New 'Import Clip Art…' dialog crashes

Bug #943275 reported by jazzynico
14
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Inkscape
Fix Released
High
jazzynico

Bug Description

Crashers found with the new OCAL dialog:
- With two concurrent searches (Ubuntu, not reproduced yet).
    -> Not fixed.
- When receiving non UTF-8 data (Ubuntu, not reproduced - probably fixed on OCAL).
    -> Patch comment #15.
- When no network connexion is available (Windows only, r11030)
    -> Fixed r11538.
- When clearing the search box (Windows only, r11077)
    -> Fixed r11141.
- When searching and data not available (Ubuntu)
    -> Fixed r11289.

jazzynico (jazzynico)
tags: added: crash openclipart win32
Changed in inkscape:
importance: Undecided → High
milestone: none → 0.49
Revision history for this message
jazzynico (jazzynico) wrote :

Also fails with 10923 and devlibs r25.

Revision history for this message
jazzynico (jazzynico) wrote :

Tested with another computer with XP (virtualized), and r11030 doesn't crash. I guess there's something wrong on the other computer, independent from Inkscape or the devlibs. Investigations in progress.

Changed in inkscape:
status: New → Incomplete
Revision history for this message
Alvin Penner (apenner) wrote :

crash duplicated on Windows XP, Inkscape rev 11030, devlibs rev 29. tdm-gcc 4.5.1.
This computer is not connected to the internet.
crash was immediate, no backtrace was generated

Changed in inkscape:
status: Incomplete → Confirmed
Revision history for this message
Kris (kris-degussem) wrote :

See report Bug #174797

Revision history for this message
Kris (kris-degussem) wrote :

Should reed see also report #174797

Revision history for this message
ScislaC (scislac) wrote :

Crashes here on Ubuntu Precise as well with r11075. I'm not sure if there are any new dependencies, but if so, there aren't proper checks in place. Backtrace attached.

Revision history for this message
dopelover (dopelover) wrote :

I havent noticed any crash while searching Open Clip Art repository using new import dialog. It works fine for me but I found an another problem. Inkscape crashes just after clearing searching box. To reproduce you have to clear the input widget using that little brush icon located on the right side.

This problem affects Inkscape 0.48+devel r11077 that runs on Windows XP.
Backtrace attached

I am not sure if this problem deserves for separate bug report but I decided to post it here. If it needs new thread feel free to set a new report.

Revision history for this message
jazzynico (jazzynico) wrote :

Seems to break in ocaldialog.cpp:1026.
Tried to catch xml_file->load_contents_finish(result, data, length), but unfortunately it doesn't want to return any exception.

The crash also occurs when removing the content of the search entry with the clear icon.

Revision history for this message
jazzynico (jazzynico) wrote :

bt after a clear icon crash:

Program received signal SIGTRAP, Trace/breakpoint trap.
0x7c91120f in ntdll!DbgUiConnectToDbg () from C:\WINDOWS\system32\ntdll.dll
(gdb) bt
#0 0x7c91120f in ntdll!DbgUiConnectToDbg () from C:\WINDOWS\system32\ntdll.dll
#1 0x7c97e139 in ntdll!RtlpNtMakeTemporaryKey () from C:\WINDOWS\system32\ntdll.dll
#2 0x7c97e576 in ntdll!RtlpNtMakeTemporaryKey () from C:\WINDOWS\system32\ntdll.dll
#3 0x7c97f75e in ntdll!RtlpNtMakeTemporaryKey () from C:\WINDOWS\system32\ntdll.dll
#4 0x7c95bc4c in ntdll!LdrFindEntryForAddress () from C:\WINDOWS\system32\ntdll.dll
#5 0x003f0000 in ?? ()
#6 0x50000061 in ?? ()
#7 0x01867a40 in virtual thunk to Inkscape::XML::SimpleNode::next() const () from D:\Inkscape\ocal-dialog-improvements\inkscape\libgtkmm-2.4-1.dll
#8 0x003f0000 in ?? ()
#9 0x01867a40 in virtual thunk to Inkscape::XML::SimpleNode::next() const () from D:\Inkscape\ocal-dialog-improvements\inkscape\libgtkmm-2.4-1.dll
#10 0x40000060 in ?? ()
#11 0x00000030 in ?? ()
#12 0x7c937573 in ntdll!RtlPcToFileHeader () from C:\WINDOWS\system32\ntdll.dll
#13 0x77bfc2de in msvcrt!free () from C:\WINDOWS\system32\msvcrt.dll

Revision history for this message
Jaroslaw M. Gliwinski (jaroslaw-m-gliwinski) wrote :

I was unable to reproduce the original bug on my machine (W7 64bit), but I did reproduce the problem with crashing after clicking the clear icon. Attached is the change fixing that.

Revision history for this message
jazzynico (jazzynico) wrote :

Clear icon crash fix confirmed on Windows XP, Inkscape 11141.
Thanks Jaroslaw!

The initial bug seems to occur when the network is down, when the openclipart server is down, or when the server (or a proxy) returns an invalid value.

Revision history for this message
jazzynico (jazzynico) wrote :

Patch committed in the trunk, revision 11151.

Revision history for this message
John Smith (john-smithi) wrote :

Committed revision 11289 - Fix for crash when searching and data not available.

jazzynico (jazzynico)
Changed in inkscape:
assignee: nobody → JazzyNico (jazzynico)
status: Confirmed → In Progress
Revision history for this message
jazzynico (jazzynico) wrote :

Workaround attached. Tested on Windows XP, trunk revision 11311.

Not wonderful because it doesn't fix the issue (xml_file->load_contents_finish segfaults instead of returning 0), but at least it prevents Inkscape from crashing when the network is down.

Revision history for this message
John Smith (john-smithi) wrote :

Attached is a fix for a crash when searching and non-utf8 compliant data is returned.

To reproduce : Search for text "link" causes a crash in g_markup_printf_escaped
Problem : g_markup_printf_escaped expects valid utf8 - but currently the data is not checked for utf8 validity.
Sample invalid data : "Penguin | Ping\xfcino"
Tested on : Ubuntu 12.04.

Revision history for this message
ScislaC (scislac) wrote :

I see John committed a fix a few comments back, however, there have been two patches added to the report after that. John, is yours including JazzyNico's?

Revision history for this message
John Smith (john-smithi) wrote :

No, the patches in #14 and #15 are for 2 separate issues.
If someone can test and confirm, i believe both can be committed.

Revision history for this message
jazzynico (jazzynico) wrote :

Bug from #15 not reproduced on Windows XP, Inkscape revision 11535.
Instead, Inkscape crashes when trying to preview a file selected in the list that has an accent in the title (accents in the descriptions but not in the title work fine). Crash reproduced with and without John's patch.
Will try later on Ubuntu.

Revision history for this message
jazzynico (jazzynico) wrote :

Fix committed, trunk revision 11538.

John, could you please test again? I've just tried to reproduce your bug (and mine) but everything works fine on Ubuntu 11.04 without your patch.

Changed in inkscape:
status: In Progress → Fix Committed
Revision history for this message
John Smith (john-smithi) wrote :

@JazzyNico, The good news is that I cannot reproduce the bug in #15 anymore.
It seems now only valid utf8 is being returned.

However, i have seen several crashes when clicking on search results.
Console only shows a stack trace up to clone() with message:

GLib (gthread-posix.c): Unexpected error from C library during 'pthread_setspecific': Invalid argument. Aborting.
The program 'inkscape' received an X Window System error.
This probably reflects a bug in the program.
The error was 'BadIDChoice (invalid resource ID chosen for this connection)'.
  (Details: serial 28730 error_code 14 request_code 144 minor_code 2)
  (Note to programmers: normally, X errors are reported asynchronously;

It seems to be a reproducible timing issue :
1. Search for "a"
2. Click any result
3. While the preview image is still loading
4. Search for "b"
5. Click any result

Should i file this as a separate bug ?

Ubuntu 12.04.

Revision history for this message
jazzynico (jazzynico) wrote :

> It seems to be a reproducible timing issue

Tried several times on Ubuntu, Inkscape revision 1545, and can't reproduce the issue.

> Should i file this as a separate bug ?

No, let's reuse this one for all OCAL crashers !

Changed in inkscape:
status: Fix Committed → In Progress
summary: - New 'Import Clip Art…' dialog crashes on Windows
+ New 'Import Clip Art…' dialog crashes
tags: removed: win32
jazzynico (jazzynico)
description: updated
Revision history for this message
Martin Owens (doctormo) wrote :

+JazzyNico, are these OCAL bugs fixed? It's not proper to use a single bug report for multiple bugs if the bugs span several commits and releases. So is it worth cleaning this old bug report up now?

Revision history for this message
jazzynico (jazzynico) wrote :

@John, can the issue described comment #20 be reproduced on your computer ?

@Martin - All but the first two on the list are fixed (they need to be tested again on Ubuntu). Note that we decided to create a "meta" bug report because the new OCAL dialog was just committed and the crashers were somewhat related.

Revision history for this message
John Smith (john-smithi) wrote :

Cannot repro #20 using r12378 on Ubuntu13.04.

Revision history for this message
jazzynico (jazzynico) wrote :

Still crashes with two concurrent searches (launch a search, select an item in the list, and before it has finished downloading the preview launch another search).

Trace:
-----
(gdb) run
Starting program: /usr/local/bin/inkscape
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7fffdf0e9700 (LWP 6600)]
GLib (gthread-posix.c): Unexpected error from C library during 'pthread_setspecific': Argument invalide. Aborting.

Program received signal SIGABRT, Aborted.
[Switching to Thread 0x7fffdf0e9700 (LWP 6600)]
0x00007fffeee8b475 in raise () from /lib/x86_64-linux-gnu/libc.so.6
(gdb) bt
#0 0x00007fffeee8b475 in raise () from /lib/x86_64-linux-gnu/libc.so.6
#1 0x00007fffeee8e6f0 in abort () from /lib/x86_64-linux-gnu/libc.so.6
#2 0x00007fffefbbb143 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#3 0x00007fffefc24815 in g_private_set () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#4 0x00007ffff56952e3 in g_input_stream_read () from /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
#5 0x00007ffff567cd1a in ?? () from /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
#6 0x00007ffff568116f in g_file_copy () from /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
#7 0x00007ffff568198a in ?? () from /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
#8 0x00007ffff56967ae in ?? () from /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
#9 0x00007fffefc0b742 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#10 0x00007fffefc0af45 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#11 0x00007fffef1e9b50 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
#12 0x00007fffeef33a7d in clone () from /lib/x86_64-linux-gnu/libc.so.6
#13 0x0000000000000000 in ?? ()
-----

The console adds the following message (when launched without gdb):

[xcb] Unknown request in queue while dequeuing
[xcb] Most likely this is a multi-threaded client and XInitThreads has not been called
[xcb] Aborting, sorry about that.
inkscape: ../../src/xcb_io.c:179: dequeue_pending_request: Assertion `!xcb_xlib_unknown_req_in_deq' failed.
Aborted

Revision history for this message
jazzynico (jazzynico) wrote :

... on Crunchbang Waldorf (based on Debian Wheezy), Inkscape trunk revision 12397.

Revision history for this message
jazzynico (jazzynico) wrote :

Concurrent searches crash reported separately in Bug #1281104 (Open Clipart import dialog crashes with concurrent searches).
Closing the meta-report "fix committed".

Changed in inkscape:
status: In Progress → Fix Committed
jazzynico (jazzynico)
Changed in inkscape:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.