[inkscape-trunk] stack smashing detected

Bug #910100 reported by revikati
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Inkscape
Fix Released
High
Unassigned

Bug Description

inkscape-trunk 1:0.48+devel+10802+30~precise

12.04 Ubuntu precise (development branch)
Linux babilon 3.2.0-7-generic #13-Ubuntu SMP Sat Dec 24 18:06:57 UTC 2011 x86_64 x86_64 x86_64 GNU/Linux
en_US.UTF-8

---

gdb inkscape
GNU gdb (Ubuntu/Linaro 7.3.1-2011.12-0ubuntu2) 7.3-2011.12
Copyright (C) 2011 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://bugs.launchpad.net/gdb-linaro/>...
Reading symbols from /usr/bin/inkscape...(no debugging symbols found)...done.
(gdb) run
Starting program: /usr/bin/inkscape
[Thread debugging using libthread_db enabled]

progname=inkscape; RGBA=on
[New Thread 0x7fffdf6eb700 (LWP 24518)]
[New Thread 0x7fffdeeea700 (LWP 24519)]
[Thread 0x7fffdf6eb700 (LWP 24518) exited]
[New Thread 0x7fffdf6eb700 (LWP 24685)]
[New Thread 0x7fffdd65c700 (LWP 24830)]
[Thread 0x7fffdd65c700 (LWP 24830) exited]

Gtk-CRITICAL **: IA__gtk_paint_layout: assertion `style->depth == gdk_drawable_get_depth (window)' failed
[Thread 0x7fffdf6eb700 (LWP 24685) exited]

Gtk-CRITICAL **: IA__gtk_paint_box: assertion `style->depth == gdk_drawable_get_depth (window)' failed

Gtk-CRITICAL **: IA__gtk_paint_layout: assertion `style->depth == gdk_drawable_get_depth (window)' failed

Gtk-CRITICAL **: IA__gtk_paint_box: assertion `style->depth == gdk_drawable_get_depth (window)' failed
*** stack smashing detected ***: /usr/bin/inkscape terminated
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x37)[0x7ffff0a087d7]
/lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x0)[0x7ffff0a087a0]
/usr/lib/x86_64-linux-gnu/libcairo.so.2(+0x5c422)[0x7ffff19b5422]
/usr/lib/x86_64-linux-gnu/libcairo.so.2(+0x5c47a)[0x7ffff19b547a]
/usr/lib/x86_64-linux-gnu/libcairo.so.2(+0x5d093)[0x7ffff19b6093]
/usr/lib/x86_64-linux-gnu/libcairo.so.2(+0x5d71e)[0x7ffff19b671e]
/usr/lib/x86_64-linux-gnu/libcairo.so.2(+0x5d86c)[0x7ffff19b686c]
/usr/lib/x86_64-linux-gnu/libcairo.so.2(+0x250c8)[0x7ffff197e0c8]
/usr/lib/x86_64-linux-gnu/libcairo.so.2(+0x32123)[0x7ffff198b123]
/usr/lib/x86_64-linux-gnu/libcairo.so.2(+0x60835)[0x7ffff19b9835]
/usr/lib/x86_64-linux-gnu/libcairo.so.2(+0x2c07a)[0x7ffff198507a]
/usr/lib/x86_64-linux-gnu/libcairo.so.2(+0x26784)[0x7ffff197f784]
/usr/lib/x86_64-linux-gnu/libcairo.so.2(cairo_stroke+0x15)[0x7ffff1979045]
/usr/bin/inkscape[0x5ad144]
/usr/bin/inkscape[0x5afed6]
======= Memory map: ========
00400000-00e8e000 r-xp 00000000 08:04 10184 /usr/bin/inkscape
0108d000-0108f000 r--p 00a8d000 08:04 10184 /usr/bin/inkscape
0108f000-010a3000 rw-p 00a8f000 08:04 10184 /usr/bin/inkscape
010a3000-03ea6000 rw-p 00000000 00:00 0 [heap]
7fffd8000000-7fffd8c03000 rw-p 00000000 00:00 0
7fffd8c03000-7fffdc000000 ---p 00000000 00:00 0
7fffdc7b0000-7fffdc8cb000 rw-p 00000000 00:00 0
7fffdcb01000-7fffdcbb1000 r--p 00000000 08:04 166964 /usr/share/fonts/truetype/ttf-dejavu/DejaVuSans.ttf
7fffdcbb1000-7fffdcbb5000 r-xp 00000000 08:04 419973 /usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-jpeg.so
7fffdcbb5000-7fffdcdb5000 ---p 00004000 08:04 419973 /usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-jpeg.so
7fffdcdb5000-7fffdcdb6000 r--p 00004000 08:04 419973 /usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-jpeg.so
7fffdcdb6000-7fffdcdb7000 rw-p 00005000 08:04 419973 /usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-jpeg.so
7fffdcdb7000-7fffdce5c000 r--p 00000000 08:04 166970 /usr/share/fonts/truetype/ttf-dejavu/DejaVuSans-Bold.ttf
7fffdce5c000-7fffdce5d000 ---p 00000000 00:00 0
7fffdce5d000-7fffdd65d000 rw-p 00000000 00:00 0
7fffdd65d000-7fffdd670000 r-xp 00000000 08:04 655673 /usr/lib/x86_64-linux-gnu/gio/modules/libgioremote-volume-monitor.so
7fffdd670000-7fffdd86f000 ---p 00013000 08:04 655673 /usr/lib/x86_64-linux-gnu/gio/modules/libgioremote-volume-monitor.so
7fffdd86f000-7fffdd870000 r--p 00012000 08:04 655673 /usr/lib/x86_64-linux-gnu/gio/modules/libgioremote-volume-monitor.so
7fffdd870000-7fffdd871000 rw-p 00013000 08:04 655673 /usr/lib/x86_64-linux-gnu/gio/modules/libgioremote-volume-monitor.so
7fffdd871000-7fffdd8d1000 rw-s 00000000 00:04 1966085 /SYSV00000000 (deleted)
7fffdd8d1000-7fffdd914000 r-xp 00000000 08:04 407860 /usr/lib/x86_64-linux-gnu/libibus-1.0.so.0.400.0
7fffdd914000-7fffddb14000 ---p 00043000 08:04 407860 /usr/lib/x86_64-linux-gnu/libibus-1.0.so.0.400.0
7fffddb14000-7fffddb15000 r--p 00043000 08:04 407860 /usr/lib/x86_64-linux-gnu/libibus-1.0.so.0.400.0
7fffddb15000-7fffddb16000 rw-p 00044000 08:04 407860 /usr/lib/x86_64-linux-gnu/libibus-1.0.so.0.400.0
7fffddb16000-7fffddb17000 rw-p 00000000 00:00 0
7fffddb67000-7fffddb6d000 r-xp 00000000 08:04 1181856 /usr/lib/x86_64-linux-gnu/gtk-2.0/2.10.0/immodules/im-ibus.so
7fffddb6d000-7fffddd6c000 ---p 00006000 08:04 1181856 /usr/lib/x86_64-linux-gnu/gtk-2.0/2.10.0/immodules/im-ibus.so
7fffddd6c000-7fffddd6d000 r--p 00005000 08:04 1181856 /usr/lib/x86_64-linux-gnu/gtk-2.0/2.10.0/immodules/im-ibus.so
7fffddd6d000-7fffddd6e000 rw-p 00006000 08:04 1181856 /usr/lib/x86_64-linux-gnu/gtk-2.0/2.10.0/immodules/im-ibus.so
7fffddd6e000-7fffdddce000 rw-s 00000000 00:04 1933312 /SYSV00000000 (deleted)
7fffdde0f000-7fffdde6e000 r--p 00000000 08:04 398355 /usr/share/fonts/truetype/ubuntu-font-family/Ubuntu-RI.ttf
7fffdde6e000-7fffddec0000 r--p 00000000 08:04 397971 /usr/share/fonts/truetype/ubuntu-font-family/Ubuntu-B.ttf
7fffddec0000-7fffddee2000 r--p 00000000 08:04 1322604 /usr/share/fonts/truetype/liberation/LiberationSans-Regular.ttf
7fffddee2000-7fffddf24000 rw-p 00000000 00:00 0
7fffddf24000-7fffddf2a000 r-xp 00000000 08:04 424349 /usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-xpm.so
7fffddf2a000-7fffde129000 ---p 00006000 08:04 424349 /usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-xpm.so
7fffde129000-7fffde12a000 r--p 00005000 08:04 424349 /usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-xpm.so
7fffde12a000-7fffde12b000 rw-p 00006000 08:04 424349 /usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-xpm.so
7fffde12b000-7fffde148000 r--p 00000000 08:04 1323279 /usr/share/fonts/truetype/droid/DroidSansMono.ttf
7fffde148000-7fffde19f000 r--p 00000000 08:04 398069 /usr/share/fonts/truetype/ubuntu-font-family/Ubuntu-R.ttf
7fffde19f000-7fffde1a1000 r-xp 00000000 08:04 303698 /usr/lib/pango/1.6.0/modules/pango-basic-fc.so
7fffde1a1000-7fffde3a0000 ---p 00002000 08:04 303698 /usr/lib/pango/1.6.0/modules/pango-basic-fc.so
7fffde3a0000-7fffde3a1000 r--p 00001000 08:04 303698 /usr/lib/pango/1.6.0/modules/pango-basic-fc.so
7fffde3a1000-7fffde3a2000 rw-p 00002000 08:04 303698 /usr/lib/pango/1.6.0/modules/pango-basic-fc.so
7fffde3a2000-7fffde6ea000
Program received signal SIGABRT, Aborted.
0x00007ffff09463b5 in raise () from /lib/x86_64-linux-gnu/libc.so.6
(gdb) bt full
#0 0x00007ffff09463b5 in raise () from /lib/x86_64-linux-gnu/libc.so.6
No symbol table info available.
#1 0x00007ffff0949b1b in abort () from /lib/x86_64-linux-gnu/libc.so.6
No symbol table info available.
#2 0x00007ffff097e0b3 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
No symbol table info available.
#3 0x00007ffff0a087d7 in __fortify_fail ()
   from /lib/x86_64-linux-gnu/libc.so.6
No symbol table info available.
#4 0x00007ffff0a087a0 in __stack_chk_fail ()
   from /lib/x86_64-linux-gnu/libc.so.6
No symbol table info available.
#5 0x00007ffff19b5422 in ?? () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
No symbol table info available.
#6 0x00007ffff19b547a in ?? () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
No symbol table info available.
#7 0x00007ffff19b6093 in ?? () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
No symbol table info available.
#8 0x00007ffff19b671e in ?? () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
No symbol table info available.
#9 0x00007ffff19b686c in ?? () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
No symbol table info available.
#10 0x00007ffff197e0c8 in ?? () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
No symbol table info available.
---Type <return> to continue, or q <return> to quit---
#11 0x00007ffff198b123 in ?? () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
No symbol table info available.
#12 0x00007ffff19b9835 in ?? () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
No symbol table info available.
#13 0x00007ffff198507a in ?? () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
No symbol table info available.
#14 0x00007ffff197f784 in ?? () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
No symbol table info available.
#15 0x00007ffff1979045 in cairo_stroke ()
   from /usr/lib/x86_64-linux-gnu/libcairo.so.2
No symbol table info available.
#16 0x00000000005ad144 in ?? ()
No symbol table info available.
#17 0x00000000005afed6 in ?? ()
No symbol table info available.
#18 0x00000000005afed6 in ?? ()
No symbol table info available.
#19 0x00000000005afed6 in ?? ()
No symbol table info available.
#20 0x00000000005aedbe in ?? ()
No symbol table info available.
#21 0x00000000005b21ef in ?? ()
No symbol table info available.
#22 0x00000000005b22e8 in ?? ()
---Type <return> to continue, or q <return> to quit---
No symbol table info available.
#23 0x00007ffff16ad58a in g_main_dispatch (context=0x11aaa60)
    at /build/buildd/glib2.0-2.31.7+git20111227.8ca2647c/./glib/gmain.c:2513
        dispatch = 0x7ffff16ab1b0 <g_idle_dispatch>
        was_in_call = 0
        user_data = 0x2277020
        callback = 0x5b2290
        cb_funcs = 0x7ffff19579a0
        cb_data = 0x36e2ad0
        current_source_link = {data = 0x357b4c0, next = 0x0}
        need_destroy = <optimized out>
        source = 0x357b4c0
        current = 0x28bbdc0
        i = <optimized out>
#24 g_main_context_dispatch (context=0x11aaa60)
    at /build/buildd/glib2.0-2.31.7+git20111227.8ca2647c/./glib/gmain.c:3050
No locals.
#25 0x00007ffff16ad950 in g_main_context_iterate (dispatch=1,
    block=<optimized out>, context=0x11aaa60, self=<optimized out>)
    at /build/buildd/glib2.0-2.31.7+git20111227.8ca2647c/./glib/gmain.c:3121
        timeout = 0
        some_ready = 1
        fds = <optimized out>
        max_priority = 100
---Type <return> to continue, or q <return> to quit---
        nfds = 5
        allocated_nfds = <optimized out>
#26 g_main_context_iterate (context=0x11aaa60, block=<optimized out>,
    dispatch=1, self=<optimized out>)
    at /build/buildd/glib2.0-2.31.7+git20111227.8ca2647c/./glib/gmain.c:3058
        some_ready = 1
#27 0x00007ffff16add4a in g_main_loop_run (loop=0x21dac00)
    at /build/buildd/glib2.0-2.31.7+git20111227.8ca2647c/./glib/gmain.c:3315
        __PRETTY_FUNCTION__ = "g_main_loop_run"
#28 0x00007ffff5ed41b7 in IA__gtk_main ()
    at /build/buildd/gtk+2.0-2.24.8/gtk/gtkmain.c:1329
        tmp_list = <optimized out>
        functions = 0x0
        init = <optimized out>
        loop = 0x21dac00
#29 0x000000000046f140 in ?? ()
No symbol table info available.
#30 0x00007ffff093130d in __libc_start_main ()
   from /lib/x86_64-linux-gnu/libc.so.6
No symbol table info available.
#31 0x000000000046e1e1 in ?? ()
No symbol table info available.
#32 0x00007fffffffe0e8 in ?? ()
No symbol table info available.
---Type <return> to continue, or q <return> to quit---
#33 0x000000000000001c in ?? ()
No symbol table info available.
#34 0x0000000000000001 in ?? ()
No symbol table info available.
#35 0x00007fffffffe42a in ?? ()
No symbol table info available.
#36 0x0000000000000000 in ?? ()
No symbol table info available.
(gdb) quit
A debugging session is active.

 Inferior 1 [process 24513] will be killed.

Tags: cairo crash
Revision history for this message
su_v (suv-lp) wrote :

Steps to reproduce? Or any information about what which actions had been done before Inkscape crashed?

Changed in inkscape:
status: New → Incomplete
tags: added: crash
removed: trunk
Revision history for this message
revikati (revikati) wrote :

It happens very often, I'll try to find a way of reproducing this.

Revision history for this message
revikati (revikati) wrote :

I can reproduce this now. It happens when dragging a shape around.

Still no step to step instructions, but something on the lines of:
1) open inkscape trunk (currently 1:0.48+devel+10809+30~precise)
2) create a shape (like a star)
3) select the shape and drag and drop around the canvas a couple of times (maybe it depends on the pace, eg. doing it fast) - I'm trying to narrow this down
4) the above crash occurs

Revision history for this message
revikati (revikati) wrote :

So this is how I can trigger it:
1) open inkscape
2) create 1 star shape
3) select it and drag it around with the mouse (dont drop it, hold the mouse button pressed), inlcuding to drag it around the border of the window
4) crash occurs

Revision history for this message
revikati (revikati) wrote :
Changed in inkscape:
status: Incomplete → New
Revision history for this message
revikati (revikati) wrote :
Revision history for this message
revikati (revikati) wrote :

no problems with the stable branch, using:
inkscape-trunk 0.48.2+9834+26~precise1

Revision history for this message
su_v (suv-lp) wrote :

Which cairo version do you have installed?

Crash could be related to using inkscape with cairo from git master (xorg-edgers PPA):
see <http://sourceforge.net/mailarchive/message.php?msg_id=28733458>

Revision history for this message
su_v (suv-lp) wrote :

Crash not reproduced with Inkscape 0.48+devel on OS X Lion (64bit), GTK+/X11 2.24.8, default prefs, tested with:
- r10808, r10921 built and run with stable cairo 1.10.2
- r10808, r10921 built with cairo stable and run with cairo git master (up-to-date) [*]
- r10546 inkscape mesh branch, built and run with cairo git master

[*] on OS X done by setting $DYLD_LIBRARY_PATH accordingly (the dynamic linker searches these directories before it searches the default locations for libraries).

Revision history for this message
ScislaC (scislac) wrote :

Just to add, I too am also on Ubuntu Precise. Everything that would affect inkscape except my cairo from the xorg-edgers ppa is standard for Precise.

Revision history for this message
revikati (revikati) wrote :

Yes, I am using the xorg-edgers ppa as well (including cairo 1.11.3+git20120119.0f40cdea-0ubuntu0ricotz~precise2).

su_v (suv-lp)
tags: added: cairo
Revision history for this message
su_v (suv-lp) wrote :

Reproduced with my latest round of inkscape builds with cairo git master (mesh branch and trunk) [1], this time compiled with GCC 4.6.2 (prior builds had been compiled with llvm-gcc-4.2), on OS X 10.7.2 Lion. Not sure about other differences (build config for cairo as well as inkscape).

[1] <http://article.gmane.org/gmane.comp.graphics.inkscape.devel/38005>

Changed in inkscape:
status: New → Confirmed
Revision history for this message
ScislaC (scislac) wrote :

I installed the cairo debugging symbols to see if it would be helpful in figuring this out.

bt (from "run" to the end of "bt" output)
http://paste.ubuntu.com/862661/

bt full (same crash, run right after bt to the end of the output)
http://paste.ubuntu.com/862665/

Revision history for this message
ScislaC (scislac) wrote :

Did a cairo-perf-trace on the output from a cairo-trace I ran... it appears to have crashed on it. :-/
http://paste.ubuntu.com/862686/

Revision history for this message
ScislaC (scislac) wrote :
su_v (suv-lp)
Changed in inkscape:
importance: Undecided → High
Revision history for this message
ScislaC (scislac) wrote :

Fixed upstream

Revision history for this message
ScislaC (scislac) wrote :
Changed in inkscape:
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.