Crash when undoing creation of almost any object with export dialog open
Summary:
Inkscape crashes when undoing the creation of almost any object. That is, when the act of pressing undo results in an object being deleted.
Undoing moves, modifications, deletions is fine, but undoing creation is not.
I haven't exhaustively experimented with which objects cause the problem, but rectangles, ellipses, paths, and spirals do. For some reason, text is an exception.
Steps to reproduce:
- Open Inkscape
- Ensure the Export dialog is open (docked or undocked)
- Draw a Rectangle
- Undo
What happened?
Reproducible crash with backtrace
Click to expand
1 Inkscape::Drawing::defer<Inkscape::DrawingItem::unlink()::<lambda()>>((unnamed struct) &&) const drawing.h 133 0x7ffff67ee970
2 defer<Inkscape::DrawingItem::unlink()::<lambda()>> drawing-item.h 252 0x7ffff67ee9b8
3 Inkscape::DrawingItem::unlink() drawing-item.cpp 1251 0x7ffff67ee9ac
4 void UnlinkDeleter::operator()<Inkscape::DrawingItem>(Inkscape::DrawingItem *) drawing-item-ptr.h 19 0x7ffff6a89577
5 std::__uniq_ptr_impl<Inkscape::DrawingItem, UnlinkDeleter>::reset(Inkscape::DrawingItem *) unique_ptr.h 203 0x7ffff6a89572
6 std::unique_ptr<Inkscape::DrawingItem, UnlinkDeleter>::reset(Inkscape::DrawingItem *) unique_ptr.h 501 0x7ffff6a89561
7 SPItem::release() sp-item.cpp 481 0x7ffff6a89561
8 SPLPEItem::release() sp-lpe-item.cpp 107 0x7ffff6a8efc6
9 SPShape::release() sp-shape.cpp 102 0x7ffff6ac3e34
10 SPObject::releaseReferences() sp-object.cpp 907 0x7ffff6aaf7f2
11 SPObject::detach(SPObject *) sp-object.cpp 638 0x7ffff6ab0c4d
12 SPObject::remove_child(Inkscape::XML::Node *) sp-object.cpp 729 0x7ffff6ab0e33
13 SPLPEItem::remove_child(Inkscape::XML::Node *) sp-lpe-item.cpp 1393 0x7ffff6a90880
14 SPGroup::remove_child(Inkscape::XML::Node *) sp-item-group.cpp 117 0x7ffff6a7f03d
15 SPObject::notifyChildRemoved(Inkscape::XML::Node&, Inkscape::XML::Node&, Inkscape::XML::Node *) sp-object.cpp 958 0x7ffff6aabf6f
16 Inkscape::XML::CompositeNodeObserver::notifyChildRemoved(Inkscape::XML::Node&, Inkscape::XML::Node&, Inkscape::XML::Node *) composite-node-observer.cpp 55 0x7ffff6fe712b
17 Inkscape::XML::SimpleNode::removeChild(Inkscape::XML::Node *) simple-node.cpp 493 0x7ffff6ff39b2
18 (anonymous namespace)::LogPerformer::notifyChildRemoved((anonymous namespace)::LogPerformer::Node &, (anonymous namespace)::LogPerformer::Node &, (anonymous namespace)::LogPerformer::Node *) const event.cpp 97 0x7ffff6fe7c91
19 Inkscape::XML::EventAdd::_undoOne(Inkscape::XML::NodeObserver&) const event.cpp 157 0x7ffff6fe7cf8
20 Inkscape::XML::Event::undoOne(Inkscape::XML::NodeObserver&) const event.h 98 0x7ffff6fe89a1
21 Inkscape::XML::undo_log_to_observer(Inkscape::XML::Event const *, Inkscape::XML::NodeObserver&) event.cpp 133 0x7ffff6fe8995
22 sp_repr_undo_log(Inkscape::XML::Event *) event.cpp 151 0x7ffff6fe8d01
23 Inkscape::DocumentUndo::undo(SPDocument *) document-undo.cpp 270 0x7ffff7041b48
24 undo(SPDocument *) actions-undo-document.cpp 47 0x7ffff71585c1
25 sigc::pointer_functor1<SPDocument *, void>::operator()(SPDocument * const&) const ptr_fun.h 111 0x7ffff71200ac
26 sigc::adaptor_functor<sigc::pointer_functor1<SPDocument *, void>>::deduce_result_type<SPDocument *&, void, void, void, void, void, void>::type sigc::adaptor_functor<sigc::pointer_functor1<SPDocument *, void>>::operator()<SPDocument *&>(SPDocument *&) const adaptor_trait.h 89 0x7ffff71200a5
27 sigc::bind_functor<-1, sigc::pointer_functor1<SPDocument *, void>, SPDocument *, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil>::operator()() bind.h 1124 0x7ffff71200a5
28 sigc::internal::slot_call0<sigc::bind_functor<-1, sigc::pointer_functor1<SPDocument *, void>, SPDocument *, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil>, void>::call_it(sigc::internal::slot_rep *) slot.h 136 0x7ffff71200a5
29 ___lldb_unnamed_symbol9415 (x86_64) /usr/lib/libgiomm-2.4.so.1 0x7ffff3e5c567
30 g_closure_invoke (x86_64) /usr/lib/libgobject-2.0.so.0 0x7ffff4b9a210
31 ___lldb_unnamed_symbol1159 (x86_64) /usr/lib/libgobject-2.0.so.0 0x7ffff4bc85c6
32 g_signal_emit_valist (x86_64) /usr/lib/libgobject-2.0.so.0 0x7ffff4bb8095
33 g_signal_emit (x86_64) /usr/lib/libgobject-2.0.so.0 0x7ffff4bb8324
34 ___lldb_unnamed_symbol5034 (x86_64) /usr/lib/libgio-2.0.so.0 0x7ffff4cc78a6
35 gtk_action_muxer_activate_action gtkactionmuxer.c 413 0x7ffff786ad29
36 gtk_action_muxer_activate_action gtkactionmuxer.c 415 0x7ffff786ad69
37 gtk_action_muxer_activate_action gtkactionmuxer.c 415 0x7ffff786ad69
38 gtk_action_muxer_activate_action gtkactionmuxer.c 415 0x7ffff786ad69
39 gtk_action_muxer_activate_action gtkactionmuxer.c 415 0x7ffff786ad69
40 gtk_action_muxer_activate_action gtkactionmuxer.c 415 0x7ffff786ad69
41 gtk_action_muxer_activate_action gtkactionmuxer.c 415 0x7ffff786ad69
42 gtk_action_muxer_activate_action gtkactionmuxer.c 415 0x7ffff786ad69
43 gtk_action_muxer_activate_action gtkactionmuxer.c 415 0x7ffff786ad69
44 gtk_application_accels_activate gtkapplicationaccels.c 448 0x7ffff7886f32
45 gtk_window_activate_key gtkwindow.c 12077 0x7ffff7b4aad0
46 gtk_window_key_press_event gtkwindow.c 8252 0x7ffff7b4ab2d
47 Gtk::Widget::on_key_press_event(_GdkEventKey *) (x86_64) /usr/lib/libgtkmm-3.0.so.1 0x7ffff42b9009
48 InkscapeWindow::on_key_press_event(_GdkEventKey *) inkscape-window.cpp 263 0x7ffff70f696d
49 Gtk::Widget_Class::key_press_event_callback(_GtkWidget *, _GdkEventKey *) (x86_64) /usr/lib/libgtkmm-3.0.so.1 0x7ffff42b1e8b
50 _gtk_marshal_BOOLEAN__BOXEDv gtkmarshalers.c 130 0x7ffff785a9fb
51 g_signal_emit_valist (x86_64) /usr/lib/libgobject-2.0.so.0 0x7ffff4bb823c
52 g_signal_emit (x86_64) /usr/lib/libgobject-2.0.so.0 0x7ffff4bb8324
53 gtk_widget_event_internal gtkwidget.c 7808 0x7ffff7b22022
54 gtk_widget_event gtkwidget.c 7378 0x7ffff7b24df7
55 propagate_event gtkmain.c 2681 0x7ffff79c5e70
56 gtk_propagate_event gtkmain.c 2725 0x7ffff79c6ebc
57 gtk_main_do_event gtkmain.c 1921 0x7ffff79c71b5
58 _gdk_event_emit gdkevents.c 73 0x7ffff7701b5f
59 gdk_event_source_dispatch gdkeventsource.c 367 0x7ffff775464f
60 g_main_context_dispatch (x86_64) /usr/lib/libglib-2.0.so.0 0x7ffff4ec053b
61 ___lldb_unnamed_symbol2580 (x86_64) /usr/lib/libglib-2.0.so.0 0x7ffff4f1d219
62 g_main_context_iteration (x86_64) /usr/lib/libglib-2.0.so.0 0x7ffff4ebf1a2
63 g_application_run (x86_64) /usr/lib/libgio-2.0.so.0 0x7ffff4cc33de
64 main inkscape-main.cpp 216 0x5555555594e4
65 ___lldb_unnamed_symbol3140 (x86_64) /usr/lib/libc.so.6 0x7ffff2e9a790
66 __libc_start_main (x86_64) /usr/lib/libc.so.6 0x7ffff2e9a84a
67 _start (x86_64) /home/pbs/Linux/inkscape/inkscape/build/bin/inkscape 0x5555555589b5
Note that a crash in defer()
most likely indicates access to a deleted DrawingItem
.
What should have happened?
Undo without crashing.
Version info
A custom build of 2d13dde8 on Arch Linux. (So well before the flurry of pre-1.3alpha commits.)
Additionally, the AppImage of 7f8f63d1. (Just before 1.3alpha.)
System info
GLib version: 2.76.1
GTK version: 3.24.30
glibmm version: 2.66.6
gtkmm version: 3.24.7
libxml2 version: 2.10.3
libxslt version: 1.1.37
Cairo version: 1.17.9
Pango version: 1.50.14
HarfBuzz version: 7.1.0
OS version: Arch Linux
Edited by PBS