View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0007324ScribusGeneralpublic2008-08-28 18:482008-11-05 22:52
Reporterdvogel Assigned Tojghali  
PrioritynormalSeveritycrashReproducibilityalways
Status closedResolutionfixed 
PlatformWindowsOSWindowsOS VersionXP SP2
Product Version1.3.3.12 
Target Version1.3.3.13Fixed in Version1.3.3.13svn 
Summary0007324: crash when saving object to scrapbook
DescriptionI have a grouping of objects in my document that I want to save to my scrapbook. When I do, it causes Scribus to crash with the EXCEPTION_ACCESS_VIOLATION error message.
Steps To ReproduceOpen the attached file.
Left click on the third grouping of objects; it is labled 0000063.
Right click and choose Send to Scrapbook. The name does not matter.
You should get the EXCEPTION_ACCESS_VIOLATION crash.
Additional InformationAfter the program crashes, trying to reopen the problem results in the same crash, unless I delete the scrapbook file in:

C:\Documents and Settings\vogel\Application Data\Scribus\scrapbook\main\

This bug applies to 1.3.3.12 and 1.3.5svn.
TagsNo tags attached.
Patch

Activities

2008-08-28 18:48

 

example_for_EXCEPTION_ACCESS_VIOLATION.sla (273,314 bytes)

dvogel

2008-08-28 18:50

reporter   ~0020177

In the 1.3.3.12 case, the scrapbook file is in:

C:\Documents and Settings\vogel\.scribus\scrapbook\main\

dvogel

2008-08-28 21:59

reporter   ~0020178

Verified on Debian/unstable with Scribus 1.3.3.12. Here is a backtrace:

#0 0x000007b1 in ?? ()
0000001 0x08410cec in QPtrList<Page>::deleteItem (this=0x8be8b14, d=0x928af68)
    at /usr/share/qt3/include/qptrlist.h:153
0000002 0x4085871c in QGList::clear () from /usr/lib/libqt-mt.so.3
0000003 0x08410cff in QPtrList<Page>::clear (this=0x8be8b14) at /usr/share/qt3/include/qptrlist.h:96
0000004 0x083fa67e in ~ScribusDoc (this=0x8be8a28) at scribusdoc.cpp:322
0000005 0x08569aab in ScribusMainWindow::emergencySave (this=0x86780a0) at scribus.cpp:8667
0000006 0x085b64a6 in defaultCrashHandler (sig=11) at main_nix.cpp:126
0000007 <signal handler called>
0000008 0x081d66c2 in FPoint (this=0x7fb40d78, p=@0x9419ff8) at fpoint.h:39
0000009 0x083e1726 in ScPreview::createPreview (this=0x8e39578, data=
      {static null = {static null = <same as static member of an already seen type>, d = 0x86500c0, static shared_null = 0x86500c0}, d = 0x7fb4111c, static shared_null = 0x86500c0}) at scpreview.cpp:694
0000010 0x083ea27e in Biblio::ObjFromMenu (this=0x8aca110, text=
      {static null = {static null = <same as static member of an already seen type>, d = 0x86500c0, static shared_null = 0x86500c0}, d = 0x7fb4119c, static shared_null = 0x86500c0}) at scrap.cpp:671
0000011 0x0856af62 in ScribusMainWindow::PutScrap (this=0x86780a0) at scribus.cpp:8390
0000012 0x085a57c4 in ScribusMainWindow::qt_invoke (this=0x86780a0, _id=89, _o=0x7fb412c4) at scribus.moc:920
0000013 0x405adf6d in QObject::activate_signal () from /usr/lib/libqt-mt.so.3
0000014 0x405aeaed in QObject::activate_signal () from /usr/lib/libqt-mt.so.3
0000015 0x408f9829 in QAction::activated () from /usr/lib/libqt-mt.so.3
0000016 0x406e7ec0 in QAction::internalActivation () from /usr/lib/libqt-mt.so.3
0000017 0x408f9b46 in QAction::qt_invoke () from /usr/lib/libqt-mt.so.3
0000018 0x083e5059 in ScrAction::qt_invoke (this=0x86f8268, _id=8, _o=0x7fb413e4) at scraction.moc:211
0000019 0x405adf6d in QObject::activate_signal () from /usr/lib/libqt-mt.so.3
0000020 0x408d805e in QSignal::signal () from /usr/lib/libqt-mt.so.3
0000021 0x405c98c7 in QSignal::activate () from /usr/lib/libqt-mt.so.3
0000022 0x406aec2a in QPopupMenu::mouseReleaseEvent () from /usr/lib/libqt-mt.so.3
0000023 0x405e6554 in QWidget::event () from /usr/lib/libqt-mt.so.3
0000024 0x4055018a in QApplication::internalNotify () from /usr/lib/libqt-mt.so.3
0000025 0x405510ba in QApplication::notify () from /usr/lib/libqt-mt.so.3
0000026 0x404f006c in QETWidget::translateMouseEvent () from /usr/lib/libqt-mt.so.3
0000027 0x404eeafd in QApplication::x11ProcessEvent () from /usr/lib/libqt-mt.so.3
0000028 0x404fefe6 in QEventLoop::processEvents () from /usr/lib/libqt-mt.so.3
0000029 0x40566b80 in QEventLoop::enterLoop () from /usr/lib/libqt-mt.so.3
0000030 0x4054fc6f in QApplication::enter_loop () from /usr/lib/libqt-mt.so.3
0000031 0x406b2027 in QPopupMenu::exec () from /usr/lib/libqt-mt.so.3
0000032 0x08457e1c in ScribusView::contentsMouseReleaseEvent (this=0x8c54448, m=0x7fb43ba4) at scribusview.cpp:2193
0000033 0x406c0271 in QScrollView::viewportMouseReleaseEvent () from /usr/lib/libqt-mt.so.3
0000034 0x406be090 in QScrollView::eventFilter () from /usr/lib/libqt-mt.so.3
0000035 0x405ad78c in QObject::activate_filters () from /usr/lib/libqt-mt.so.3
0000036 0x405ad7fb in QObject::event () from /usr/lib/libqt-mt.so.3
0000037 0x405e643c in QWidget::event () from /usr/lib/libqt-mt.so.3
0000038 0x4055018a in QApplication::internalNotify () from /usr/lib/libqt-mt.so.3
0000039 0x405510ba in QApplication::notify () from /usr/lib/libqt-mt.so.3
0000040 0x404efa52 in QETWidget::translateMouseEvent () from /usr/lib/libqt-mt.so.3
0000041 0x404eeafd in QApplication::x11ProcessEvent () from /usr/lib/libqt-mt.so.3
0000042 0x404fefe6 in QEventLoop::processEvents () from /usr/lib/libqt-mt.so.3
0000043 0x40566b80 in QEventLoop::enterLoop () from /usr/lib/libqt-mt.so.3
0000044 0x40566a16 in QEventLoop::exec () from /usr/lib/libqt-mt.so.3
0000045 0x4054fcff in QApplication::exec () from /usr/lib/libqt-mt.so.3
0000046 0x085b6652 in mainApp (argc=1, argv=0x7fb444a4) at main_nix.cpp:74
0000047 0x085b6690 in main (argc=0, argv=0x0) at main_nix.cpp:50

Here is the parameter info for frame 0000001:
(gdb) fr 1
0000001 0x08410cec in QPtrList<Page>::deleteItem (this=0x8be8b14, d=0x928af68)
    at /usr/share/qt3/include/qptrlist.h:153
153 if ( del_item ) delete (type *)d;

dvogel

2008-08-28 22:54

reporter   ~0020179

If I set a breakpoint on line 676 in ScPreview::createPreview I can see the problem:

Breakpoint 1, ScPreview::createPreview (this=0x8be9c78, data=
      {static null = {static null = <same as static member of an already seen type>, d = 0x86500c0, static shared_null = 0x86500c0}, d = 0x7fb780dc, static shared_null = 0x86500c0}) at scpreview.cpp:676
676 for (uint n = 0; n < OB.PoLine.size()-3; n += 4)
(gdb) inspect n
$3 = 140837056
(gdb) inspect OB.PoLine.size()
$4 = 2

The loop assumes that a PolyLine will have at least 4 points. The attached file apparently demonstrates that this is not true. I don't know enough about the PolyLine implementation to know whether this loop needs to be changed or whether the PolyLine methods need to be changed to enforce the invariant.

I made the PolyLine mistakenly. I didn't even realize that it was there until I looked in the debugger and then at the code. The PolyLine is hidden behind the large gray block. It is extremely small.

jghali

2008-08-29 19:36

administrator   ~0020181

The way paths are constructed need 4 PoLine points per path points. So a path must have at least 4 PoLine points to be valid. We normally protect code against incorrect PoLine size. Protection was obviously missing here. Fixed in 1.3.3.13svn and 1.3.5svn!

Issue History

Date Modified Username Field Change
2008-08-28 18:48 dvogel New Issue
2008-08-28 18:48 dvogel File Added: example_for_EXCEPTION_ACCESS_VIOLATION.sla
2008-08-28 18:50 dvogel Note Added: 0020177
2008-08-28 18:53 jghali Product Version 1.3.5svn => 1.3.3.12
2008-08-28 18:53 jghali Additional Information Updated
2008-08-28 21:59 dvogel Note Added: 0020178
2008-08-28 22:54 dvogel Note Added: 0020179
2008-08-29 08:14 jghali Status new => confirmed
2008-08-29 08:14 jghali Target Version => 1.3.3.13
2008-08-29 19:36 jghali Note Added: 0020181
2008-08-29 19:36 jghali Status confirmed => resolved
2008-08-29 19:36 jghali Fixed in Version => 1.3.3.13svn
2008-08-29 19:36 jghali Resolution open => fixed
2008-08-29 19:36 jghali Assigned To => jghali
2008-08-29 20:43 jghali Summary EXCEPTION_ACCESS_VIOLATION When saving a grouping of objects to my scrapbook => crash when saving object to scrapbook
2008-11-05 22:52 jghali Status resolved => closed