Bugs item #1012874, was opened at 2004-08-20 12:38
Message generated for change (Comment added) made by cth103
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=604306&aid=1012874&group_id=93438
Category: Shape Editing
Group: Linux
>Status: Closed
>Resolution: Fixed
Priority: 5
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Nobody/Anonymous (nobody)
Summary: Crash when editing fill and stroke
Initial Comment:
When I select an object in my drawing and I click on
the icon to edit fill and stroke, inkscape crashes. It
happens everytimes, with every drawing.
Output from gdb after running inkscape:
(inkscape:21990): Gtk-WARNING **: Theme directory of
theme crystal has no size field
Program received signal SIGSEGV, Segmentation fault.
0x080bd99d in SPObject::deleteObject ()
(gdb) bt
#0 0x080bd99d in SPObject::deleteObject ()
#1 0x080bd9da in SPObject::deleteObject ()
#2 0x0817ff4f in sp_marker_prev_new ()
#3 0x0818526e in sp_stroke_style_line_widget_new ()
#4 0x08183604 in sp_stroke_style_line_widget_new ()
#5 0x081813a5 in sp_stroke_style_line_widget_new ()
#6 0x0817b41c in sp_object_properties_dialog ()
#7 0x081ebbe1 in sp_action_perform ()
#8 0x4072df13 in g_cclosure_marshal_VOID__VOID ()
from /usr/lib/libgobject-2.0.so.0
----------------------------------------------------------------------
>Comment By: Carl Hetherington (cth103)
Date: 2004-09-02 13:11
Message:
Logged In: YES
user_id=448932
No, that's fine. Thanks for the report and for your time
spent in chasing it up.
Cheers
Carl
----------------------------------------------------------------------
Comment By: Bertrand Rousseau (sfbertrand)
Date: 2004-09-02 12:02
Message:
Logged In: YES
user_id=1110026
I've just made a checkout from the CVS and compiled it.
Everything seems to work fine now. I don't know if you want
me to put more precise information, but I will be please to
do so if tell me what to do.
Bertrand
----------------------------------------------------------------------
Comment By: Carl Hetherington (cth103)
Date: 2004-08-31 14:04
Message:
Logged In: YES
user_id=448932
This should now be fixed in CVS. It would be great if you
could try CVS and report back here.
Thanks
Carl
----------------------------------------------------------------------
Comment By: Nobody/Anonymous (nobody)
Date: 2004-08-30 03:04
Message:
Logged In: NO
Yeah. Eventually SOLVED.
For what concerns my machine, of course :)
----------------------------------------------------------------------
Comment By: Bertrand Rousseau (sfbertrand)
Date: 2004-08-28 21:59
Message:
Logged In: YES
user_id=1110026
I applied these modifications and now everything is fine. I
can edit with no porblems. Thanks a lot!
----------------------------------------------------------------------
Comment By: Owen Taylor (otaylor)
Date: 2004-08-28 15:04
Message:
Logged In: YES
user_id=63124
Hmm, not obvious how to create an attachment ... maybe I don't
have sufficient permissions, so here it is inline:
Index: sp-object.cpp
===================================================================
RCS file: /cvsroot/inkscape/inkscape/src/sp-object.cpp,v
retrieving revision 1.45
diff -u -p -r1.45 sp-object.cpp
--- sp-object.cpp 15 Aug 2004 04:05:20 -0000 1.45
+++ sp-object.cpp 28 Aug 2004 14:57:26 -0000
@@ -301,6 +301,8 @@ void SPObject::_sendDeleteSignalRecursiv
void SPObject::deleteObject(bool propagate, bool
propagate_descendants)
{
+ SPObject *successor = _successor;
+
if (propagate) {
_delete_signal.emit(this);
}
@@ -313,8 +315,8 @@ void SPObject::deleteObject(bool propaga
sp_repr_unparent(repr);
}
- if (_successor) {
- _successor->deleteObject(propagate,
propagate_descendants);
+ if (successor) {
+ successor->deleteObject(propagate,
propagate_descendants);
}
}
----------------------------------------------------------------------
Comment By: Owen Taylor (otaylor)
Date: 2004-08-28 15:02
Message:
Logged In: YES
user_id=63124
Pretty straightforward problem ... SPObject::deleteObject
is trying to
access the _successor field after the object has been freed.
I'll attach
a patch that fixes for me.
(I see it here because GObject, when compiled with full
debugging on
fills freed objects with 0xaa. Without that, it might
normally "work")
----------------------------------------------------------------------
Comment By: Justace Clutter (justace)
Date: 2004-08-24 23:15
Message:
Logged In: YES
user_id=683201
cth103 had posted a patch to apply.
I applyed it to the 0.39 version which is the latest gentoo
version.
I started the application, drew a rectangle, then tried to
open the "fill and stroke" dialog box. This is the output
that resulted. I hope that this helps, I really need to get
inkscape working again.
prophecy@... ~ $ inkscape
sp_marker_prev_new: Arrow1L
delete old marker.
deleted.
sp_marker_prev_new: Arrow1M
delete old marker.
deleteObject: 0x8cfc0f0 0 0
Get repr
repr is 0x8cfc0f0
Unparenting
Complete.
delete successor 0xaaaaaaaadeleteObject: 0xaaaaaaaa 0 0
Get repr
Emergency save activated!
Emergency save document locations:
/home/prophecy/.inkscape/New document 1.2004_08_24_13_13_32.0
Emergency save completed. Inkscape will close now.
If you can reproduce this crash, please file a bug at
http://www.inkscape.org
with a detailed description of the steps leading to the
crash, so we can fix it.
Segmentation fault
----------------------------------------------------------------------
Comment By: Justace Clutter (justace)
Date: 2004-08-24 22:53
Message:
Logged In: YES
user_id=683201
I have the exact same problem. This is actually a duplicate
bug. I registered this bug a while back. I was theorizing
that it was related to the upgrade of gtk+. Anyway. I
recompiled my gtk+ and inkspace with debuging turned on and
then I ran it in gdb. Here is the output.
prophecy@... ~ $ gdb inkscape
GNU gdb 6.2
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public
License, and you are
welcome to change it and/or distribute copies of it under
certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show
warranty" for details.
This GDB was configured as "i686-pc-linux-gnu"...Using host
libthread_db library "/lib/libthread_db.so.1".
(gdb) run
Starting program: /usr/bin/inkscape
warning: Unable to find dynamic linker breakpoint function.
GDB will be unable to debug shared library initializers
and track explicitly loaded dynamic code.
[Thread debugging using libthread_db enabled]
[New Thread 16384 (LWP 8985)]
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 16384 (LWP 8985)]
SPObject::deleteObject (this=0xaaaaaaaa, propagate=false,
propagate_descendants=false) at sp-object.cpp:332
332 sp-object.cpp: No such file or directory.
in sp-object.cpp
(gdb) bt
#0 SPObject::deleteObject (this=0xaaaaaaaa,
propagate=false, propagate_descendants=false) at
sp-object.cpp:332
#1 0x080c03a8 in SPObject::deleteObject (this=0x0,
propagate=false, propagate_descendants=false) at
sp-object.cpp:338
#2 0x08187d55 in sp_marker_prev_new (size=22, mname=0x1
<Address 0x1 out of bounds>, source=0x1, sandbox=0x837de38,
menu_id=0x1 <Address 0x1 out of bounds>, arena=0x8c3b478,
visionkey=7,
root=0x8c3b490) at sp-object.h:173
#3 0x0818d2a1 in sp_marker_list_from_doc (m=0x8b71a40,
current_doc=0x837ddc8, source=0x837de70, markers_doc=0x0,
sandbox=0x837de38, menu_id=0x829e4b5 "marker-start")
at dialogs/stroke-style.cpp:1008
#4 0x0818b52b in ink_marker_menu (tbl=0x8bebeb0,
menu_id=0x829e4b5 "marker-start", sandbox=0x837de38) at
dialogs/stroke-style.cpp:1126
#5 0x081890e7 in sp_stroke_style_line_widget_new () at
dialogs/stroke-style.cpp:1532
#6 0x081831bc in sp_object_properties_dialog () at
dialogs/object-properties.cpp:216
#7 0x40836041 in g_cclosure_marshal_VOID__VOID () from
/usr/lib/libgobject-2.0.so.0
#8 0x4081f810 in g_closure_invoke () from
/usr/lib/libgobject-2.0.so.0
#9 0x40835ae6 in g_signal_emit_by_name () from
/usr/lib/libgobject-2.0.so.0
#10 0x408349f3 in g_signal_emit_valist () from
/usr/lib/libgobject-2.0.so.0
#11 0x40834d74 in g_signal_emit () from
/usr/lib/libgobject-2.0.so.0
#12 0x40511687 in gtk_widget_activate () from
/usr/lib/libgtk-x11-2.0.so.0
#13 0x40406a92 in gtk_menu_shell_activate_item () from
/usr/lib/libgtk-x11-2.0.so.0
#14 0x40405c10 in _gtk_menu_shell_activate () from
/usr/lib/libgtk-x11-2.0.so.0
#15 0x403fd067 in gtk_menu_reorder_child () from
/usr/lib/libgtk-x11-2.0.so.0
#16 0x403f3655 in _gtk_marshal_BOOLEAN__BOXED () from
/usr/lib/libgtk-x11-2.0.so.0
#17 0x4081ff37 in g_signal_type_cclosure_new () from
/usr/lib/libgobject-2.0.so.0
#18 0xbfffeb30 in ?? ()
#19 0x00000002 in ?? ()
#20 0xbfffeb58 in ?? ()
#21 0x403fcfd0 in gtk_menu_reorder_child () from
/usr/lib/libgtk-x11-2.0.so.0
#22 0x08e00ee8 in ?? ()
#23 0x00000000 in ?? ()
#24 0x00000000 in ?? ()
#25 0x00000000 in ?? ()
#26 0x08383650 in ?? ()
#27 0x08db53a0 in ?? ()
#28 0x00000000 in ?? ()
#29 0x08000000 in ?? ()
#30 0x00000000 in ?? ()
#31 0xbfffeca8 in ?? ()
#32 0x4061074b in _gdk_x11_display_screen_for_xrootwin ()
from /usr/lib/libgdk-x11-2.0.so.0
Previous frame inner to this frame (corrupt stack?)
gcc version 3.3.4 20040623 (Gentoo Linux 3.3.4-r1,
ssp-3.3.2-2, pie-8.7.6)
-rw-r--r-- 1 root root 823 Aug 24 12:33
/usr/lib/libgtk-x11-2.0.la
lrwxrwxrwx 1 root root 25 Aug 24 12:33
/usr/lib/libgtk-x11-2.0.so -> libgtk-x11-2.0.so.0.501.0
lrwxrwxrwx 1 root root 25 Aug 24 12:33
/usr/lib/libgtk-x11-2.0.so.0 -> libgtk-x11-2.0.so.0.501.0
-rwxr-xr-x 1 root root 3302800 Aug 24 12:33
/usr/lib/libgtk-x11-2.0.so.0.501.0
-rw-r--r-- 1 root root 2652444 Aug 17 23:14 /usr/lib/libc.a
-rwxr-xr-x 1 root root 204 Aug 17 23:14 /usr/lib/libc.so
-rwxr-xr-x 1 root root 580404 Dec 15 2003 /usr/lib/libc.so.5
----------------------------------------------------------------------
Comment By: Carl Hetherington (cth103)
Date: 2004-08-24 18:26
Message:
Logged In: YES
user_id=448932
sp_marker_prev_new is called for "Arrow1L", and there is no
previous marker in the sandbox. Then it is called again for
"Arrow1M", at which point the old marker is deleted.
However its SPObject has a successor of 0xaaaaaaaa, meaning
that the SPObject::deleteObject() call to
_successor->deleteObject() fails.
It doesn't happen for me. Either something is setting up
the successor badly, or there's a memory corruption bug.
----------------------------------------------------------------------
Comment By: Carl Hetherington (cth103)
Date: 2004-08-24 15:26
Message:
Logged In: YES
user_id=448932
Perhaps you could do us a favour...
Download the patch here:
http://carlh.net/debug.patch
Copy it into your CVS copy of Inkscape and then do
patch -p0 < debug.patch
at the top level of the directory tree. Then recompile and
run Inkscape :
make
src/inkscape > out
Then email the file "out" to me at inkscape@....
Thanks
Carl
----------------------------------------------------------------------
Comment By: Nobody/Anonymous (nobody)
Date: 2004-08-24 14:25
Message:
Logged In: NO
Here is what inkscape says, in a dialog box:
Inkscape encountered an internal error and will close now.
Automatic backups of unsaved documents were done to the
following locations:
/home/bertrand/.inkscape/Nouveau document
1.2004_08_24_16_21_47.0
It happens every times.
How I can do it? Vim is my friend :-D I change the
properties manually (which is not really handy, that's why
this bug is really annoying).
----------------------------------------------------------------------
Comment By: Carl Hetherington (cth103)
Date: 2004-08-24 14:17
Message:
Logged In: YES
user_id=448932
Thanks. That file is as distributed, so it's not the
problem. Very strange.
Does it happen with any drawing? So, say:
1. Start inkscape.
2. Draw a rectangle.
3. Open Fill & Stroke dialogue
causes this crash every time?
How do you use inkscape if you can't use fill & stroke ?!
I'm impressed!
Thanks
Carl
----------------------------------------------------------------------
Comment By: Bertrand Rousseau (sfbertrand)
Date: 2004-08-24 13:36
Message:
Logged In: YES
user_id=1110026
OK, I don't how to attach files so I posted it here:
http://ece.fsa.ucl.ac.be/broussea/markers.svg. It's coming
from /usr/local/share/inkscape/markers/.
----------------------------------------------------------------------
Comment By: Bertrand Rousseau (sfbertrand)
Date: 2004-08-24 13:29
Message:
Logged In: YES
user_id=1110026
Well, I didn't modify any of these but I will attach them.
Concerning the use of the CVS version, you're welcome! ;-)
Inkscape is juste GREAT and so far I find every new
additions wonderful! Keep on the great work!
----------------------------------------------------------------------
Comment By: Carl Hetherington (cth103)
Date: 2004-08-24 13:17
Message:
Logged In: YES
user_id=448932
Hi,
Thanks for trying the CVS version. Have you edited
/usr/share/inkscape/markers/markers.svg or
/usr/local/share/inkscape/markers/markers.svg?
at any point?
Perhaps you could attach whichever of those files to this
report?
Thanks
Carl
----------------------------------------------------------------------
Comment By: Bertrand Rousseau (sfbertrand)
Date: 2004-08-24 11:27
Message:
Logged In: YES
user_id=1110026
it was in version 0.39. I just tried the 0.40 from the cvs
and there is still the same problem.
----------------------------------------------------------------------
Comment By: Nobody/Anonymous (nobody)
Date: 2004-08-20 22:09
Message:
Logged In: NO
(gdb) run
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /usr/local/bin/inkscape
warning: Unable to find dynamic linker breakpoint function.
GDB will be unable to debug shared library initializers
and track explicitly loaded dynamic code.
[Thread debugging using libthread_db enabled]
[New Thread 16384 (LWP 14270)]
GC Warning: Finalization cycle involving 83a83b8
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 16384 (LWP 14270)]
SPObject::deleteObject (this=0xaaaaaaaa, propagate=false,
propagate_descendants=false) at sp-object.cpp:311
311 SPRepr *repr=SP_OBJECT_REPR(this);
(gdb)
I have been more unlucky, this is the whole gdb backtrace
(CVS version)
----------------------------------------------------------------------
Comment By: Nobody/Anonymous (nobody)
Date: 2004-08-20 17:03
Message:
Logged In: NO
Which version?
----------------------------------------------------------------------
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=604306&aid=1012874&group_id=93438
|
