crash with two inkscape instances when changing layer

Bug #307195 reported by Thomas Holder
78
This bug affects 9 people
Affects Status Importance Assigned to Milestone
Inkscape
Fix Released
High
theAdib

Bug Description

Steps to reproduce:

 * open first file
 * open second file
 * in first window show layers dialog
 * in second window select (click) some object on canvas
 * in first window change layer
 -> crash

Linux, SVN Revision: 20351

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1247754000 (LWP 10472)]
0x081b5e33 in SPDesktop::currentRoot () at io/base64stream.cpp:74
74 */
Current language: auto; currently c++
(gdb) backtrace
#0 0x081b5e33 in SPDesktop::currentRoot () at io/base64stream.cpp:74
#1 0x083eb175 in Inkscape::UI::Dialogs::LayersPanel::_pushTreeSelectionToCurrent () at io/base64stream.cpp:74
#2 0x083f3ff3 in sigc::bound_mem_functor0<void, Inkscape::UI::Dialogs::LayersPanel>::operator() () at io/base64stream.cpp:74
#3 0x083f400a in sigc::adaptor_functor<sigc::bound_mem_functor0<void, Inkscape::UI::Dialogs::LayersPanel> >::operator() () at io/base64stream.cpp:74
#4 0x083f4026 in sigc::internal::slot_call0<sigc::bound_mem_functor0<void, Inkscape::UI::Dialogs::LayersPanel>, void>::call_it () at io/base64stream.cpp:74
#5 0xb7b83526 in Glib::SignalProxyNormal::slot0_void_callback () from /usr/lib/libglibmm-2.4.so.1
#6 0xb76f2207 in g_cclosure_marshal_VOID__VOID () from /usr/lib/libgobject-2.0.so.0
#7 0x00000000 in ?? ()
(gdb)

More precisely, the access on _layer_hierarchy seems to produce the crash.

SPObject *SPDesktop::currentRoot() const
{
    return _layer_hierarchy ? // <- crashes here
        _layer_hierarchy->top() : NULL;
}

Revision history for this message
Kaspar (kaspartorn) wrote :

Confirmed, I get the same behaviour:

Windows XPSP3, Inkscape 0.46+devel, revision 20212, built Nov 16 2008...

Revision history for this message
jazzynico (jazzynico) wrote :

Tested with XP-SP3, rev20398 (Dec 23 2008), same behaviour.

And some other problems with layers when two instances are running, probably related.

* Inactive Layers dialog
1. Open two blank instances.
2. Open the Layers dialog in the second instance.
3. Select the first instance, and then the second again.
4. Try to add a new layer in the second instance (+ button or right-click menu). Nothing appends.

* Other actions leading to a crash (after steps 1-4)
5a. Open the Layers dialog in the first instance and click on the default layer in the list.
5b. Click on the lock (or eye) in the layer list.

Thomas Holder (speleo3)
Changed in inkscape:
status: New → Confirmed
Revision history for this message
jazzynico (jazzynico) wrote :

Tested again on Ubuntu 9.04, build 21348.

Backtrace:
----
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb6663740 (LWP 31044)]
0x0842c5ce in Inkscape::UI::Dialogs::LayersPanel::_toggled (this=0xb3e3bb0, str=@0xbfe1a9d8, targetCol=1)
    at ui/dialog/layers.cpp:491
491 newValue? _("Unhide layer") : _("Hide layer"));
(gdb) backtrace
#0 0x0842c5ce in Inkscape::UI::Dialogs::LayersPanel::_toggled (this=0xb3e3bb0, str=@0xbfe1a9d8, targetCol=1)
    at ui/dialog/layers.cpp:491
#1 0x0843378d in sigc::internal::slot_call1<sigc::bind_functor<-1, sigc::bound_mem_functor2<void, Inkscape::UI::Dialogs::LayersPanel, Glib::ustring const&, int>, int, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil>, void, Glib::ustring const&>::call_it (rep=0xb204fc8, a_1=@0xbfe1a9d8) at /usr/include/sigc++-2.0/sigc++/functors/mem_fun.h:1917
#2 0x08492d48 in Inkscape::UI::Widget::ImageToggler::activate_vfunc (this=0xd060000, event=0xb2f4008, path=@0xbfe1a9d8)
    at /usr/include/sigc++-2.0/sigc++/signal.h:690
#3 0xb7d37bb5 in Gtk::CellRenderer_Class::activate_vfunc_callback () from /usr/lib/libgtkmm-2.4.so.1
#4 0xb76e9658 in IA__gtk_cell_renderer_activate (cell=0xcff7ea8, event=0xb2f4008, widget=0xb1f4ba0, path=0xcb963a0 "0",
    background_area=0xbfe1aae4, cell_area=0xbfe1aaf4, flags=0) at /build/buildd/gtk+2.0-2.16.1/gtk/gtkcellrenderer.c:621
#5 0xb78a56a1 in gtk_tree_view_column_cell_process_action (tree_column=0xcc1a4a8, window=0x0, background_area=0xbfe1ac00,
    cell_area=0xbfe1abf0, flags=0, action=2, expose_area=0x0, focus_rectangle=0x0, editable_widget=0xbfe1ac18, event=0xb2f4008,
    path_string=0xcb963a0 "0") at /build/buildd/gtk+2.0-2.16.1/gtk/gtktreeviewcolumn.c:2879
----

Changed in inkscape:
importance: Undecided → Medium
Revision history for this message
jazzynico (jazzynico) wrote :

I can't reproduce it with 0.46. As this is a regression, it should be fixed in 0.47.

Changed in inkscape:
milestone: none → 0.47
Thomas Holder (speleo3)
tags: added: crash
Revision history for this message
Alvin Penner (apenner) wrote :

    well, I am beginning to feel like a slow student here, but I cannot make this crash in Windows, running build 21345, and using undocked layers dialogs, free floating.
    can anyone confirm this crash on a recent Windows build?

Revision history for this message
jazzynico (jazzynico) wrote :

Tested again on Windows XP sp3, Inkscape rev. 21424, and I still have the bug. Floating or docked, same problem.

Revision history for this message
dopelover (dopelover) wrote :

Crash also occurs with Inkscape r21439 (Ubuntu 9.04).
Backtrace:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb5fd5770 (LWP 19480)]
0x084dbeb6 in SPDesktop::currentRoot (this=0x0) at desktop.cpp:460
460 return _layer_hierarchy ? _layer_hierarchy->top() : NULL;
(gdb) bt
#0 0x084dbeb6 in SPDesktop::currentRoot (this=0x0) at desktop.cpp:460
#1 0x084011a7 in Inkscape::UI::Dialogs::LayersPanel::_pushTreeSelectionToCurrent (this=0x135b8d30) at ui/dialog/layers.cpp:419
#2 0xb7b187e2 in Glib::SignalProxyNormal::slot0_void_callback ()
   from /usr/lib/libglibmm-2.4.so.1
#3 0xb72be3a4 in g_cclosure_marshal_VOID__VOID ()
   from /usr/lib/libgobject-2.0.so.0
#4 0xb72b0c7b in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#5 0xb72c73d2 in ?? () from /usr/lib/libgobject-2.0.so.0
#6 0xb72c84b9 in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0
#7 0xb72c8936 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#8 0xb77c9185 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#9 0xb77e208b in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#10 0xb77ebc07 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#11 0xb7ecd10c in Gtk::Widget_Class::button_press_event_callback ()
   from /usr/lib/libgtkmm-2.4.so.1
#12 0xb76e2526 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#13 0xb72af3d9 in ?? () from /usr/lib/libgobject-2.0.so.0
#14 0xb72b0c7b in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#15 0xb72c6aff in ?? () from /usr/lib/libgobject-2.0.so.0
#16 0xb72c834f in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0
#17 0xb72c8936 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#18 0xb77fd2ae in ?? () from /usr/lib/libgtk-x11-2.0.so.0
---Type <return> to continue, or q <return> to quit---
#19 0xb76daf7c in gtk_propagate_event () from /usr/lib/libgtk-x11-2.0.so.0
#20 0xb76dc447 in gtk_main_do_event () from /usr/lib/libgtk-x11-2.0.so.0
#21 0xb756834a in ?? () from /usr/lib/libgdk-x11-2.0.so.0
#22 0xb7212b88 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#23 0xb72160eb in ?? () from /usr/lib/libglib-2.0.so.0
#24 0xb72165ba in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#25 0xb76dc7d9 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#26 0xb7e423d7 in Gtk::Main::run_impl () from /usr/lib/libgtkmm-2.4.so.1
#27 0xb7e421d2 in Gtk::Main::run () from /usr/lib/libgtkmm-2.4.so.1
#28 0x08088817 in sp_main_gui (argc=1, argv=0xbfdeab94) at main.cpp:943
#29 0x0816673a in Inkscape::NSApplication::Application::run (this=0xbfdeaad0)
    at application/application.cpp:114
#30 0x08087e6d in main (argc=1, argv=0xbfdeab94) at main.cpp:679

Revision history for this message
Alvin Penner (apenner) wrote :

yes, I get a crash on Win32 rev21345.
In my case, it occurs only when I open the second instance of Inkscape from the first one using the File | New command. Is this how you are opening the second instance?

Revision history for this message
Thomas Holder (speleo3) wrote :

@Alvin: exactly, second instance must be opened with "file > open" or "file > new".

Revision history for this message
Thomas Ibbotson (thomas-ibbotson) wrote :

I also see this with revision 21470. I tried to work around the issue by closing the second instance before trying to change layers, but unfortunately the crash still occurs.

Revision history for this message
ErikTiePie (e-tigchelaar) wrote :

I can confirm this on :

Inkscape 0.46, april 2008
Inkscape Dev. version 21323-0905111537
Inkscape Dev. version 21345-0905140303
Inkscape Dev. version 21627-0906200405

all on Windows XP SP3

@Alvin and @Thomas Holder : I created the second instance by pressing the "new document" button on the toolbar.

Since I need to copy many items from different layers from one document to another, again to various layers, this bugs me terribly.

Revision history for this message
g2010a (x-launchpad-the-otherinbox-com) wrote :

confirmed on OSX 10.4 using 0.47pre1

Revision history for this message
Jan M (cymiu) wrote :

Also confirmed on WinXP SP3, 0.47pre1
Was working on a document normally, but accidentally hit Ctrl+N. So I closed the new document, clicked on the layers panel of the original doc, and Inkscape crashes.

Program received signal SIGSEGV, Segmentation fault.
0x0088ba01 in Inkscape::UI::Dialogs::LayersPanel::_toggled ()
(gdb) bt
#0 0x0088ba01 in Inkscape::UI::Dialogs::LayersPanel::_toggled ()
#1 0x00ddeb1d in sigc::internal::slot_call1<sigc::bind_functor<-1, sigc::bound
mem_functor2<void, Inkscape::UI::Dialogs::LayersPanel, Glib::ustring const&, in
>, int, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil>, void
 Glib::ustring const&>::call_it ()
#2 0x009abb7d in Inkscape::UI::Widget::ImageToggler::activate_vfunc ()
#3 0x01945b46 in Gtk::CellRenderer_Class::activate_vfunc_callback (
    self=0xab131a0, event=0xe80fb58, widget=0xab100d0, path=0xe2eef90 "0",
    background_area=0x22f6f0, cell_area=0x22f700, flags=0)
    at cellrenderer.cc:290
#4 0x619710a3 in gtk_tree_view_column_cell_process_action ()
   from C:\Program Files\inkscape\libgtk-win32-2.0-0.dll
#5 0x61971370 in _gtk_tree_view_column_cell_event ()
   from C:\Program Files\inkscape\libgtk-win32-2.0-0.dll
#6 0x61969d6f in gtk_tree_view_button_press ()
   from C:\Program Files\inkscape\libgtk-win32-2.0-0.dll
#7 0x618611d2 in _gtk_marshal_BOOLEAN__BOXED ()
   from C:\Program Files\inkscape\libgtk-win32-2.0-0.dll
#8 0x63a43955 in g_closure_invoke ()
   from C:\Program Files\inkscape\libgobject-2.0-0.dll
#9 0x63a57ab6 in signal_emit_unlocked_R ()
   from C:\Program Files\inkscape\libgobject-2.0-0.dll
#10 0x0022f980 in ?? ()
#11 0x00000002 in ?? ()
#12 0x0022f9a8 in ?? ()
#13 0x0022f91c in ?? ()
#14 0x7e42b401 in USER32!CallNextHookEx () from C:\WINDOWS\system32\user32.dll
#15 0x00000000 in ?? ()
(gdb)

Revision history for this message
su_v (suv-lp) wrote :

Confirmed with Inkscape 0.46+devel r21924 on OS X 10.5.7

steps to reproduce:
1) open existing drawing with several layers
2) open layer dialog, toggle visibility or lock status
3) open new drawing (Ctrl+N)
4) close first drawing, without saving
5) inkscape crashes

This bug is annoying when working with layers (unless you always save and quit Inkscape every time before opening another or new drawing). Proposing to elevate the importance to high for 0.47 (despite <http://article.gmane.org/gmane.comp.graphics.inkscape.devel/30847> ;-)

Revision history for this message
su_v (suv-lp) wrote :

step 2): just open the layer dialog
no need to toggle a layer status or to select an object - inkscape crashes when closing the first drawing after opening a second one.
Interestingly Inkscape asks to save changes even though nothing was changed (besides opening the layer dialog).

Revision history for this message
jazzynico (jazzynico) wrote :

Key feature, very annoying, crash, regression, 3 duplicates...
Set to High.

Changed in inkscape:
importance: Medium → High
Revision history for this message
Marc Poulhiès (marc-poulhies) wrote :

Any news on this one ? Any way I could help ? I'm always using a nearly up to date version of inkscape from svn. This bug is really annoying, in particular when you need to copy/paste between different svg files... Gets tricky to use inkscape :(

Revision history for this message
theAdib (theadib) wrote :

uh oh. NULL pointer.

The patch attached checks all cases for _desktop and assigns the _desktop in the onactivate callback.
The current onactivate callback assigns the current destop to the desktop, which in this case becomes NULL. Because ondeactivating the _destop becomes NULL already.

HTH, Adib.
---

Changed in inkscape:
status: Confirmed → In Progress
assignee: nobody → theAdib (theadib)
Revision history for this message
Thomas Holder (speleo3) wrote :

Adib, well done! :)
I tested the patch and got no crash anymore. But now any Layer Panel in each window shows the layers of the active window.

Revision history for this message
bbyak (buliabyak) wrote :

thanks Adib, tested and committed in 22214

Changed in inkscape:
status: In Progress → Fix Released
Revision history for this message
theAdib (theadib) wrote :

Thomas , thanks for testing.
Funny think do that now layer dialog acts according to the current document not to the assigned document.
However this is a more general and separate issue. You can try using "fill and stroke" dialogue.
Open two documents and open in each inkscape window the fill and stroke dialogue.
...
I will open a new issue for that.
Adib.

Revision history for this message
Marc Poulhiès (marc-poulhies) wrote :

Looks like it works fine now. No crash anymore (yet!) when playing with multiple windows and layers. Thanks !

Revision history for this message
panga (pangabada) wrote :

Hi, Just want to know how I can apply this patch ? Thanks !!

Revision history for this message
Marc Poulhiès (marc-poulhies) wrote :

Easiest way is to checkout a fresh svn and compile it, patch is already applied.
If you are using Ubuntu Jaunty, you can also try to use my ppa:
  https://launchpad.net/~marc-poulhies/+archive/ppa
it's not meant to be maintained, but it can help in the meantime (until the next stable version)

Revision history for this message
Jon A. Cruz (jon-joncruz) wrote :

The patch suppressed the crash, but a more comprehensive fix was to track the desired "target" desktop correctly. This is addressed in bug #427514 and covers the issue seen by theAdib in comment #21 on 2009-09-10.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.