View Issue Details

IDProjectCategoryView StatusLast Update
0007324ScribusGeneralpublic2008-11-05 22:52
Reporterdvogel Assigned Tojghali  
Status closedResolutionfixed 
PlatformWindowsOSWindowsOS VersionXP SP2
Product Version1.3.3.12 
Target Version1.3.3.13Fixed in Version1.3.3.13svn 
Summary0007324: crash when saving object to scrapbook
DescriptionI have a grouping of objects in my document that I want to save to my scrapbook. When I do, it causes Scribus to crash with the EXCEPTION_ACCESS_VIOLATION error message.
Steps To ReproduceOpen the attached file.
Left click on the third grouping of objects; it is labled 0000063.
Right click and choose Send to Scrapbook. The name does not matter.
You should get the EXCEPTION_ACCESS_VIOLATION crash.
Additional InformationAfter the program crashes, trying to reopen the problem results in the same crash, unless I delete the scrapbook file in:

C:\Documents and Settings\vogel\Application Data\Scribus\scrapbook\main\

This bug applies to and 1.3.5svn.
TagsNo tags attached.


2008-08-28 18:48


example_for_EXCEPTION_ACCESS_VIOLATION.sla (273,314 bytes)


2008-08-28 18:50

reporter   ~0020177

In the case, the scrapbook file is in:

C:\Documents and Settings\vogel\.scribus\scrapbook\main\


2008-08-28 21:59

reporter   ~0020178

Verified on Debian/unstable with Scribus Here is a backtrace:

#0 0x000007b1 in ?? ()
0000001 0x08410cec in QPtrList<Page>::deleteItem (this=0x8be8b14, d=0x928af68)
    at /usr/share/qt3/include/qptrlist.h:153
0000002 0x4085871c in QGList::clear () from /usr/lib/
0000003 0x08410cff in QPtrList<Page>::clear (this=0x8be8b14) at /usr/share/qt3/include/qptrlist.h:96
0000004 0x083fa67e in ~ScribusDoc (this=0x8be8a28) at scribusdoc.cpp:322
0000005 0x08569aab in ScribusMainWindow::emergencySave (this=0x86780a0) at scribus.cpp:8667
0000006 0x085b64a6 in defaultCrashHandler (sig=11) at main_nix.cpp:126
0000007 <signal handler called>
0000008 0x081d66c2 in FPoint (this=0x7fb40d78, p=@0x9419ff8) at fpoint.h:39
0000009 0x083e1726 in ScPreview::createPreview (this=0x8e39578, data=
      {static null = {static null = <same as static member of an already seen type>, d = 0x86500c0, static shared_null = 0x86500c0}, d = 0x7fb4111c, static shared_null = 0x86500c0}) at scpreview.cpp:694
0000010 0x083ea27e in Biblio::ObjFromMenu (this=0x8aca110, text=
      {static null = {static null = <same as static member of an already seen type>, d = 0x86500c0, static shared_null = 0x86500c0}, d = 0x7fb4119c, static shared_null = 0x86500c0}) at scrap.cpp:671
0000011 0x0856af62 in ScribusMainWindow::PutScrap (this=0x86780a0) at scribus.cpp:8390
0000012 0x085a57c4 in ScribusMainWindow::qt_invoke (this=0x86780a0, _id=89, _o=0x7fb412c4) at scribus.moc:920
0000013 0x405adf6d in QObject::activate_signal () from /usr/lib/
0000014 0x405aeaed in QObject::activate_signal () from /usr/lib/
0000015 0x408f9829 in QAction::activated () from /usr/lib/
0000016 0x406e7ec0 in QAction::internalActivation () from /usr/lib/
0000017 0x408f9b46 in QAction::qt_invoke () from /usr/lib/
0000018 0x083e5059 in ScrAction::qt_invoke (this=0x86f8268, _id=8, _o=0x7fb413e4) at scraction.moc:211
0000019 0x405adf6d in QObject::activate_signal () from /usr/lib/
0000020 0x408d805e in QSignal::signal () from /usr/lib/
0000021 0x405c98c7 in QSignal::activate () from /usr/lib/
0000022 0x406aec2a in QPopupMenu::mouseReleaseEvent () from /usr/lib/
0000023 0x405e6554 in QWidget::event () from /usr/lib/
0000024 0x4055018a in QApplication::internalNotify () from /usr/lib/
0000025 0x405510ba in QApplication::notify () from /usr/lib/
0000026 0x404f006c in QETWidget::translateMouseEvent () from /usr/lib/
0000027 0x404eeafd in QApplication::x11ProcessEvent () from /usr/lib/
0000028 0x404fefe6 in QEventLoop::processEvents () from /usr/lib/
0000029 0x40566b80 in QEventLoop::enterLoop () from /usr/lib/
0000030 0x4054fc6f in QApplication::enter_loop () from /usr/lib/
0000031 0x406b2027 in QPopupMenu::exec () from /usr/lib/
0000032 0x08457e1c in ScribusView::contentsMouseReleaseEvent (this=0x8c54448, m=0x7fb43ba4) at scribusview.cpp:2193
0000033 0x406c0271 in QScrollView::viewportMouseReleaseEvent () from /usr/lib/
0000034 0x406be090 in QScrollView::eventFilter () from /usr/lib/
0000035 0x405ad78c in QObject::activate_filters () from /usr/lib/
0000036 0x405ad7fb in QObject::event () from /usr/lib/
0000037 0x405e643c in QWidget::event () from /usr/lib/
0000038 0x4055018a in QApplication::internalNotify () from /usr/lib/
0000039 0x405510ba in QApplication::notify () from /usr/lib/
0000040 0x404efa52 in QETWidget::translateMouseEvent () from /usr/lib/
0000041 0x404eeafd in QApplication::x11ProcessEvent () from /usr/lib/
0000042 0x404fefe6 in QEventLoop::processEvents () from /usr/lib/
0000043 0x40566b80 in QEventLoop::enterLoop () from /usr/lib/
0000044 0x40566a16 in QEventLoop::exec () from /usr/lib/
0000045 0x4054fcff in QApplication::exec () from /usr/lib/
0000046 0x085b6652 in mainApp (argc=1, argv=0x7fb444a4) at main_nix.cpp:74
0000047 0x085b6690 in main (argc=0, argv=0x0) at main_nix.cpp:50

Here is the parameter info for frame 0000001:
(gdb) fr 1
0000001 0x08410cec in QPtrList<Page>::deleteItem (this=0x8be8b14, d=0x928af68)
    at /usr/share/qt3/include/qptrlist.h:153
153 if ( del_item ) delete (type *)d;


2008-08-28 22:54

reporter   ~0020179

If I set a breakpoint on line 676 in ScPreview::createPreview I can see the problem:

Breakpoint 1, ScPreview::createPreview (this=0x8be9c78, data=
      {static null = {static null = <same as static member of an already seen type>, d = 0x86500c0, static shared_null = 0x86500c0}, d = 0x7fb780dc, static shared_null = 0x86500c0}) at scpreview.cpp:676
676 for (uint n = 0; n < OB.PoLine.size()-3; n += 4)
(gdb) inspect n
$3 = 140837056
(gdb) inspect OB.PoLine.size()
$4 = 2

The loop assumes that a PolyLine will have at least 4 points. The attached file apparently demonstrates that this is not true. I don't know enough about the PolyLine implementation to know whether this loop needs to be changed or whether the PolyLine methods need to be changed to enforce the invariant.

I made the PolyLine mistakenly. I didn't even realize that it was there until I looked in the debugger and then at the code. The PolyLine is hidden behind the large gray block. It is extremely small.


2008-08-29 19:36

administrator   ~0020181

The way paths are constructed need 4 PoLine points per path points. So a path must have at least 4 PoLine points to be valid. We normally protect code against incorrect PoLine size. Protection was obviously missing here. Fixed in and 1.3.5svn!

Issue History

Date Modified Username Field Change
2008-08-28 18:48 dvogel New Issue
2008-08-28 18:48 dvogel File Added: example_for_EXCEPTION_ACCESS_VIOLATION.sla
2008-08-28 18:50 dvogel Note Added: 0020177
2008-08-28 18:53 jghali Product Version 1.3.5svn =>
2008-08-28 18:53 jghali Additional Information Updated
2008-08-28 21:59 dvogel Note Added: 0020178
2008-08-28 22:54 dvogel Note Added: 0020179
2008-08-29 08:14 jghali Status new => confirmed
2008-08-29 08:14 jghali Target Version =>
2008-08-29 19:36 jghali Note Added: 0020181
2008-08-29 19:36 jghali Status confirmed => resolved
2008-08-29 19:36 jghali Fixed in Version =>
2008-08-29 19:36 jghali Resolution open => fixed
2008-08-29 19:36 jghali Assigned To => jghali
2008-08-29 20:43 jghali Summary EXCEPTION_ACCESS_VIOLATION When saving a grouping of objects to my scrapbook => crash when saving object to scrapbook
2008-11-05 22:52 jghali Status resolved => closed