View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0012595ScribusShape Drawingpublic2014-08-09 16:402014-10-10 22:30
ReporterFirasH Assigned Tocbradney  
PrioritynormalSeverityblockReproducibilityalways
Status closedResolutionfixed 
Platformx86_64OSopenSUSEOS Version13.1
Product Version1.5.0svn 
Target Version1.5.0Fixed in Version1.5.0svn 
Summary0012595: [PATCH] Nodes tools might crash Scribus moving item between Layers
DescriptionNodes tools might crash Scribus using moving item between Layers.
Steps To Reproduce0) Create a new document
1) Insert a Shape on Canvas
2) Double-click on the Shape so that "Nodes" window appears
3) Go to: Item > Send to Layer > "Background"
You can notice that "Nodes" window is opened and the Shape is not in "edit nodes" mode.

4) Select the tool to add or delete nodes
5) Click a few times on Canvas (slowly, otherwise "Nodes" window will close)

Scribus crashes due to Signal 11
Additional InformationIssue present on:
1.4.5.svn (19402)
1.5.0.svn (19415)


Program received signal SIGSEGV, Segmentation fault.
0x00000000009cc5c9 in PageItem::getCombinedTransform (this=0x0) at /home/.../Scribus/scribus/pageitem.cpp:8851
8851 if (isGroupChild())
(gdb) bt
#0 0x00000000009cc5c9 in PageItem::getCombinedTransform (this=0x0)
    at /home/.../Scribus/scribus/pageitem.cpp:8851
0000001 0x00000000009cc5a1 in PageItem::getTransform (this=0x0)
    at /home/.../Scribus/scribus/pageitem.cpp:8845
0000002 0x00000000008bf4d4 in CanvasMode_NodeEdit::activate (this=0x2fba1c0, fromGesture=true)
    at /home/.../Scribus/scribus/canvasmode_nodeedit.cpp:183
0000003 0x0000000000d9bf42 in ScribusView::stopGesture (this=0x3424110)
    at /home/.../Scribus/scribus/scribusview.cpp:416
0000004 0x000000000084b2e6 in RectSelect::mouseReleaseEvent (this=0x3204f30, m=0x7fffffffcde0)
    at /home/.../Scribus/scribus/canvasgesture_rectselect.cpp:97
0000005 0x0000000000db7507 in ScribusView::eventFilter (this=0x3424110, obj=0x344dd40, event=0x7fffffffcde0)
    at /home/.../Scribus/scribus/scribusview.cpp:4007
0000006 0x00007ffff7659173 in QCoreApplicationPrivate::sendThroughObjectEventFilters(QObject*, QEvent*) ()
   from /home/.../Qt/5.3/gcc_64/lib/libQt5Core.so.5
0000007 0x00007ffff6c8da5f in QApplicationPrivate::notify_helper(QObject*, QEvent*) ()
   from /home/.../Qt/5.3/gcc_64/lib/libQt5Widgets.so.5
0000008 0x00007ffff6c90e8c in QApplication::notify(QObject*, QEvent*) ()
   from /home/.../Qt/5.3/gcc_64/lib/libQt5Widgets.so.5
0000009 0x00007ffff7658f04 in QCoreApplication::notifyInternal(QObject*, QEvent*) ()
   from /home/.../Qt/5.3/gcc_64/lib/libQt5Core.so.5
0000010 0x00007ffff6c8fffa in QApplicationPrivate::sendMouseEvent(QWidget*, QMouseEvent*, QWidget*, QWidget*, QWidget**, QPointer<QWidget>&, bool) ()
   from /home/.../Qt/5.3/gcc_64/lib/libQt5Widgets.so.5
0000011 0x00007ffff6ce5e87 in ?? ()
   from /home/.../Qt/5.3/gcc_64/lib/libQt5Widgets.so.5
0000012 0x00007ffff6ce89d8 in ?? ()
   from /home/.../Qt/5.3/gcc_64/lib/libQt5Widgets.so.5
0000013 0x00007ffff6c8da94 in QApplicationPrivate::notify_helper(QObject*, QEvent*) ()
   from /home/.../Qt/5.3/gcc_64/lib/libQt5Widgets.so.5
0000014 0x00007ffff6c910b6 in QApplication::notify(QObject*, QEvent*) ()
   from /home/.../Qt/5.3/gcc_64/lib/libQt5Widgets.so.5
0000015 0x00007ffff7658f04 in QCoreApplication::notifyInternal(QObject*, QEvent*) ()
   from /home/.../Qt/5.3/gcc_64/lib/libQt5Core.so.5
0000016 0x00007ffff650c537 in QGuiApplicationPrivate::processMouseEvent(QWindowSystemInterfacePrivate::MouseEvent*) ()
   from /home/.../Qt/5.3/gcc_64/lib/libQt5Gui.so.5
0000017 0x00007ffff650cf75 in QGuiApplicationPrivate::processWindowSystemEvent(QWindowSystemInterfacePrivate::WindowSystemEvent*) ()
   from /home/.../Qt/5.3/gcc_64/lib/libQt5Gui.so.5
0000018 0x00007ffff64f2208 in QWindowSystemInterface::sendWindowSystemEvents(QFlags<QEventLoop::ProcessEventsFlag>) ()
   from /home/.../Qt/5.3/gcc_64/lib/libQt5Gui.so.5
0000019 0x00007fffe548c460 in ?? ()
   from /home/.../Qt/5.3/gcc_64/plugins/platforms/libqxcb.so
0000020 0x00007fffecddd316 in g_main_dispatch (context=0x7fffe0001740)
    at gmain.c:3066
0000021 g_main_context_dispatch (context=context@entry=0x7fffe0001740)
    at gmain.c:3642
0000022 0x00007fffecddd668 in g_main_context_iterate (context=context@entry=0x7fffe0001740, block=block@entry=1,
    dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3713
0000023 0x00007fffecddd70c in g_main_context_iteration (context=0x7fffe0001740, may_block=1)
    at gmain.c:3774
0000024 0x00007ffff76b3574 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) ()
   from /home/.../Qt/5.3/gcc_64/lib/libQt5Core.so.5
0000025 0x00007ffff765711b in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) ()
   from /home/.../Qt/5.3/gcc_64/lib/libQt5Core.so.5
0000026 0x00007ffff765bfe5 in QCoreApplication::exec() ()
   from /home/.../Qt/5.3/gcc_64/lib/libQt5Core.so.5
0000027 0x000000000124167c in mainApp (argc=1, argv=0x7fffffffdd18)
    at /home/.../Scribus/scribus/main_nix.cpp:86
0000028 0x000000000124160c in main (argc=1, argv=0x7fffffffdd18)
    at /home/.../Scribus/scribus/main_nix.cpp:54
TagsNo tags attached.
Patch

Relationships

related to 0012608 closed Delete Bezier node --> Crash 

Activities

Kunda

2014-08-10 10:33

updater   ~0033220

Attempted several times to reproduce on OSX 10.8.5 1.5svn r19415 without any success
Step 5 doesn't trigger crash, AFAICT

FirasH

2014-08-10 10:57

reporter   ~0033222

Here is a screencast:
https://www.dropbox.com/s/2jt8t147hk09gfe/12595.mp4

Reproduced on FreeBSD and openSUSE.

gpittman

2014-09-04 23:35

developer   ~0033507

this looks like searching for ways to make Scribus crash.
When you open the Edit Shapes dialog, you should edit, then close the dialog, then perform other operations like moving a shape to another layer.

This is just common sense.

Kunda

2014-09-04 23:46

updater   ~0033508

"this looks like searching for ways to make Scribus crash."
gpittman, that's what QA testing is :)

Common sense is not as common as one would think. Especially with a complex DTP.

IMHO, I think searching for ways to make scribus crash makes it more bullet-proof application. In the process it can fix potentially dormant bugs.

ale

2014-09-05 07:49

manager   ~0033514

i (mostly) agree with kunda here.
(the "mostly" part only concerns my opinion on whether we can require common sense from somebody using a complex app :-)

even if this report might seem pointless, it has a point: one or both of the layer and the edit shape dialog is implemented in a way that is not correct and that's why you see this crash.

how do you know that this is not the source of more obscure bugs that happen to you in a unexpected and not reproducible way?

of course, the solution to this ticket should not lead to a hack that avoids this specific bug (which is indeed mostly pointless). we should improve one or both tools in a way that eliminates the possibility of this kind of bugs.

owencook

2014-09-06 08:04

reporter   ~0033540

It wasn't easy to do, but eventually reproduced it with Revision 19482 and Qt-5.1.1


Program received signal SIGSEGV, Segmentation fault.
0x08413d16 in PageItem::getCombinedTransform() const ()
(gdb) bt
#0 0x08413d16 in PageItem::getCombinedTransform() const ()
0000001 0x08414109 in PageItem::getTransform() const ()
0000002 0x0831f286 in CanvasMode_NodeEdit::activate(bool) ()
0000003 0x0880df84 in ScribusView::stopGesture() ()
0000004 0x082ba1c8 in RectSelect::mouseReleaseEvent(QMouseEvent*) ()
0000005 0x08827b88 in ScribusView::eventFilter(QObject*, QEvent*) ()
0000006 0xb7c5699c in QCoreApplicationPrivate::sendThroughObjectEventFilters(QObject*, QEvent*) ()
   from /usr/lib/i386-linux-gnu/libQt5Core.so.5
0000007 0xb74fd5b1 in QApplicationPrivate::notify_helper(QObject*, QEvent*) ()
   from /usr/lib/i386-linux-gnu/libQt5Widgets.so.5
0000008 0xb7503d5c in QApplication::notify(QObject*, QEvent*) () from /usr/lib/i386-linux-gnu/libQt5Widgets.so.5
0000009 0xb7c5677a in QCoreApplication::notifyInternal(QObject*, QEvent*) () from /usr/lib/i386-linux-gnu/libQt5Core.so.5
0000010 0xb7501791 in QApplicationPrivate::sendMouseEvent(QWidget*, QMouseEvent*, QWidget*, QWidget*, QWidget**, QPointer<QWidget>&, bool) () from /usr/lib/i386-linux-gnu/libQt5Widgets.so.5
0000011 0xb755e25b in ?? () from /usr/lib/i386-linux-gnu/libQt5Widgets.so.5
0000012 0xb7560c5c in ?? () from /usr/lib/i386-linux-gnu/libQt5Widgets.so.5
0000013 0xb74fd5d4 in QApplicationPrivate::notify_helper(QObject*, QEvent*) ()
   from /usr/lib/i386-linux-gnu/libQt5Widgets.so.5
0000014 0xb7502ee9 in QApplication::notify(QObject*, QEvent*) () from /usr/lib/i386-linux-gnu/libQt5Widgets.so.5
0000015 0xb7c5677a in QCoreApplication::notifyInternal(QObject*, QEvent*) () from /usr/lib/i386-linux-gnu/libQt5Core.so.5
0000016 0xb70a97c1 in QGuiApplicationPrivate::processMouseEvent(QWindowSystemInterfacePrivate::MouseEvent*) ()
   from /usr/lib/i386-linux-gnu/libQt5Gui.so.5
0000017 0xb70ab6a8 in QGuiApplicationPrivate::processWindowSystemEvent(QWindowSystemInterfacePrivate::WindowSystemEvent*) ()

william

2014-09-07 01:36

updater  

scribus15-20140907-032711-shape.pat (1,097 bytes)

william

2014-09-07 01:41

updater   ~0033557

Can you try the attached patch?

canvasmode_nodeedit.cpp had a few places where it used PageItem* currItem returned by m_doc->m_Selection->itemAt(0) without checking first that m_doc->m_Selection->count() was not 0.
When it called member functions through currItem->, they had a NULL this, and that is why the crash eventually happened in a PageItem member function.

This patch might also help the node deletion problem in http://bugs.scribus.net/view.php?id=12608

ale

2014-09-07 20:51

manager   ~0033565

thanks william!

while checking that you don't work on a null item it's for sure something sane, imo the goal should be that curritem cannot be changed while somebody is using the nodes tool.

what do you (plural) think?

william

2014-09-07 21:23

updater   ~0033566

I don't have a strong opinion.
Preventing users from changing the current item when the node tool is open could be a lot of work. Aren't there many commands that can change the current item?

Kunda

2014-09-11 13:41

updater   ~0033623

I'm for fixing the issue so that it not trigger other bugs in the future :)
But that's easy for me to say since I don't code.

cbradney

2014-10-10 21:19

administrator   ~0033969

This has already been fixed in appmodehelper previously, however I am adding disabling the level changing actions as well.

FirasH

2014-10-10 22:30

reporter   ~0033970

Perfect, thanks cbradney!

Issue History

Date Modified Username Field Change
2014-08-09 16:40 FirasH New Issue
2014-08-09 20:31 FirasH Steps to Reproduce Updated
2014-08-09 20:32 FirasH Summary Nodes tools might crash Scribus using more Layers => Nodes tools might crash Scribus moving item between Layers
2014-08-09 20:32 FirasH Description Updated
2014-08-10 10:33 Kunda Note Added: 0033220
2014-08-10 10:33 Kunda Status new => feedback
2014-08-10 10:57 FirasH Note Added: 0033222
2014-08-10 10:57 FirasH Status feedback => new
2014-08-10 13:46 Kunda Status new => confirmed
2014-08-10 13:46 Kunda Target Version => 1.5.0
2014-09-04 23:35 gpittman Note Added: 0033507
2014-09-04 23:46 Kunda Note Added: 0033508
2014-09-05 07:49 ale Note Added: 0033514
2014-09-06 08:04 owencook Note Added: 0033540
2014-09-07 01:36 william File Added: scribus15-20140907-032711-shape.pat
2014-09-07 01:41 william Note Added: 0033557
2014-09-07 01:50 FirasH Relationship added related to 0012608
2014-09-07 01:50 FirasH Summary Nodes tools might crash Scribus moving item between Layers => [PATCH] Nodes tools might crash Scribus moving item between Layers
2014-09-07 20:51 ale Note Added: 0033565
2014-09-07 21:23 william Note Added: 0033566
2014-09-11 02:25 Kunda Severity crash => block
2014-09-11 13:41 Kunda Note Added: 0033623
2014-10-10 21:19 cbradney Note Added: 0033969
2014-10-10 21:19 cbradney Status confirmed => resolved
2014-10-10 21:19 cbradney Fixed in Version => 1.5.0svn
2014-10-10 21:19 cbradney Resolution open => fixed
2014-10-10 21:19 cbradney Assigned To => cbradney
2014-10-10 22:30 FirasH Note Added: 0033970
2014-10-10 22:30 FirasH Status resolved => closed