next bug-fix release (Inkscape 0.48.2).

With regard to MacPorts: it is up to the maintainer of the 'inkscape' port in MacPorts to test and decide whether to backport the patch from the 0.48.x branch to the current stable version available in MacPorts (0.48.1_1). Most likely the fix for bug #778441 would be required for Snow Leopard (64bit) as well (not confirmed though).

Related tickets in Macports:
<https://trac.macports.org/ticket/22638>
<https://trac.macports.org/ticket/24098>

[Jonathan Stickel (jjstickel)]

Regarding macports, see:

https://trac.macports.org/ticket/29689

[cxcampb (ccampbell95-gmail)]

Thank you. This is what needed to know.

On Thu, Jun 2, 2011 at 12:38 PM, ~suv <email address hidden> wrote:

> cxcampb wrote:
> > Is it still being open?
>
> The bug status "Fix Committed" means that the fix to this bug was
> committed to the current development branch and to the 0.48.x branch (as
> indicated by the Milestone "Inkscape 0.48.2"). It will be part of the
> next bug-fix release (Inkscape 0.48.2).
>
> With regard to MacPorts: it is up to the maintainer of the 'inkscape'
> port in MacPorts to test and decide whether to backport the patch from
> the 0.48.x branch to the current stable version available in MacPorts
> (0.48.1_1). Most likely the fix for bug #778441 would be required for
> Snow Leopard (64bit) as well (not confirmed though).
>
> Related tickets in Macports:
> <https://trac.macports.org/ticket/22638>
> <https://trac.macports.org/ticket/24098>
>
> ** Bug watch added: trac.macports.org/ #22638
> http://trac.macports.org/ticket/22638
>
> ** Bug watch added: trac.macports.org/ #24098
> http://trac.macports.org/ticket/24098
>
> --
> You received this bug notification because you are a direct subscriber
> of a duplicate bug (672111).
> https://bugs.launchpad.net/bugs/629363
>
> Title:
> inkscape 0.48 crashes in sp_stroke_style_line_update() when drawing
> with opened "Fill and Stroke" dialog
>
> Status in Inkscape: A Vector Drawing Tool:
> Fix Committed
>
> Bug description:
> After updating to inkscape 0.48 / gentoo / amd64 inkscape crashes when
> I create a new shape with the "Fill and Stroke" dialog opened. Just
> start inkscape, open the dialog and then draw a rectangle. Doing this
> with gdb reveals this:
>
>
> [...]
> (inkscape:6396): Gtk-CRITICAL **: gtk_misc_set_alignment: assertion
> `GTK_IS_MISC (misc)' failed
>
> (inkscape:6396): Gtk-CRITICAL **: gtk_misc_set_alignment: assertion
> `GTK_IS_MISC (misc)' failed
>
> Program received signal SIGSEGV, Segmentation fault.
> 0x00007ffff7c6e9c8 in sp_stroke_style_line_update (spw=0x7ffffc768100,
> sel=0xf8c28e10) at widgets/stroke-style.cpp:1007
> 1007 widgets/stroke-style.cpp: No such file or directory.
> in widgets/stroke-style.cpp
> (gdb) bt
> #0 0x00007ffff7c6e9c8 in sp_stroke_style_line_update (spw=0x7ffffc768100,
> sel=0xf8c28e10) at widgets/stroke-style.cpp:1007
> #1 0x00007ffff385804f in IA__g_closure_invoke (closure=0x7ffffc9e8190,
> return_value=0x0, n_param_values=3, param_values=0x7ffffee55230,
> invocation_hint=0x7fffffffd020) at gclosure.c:767
> #2 0x00007ffff386da03 in signal_emit_unlocked_R (node=0x7ffffb6f8fa0,
> detail=0, instance=0x7ffffcf75b20, emission_return=0x0,
> instance_and_params=0x7ffffee55230) at gsignal.c:3248
> #3 0x00007ffff386f121 in IA__g_signal_emit_valist
> (instance=0x7ffffcf75b20, signal_id=<value optimized out>, detail=0,
> var_args=0x7fffffffd1f0)
> at gsignal.c:2981
> #4 0x00007ffff386f663 in IA__g_signal_emit (instance=0x7ffffe1a7110,
> signal_id=2, detail=4221718288) at gsignal.c:3038
> #5 0x00007ffff385804f in IA__g_closure_invoke (closure=0x7ffffc9cb650,
> return_value=0x0, n_param_values=3, param_values=0x7ffffee55190,
> invocation_hint=0x7fffffffd410) at gclo...