Crash when opening SVG and saving as EPS/PS

[Joe Joysn]

When saving the attached SVG to EPS/PS inkscape crashes with a "Program received signal SIGSEGV, Segmentation fault."

Inkscape: 0.47.0-2+b1
OS: Debian 6.0

From the SVG source:
<svg xmlns:v="http://schemas.microsoft.com/visio/2003/SVGExtensions/"
     xmlns="http://www.w3.org/2000/svg"
     xmlns:oryx="http://oryx-editor.org"
     id="sid-2CF4F2F2-4283-42EB-946F-AAA5FA61A921"
     width="1437"
     height="740"
     xmlns:xlink="http://www.w3.org/1999/xlink"
     xmlns:svg="http://www.w3.org/2000/svg">

Oryx Editor (presumably used to generate the SVG):
<http://code.google.com/p/oryx-editor/>
<http://bpt.hpi.uni-potsdam.de/Oryx/WebHome>

[Joe Joysn (joysn71)]

output of bt/gdb:

#0 0x08212ca8 in ?? ()
#1 0x082118c4 in ?? ()
#2 0x082125f1 in ?? ()
#3 0x0821294f in ?? ()
#4 0x08212be6 in ?? ()
#5 0x082125e1 in ?? ()
#6 0x0821294f in ?? ()
#7 0x08212be6 in ?? ()
#8 0x082125e1 in ?? ()
#9 0x0821294f in ?? ()
#10 0x08212be6 in ?? ()
#11 0x082125e1 in ?? ()
#12 0x0821294f in ?? ()
#13 0x08212be6 in ?? ()
#14 0x082125e1 in ?? ()
#15 0x0821294f in ?? ()
#16 0x08212be6 in ?? ()
#17 0x082125e1 in ?? ()
#18 0x0821294f in ?? ()
#19 0x08212be6 in ?? ()
#20 0x082125e1 in ?? ()
#21 0x0821294f in ?? ()
#22 0x08212be6 in ?? ()
#23 0x082125e1 in ?? ()
#24 0x0821294f in ?? ()
#25 0x08212be6 in ?? ()
#26 0x082125c7 in ?? ()
#27 0x0821294f in ?? ()
#28 0x0820c8ca in ?? ()
#29 0x0820ca83 in ?? ()
#30 0x081feed7 in ?? ()
#31 0x081fd1f0 in ?? ()
#32 0x080995bb in ?? ()
#33 0x08099010 in ?? ()
#34 0x08240e9d in ?? ()
#35 0xb722fcac in g_cclosure_marshal_VOID__VOID () from /usr/lib/libgobject-2.0.so.0
#36 0xb722213a in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#37 0xb723861d in ?? () from /usr/lib/libgobject-2.0.so.0
#38 0xb7239bfc in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0
#39 0xb723a076 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#40 0xb77bbf05 in gtk_widget_activate () from /usr/lib/libgtk-x11-2.0.so.0
#41 0xb769b400 in gtk_menu_shell_activate_item () from /usr/lib/libgtk-x11-2.0.so.0
#42 0xb769cecf in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#43 0xb76926c4 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#44 0xb768be74 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#45 0xb72207a9 in ?? () from /usr/lib/libgobject-2.0.so.0
#46 0xb722213a in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#47 0xb7238266 in ?? () from /usr/lib/libgobject-2.0.so.0
#48 0xb7239a7b in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0
#49 0xb723a076 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#50 0xb77b8156 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#51 0xb76844cd in gtk_propagate_event () from /usr/lib/libgtk-x11-2.0.so.0
#52 0xb7685857 in gtk_main_do_event () from /usr/lib/libgtk-x11-2.0.so.0
#53 0xb750ddda in ?? () from /usr/lib/libgdk-x11-2.0.so.0
#54 0xb7177305 in g_main_context_dispatch () from /lib/libglib-2.0.so.0
#55 0xb717afe8 in ?? () from /lib/libglib-2.0.so.0
#56 0xb717b527 in g_main_loop_run () from /lib/libglib-2.0.so.0
#57 0xb7685e19 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#58 0xb7e4ae87 in Gtk::Main::run_impl() () from /usr/lib/libgtkmm-2.4.so.1
#59 0xb7e4ac82 in Gtk::Main::run() () from /usr/lib/libgtkmm-2.4.so.1
#60 0x08088d7b in ?? ()
#61 0x08163e0a in ?? ()
#62 0x08088242 in ?? ()
#63 0xb6528c76 in __libc_start_main () from /lib/i686/cmov/libc.so.6
#64 0x080872f1 in ?? ()

[su_v (suv-lp)]

> Inkscape: 0.47.0-2+b1

Reproduced with Inkscape 0.48.1 and 0.48+devel r10191 on OS X 10.5.8

Backtrace from Inkscape 0.48.1:

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000080
0x002a6d90 in Inkscape::Extension::Internal::sp_shape_render_invoke_marker_rendering ()
(gdb) bt
#0 0x002a6d90 in Inkscape::Extension::Internal::sp_shape_render_invoke_marker_rendering ()
#1 0x002a7218 in Inkscape::Extension::Internal::sp_shape_render ()
#2 0x002a5bf5 in Inkscape::Extension::Internal::sp_item_invoke_render ()
#3 0x002a69cc in Inkscape::Extension::Internal::CairoRenderer::renderItem ()
#4 0x002a6c8f in Inkscape::Extension::Internal::sp_group_render ()
#5 0x002a59d1 in Inkscape::Extension::Internal::sp_item_invoke_render ()
#6 0x002a69cc in Inkscape::Extension::Internal::CairoRenderer::renderItem ()
#7 0x002a6c8f in Inkscape::Extension::Internal::sp_group_render ()
#8 0x002a59d1 in Inkscape::Extension::Internal::sp_item_invoke_render ()
#9 0x002a69cc in Inkscape::Extension::Internal::CairoRenderer::renderItem ()
#10 0x002a6c8f in Inkscape::Extension::Internal::sp_group_render ()
#11 0x002a59d1 in Inkscape::Extension::Internal::sp_item_invoke_render ()
#12 0x002a69cc in Inkscape::Extension::Internal::CairoRenderer::renderItem ()
#13 0x002a6c8f in Inkscape::Extension::Internal::sp_group_render ()
#14 0x002a59d1 in Inkscape::Extension::Internal::sp_item_invoke_render ()
#15 0x002a69cc in Inkscape::Extension::Internal::CairoRenderer::renderItem ()
#16 0x002a6c8f in Inkscape::Extension::Internal::sp_group_render ()
#17 0x002a59d1 in Inkscape::Extension::Internal::sp_item_invoke_render ()
#18 0x002a69cc in Inkscape::Extension::Internal::CairoRenderer::renderItem ()
#19 0x002a6c8f in Inkscape::Extension::Internal::sp_group_render ()
#20 0x002a59d1 in Inkscape::Extension::Internal::sp_item_invoke_render ()
#21 0x002a69cc in Inkscape::Extension::Internal::CairoRenderer::renderItem ()
#22 0x002a6c8f in Inkscape::Extension::Internal::sp_group_render ()
#23 0x002a59d1 in Inkscape::Extension::Internal::sp_item_invoke_render ()
#24 0x002a69cc in Inkscape::Extension::Internal::CairoRenderer::renderItem ()
#25 0x002a6c8f in Inkscape::Extension::Internal::sp_group_render ()
#26 0x002a5a92 in Inkscape::Extension::Internal::sp_item_invoke_render ()
#27 0x002a69cc in Inkscape::Extension::Internal::CairoRenderer::renderItem ()
#28 0x002a86c0 in Inkscape::Extension::Internal::CairoRendererPdfOutput::save ()
#29 0x002902f2 in Inkscape::Extension::Output::save ()
#30 0x0028ec72 in Inkscape::Extension::save ()
#31 0x00074408 in file_save ()
#32 0x00073cb8 in sp_file_save_dialog ()
#33 0x0007430a in sp_file_save_a_copy ()
#34 0x002f3bcf in sp_action_perform ()
#35 0x020f9f39 in g_closure_invoke ()
#36 0x0210c0b3 in signal_emit_unlocked_R ()
#37 0x0210d741 in g_signal_emit_valist ()
#38 0x0210da49 in g_signal_emit ()
#39 0x019782bf in gtk_widget_activate ()
#40 0x0185d625 in gtk_menu_shell_activate_item ()
#41 0x0185d9a8 in gtk_menu_shell_button_release ()
#42 0x0184985b in _gtk_marshal_BOOLEAN__BOXED ()
#43 0x020f9f39 in g_closure_invoke ()
#44 0x0210c238 in signal_emit_unlocked_R ()
#45 0x0210d487 i...

[su_v (suv-lp)]

Inkscape also crashes when
- copying the top-level group (contains all drawing content) in [root]
- copying all objects after ungrouping all groups

-> crash is not related to cairo-based exports.

[su_v (suv-lp)]

- -> crash is not related to cairo-based exports.
+ -> marker-related crash is not limited to cairo-based exports.

[su_v (suv-lp)]

Crash seems to be triggered by "empty" marker definitions (i.e. without any path of shape actually drawing the marker):

    <marker
       id="sid-E236469C-A600-41CA-9136-1E3E193800E2start"
       refX="1"
       refY="5"
       markerUnits="userSpaceOnUse"
       markerWidth="17"
       markerHeight="11"
       orient="auto" />

After removing these kinds of empty marker definitions, export to PDF or copy&paste works as expected. As far as I can tell, the rendering of the paths stays unchanged.

[Johan Engelen (johanengelen)]

Thanks for triaging. Fixed in 10195.

[su_v (suv-lp)]

Inkscape 0.48.x: r9777