Bug 1575842

Summary: Inkscape crashes when hitting ENTER on text input
Product: [Fedora] Fedora Reporter: Sebastian Köhler <snkr>
Component: inkscapeAssignee: Gwyn Ciesla <gwync>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 28CC: adam.matejko, aviskase, christianbueno.1, dave, dpntldvc, duffy, euan, fabian.g.droege, flaviusglamfenix, gwync, james, jonathan.underwood, LaKing, lkundrak, martin, mathieu, mcardinot, moneta.mace, penguin.wrangler, plazaga, rlerch, schlaffi, seb, smrtsmart, snkr, stoet, tom.bamford, toon.verstraelen
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: inkscape-0.92.3-2.fc28 inkscape-0.92.3-2.fc27 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1612618 (view as bug list) Environment:
Last Closed: 2018-06-29 08:43:18 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Sebastian Köhler 2018-05-08 05:35:19 UTC
Description of problem:
Inkscape crashes on hitting ENTER using Text Tool




Version-Release number of selected component (if applicable):
Inkscape 0.92.3 (2405546, 2018-03-11)




Steps to Reproduce:

1) Open new document
2) Select Text Tool (F8)
3) Click on empty canvas
4) Hit ENTER





Actual results:

Inkscape crashes





Expected results:

Create a new line on hitting ENTER



Additional info:

See also:
https://bugs.launchpad.net/inkscape/+bug/1768958

Terminal output:

/usr/include/c++/8/bits/stl_vector.h:950: std::vector<_Tp, _Alloc>::const_reference std::vector<_Tp, _Alloc>::operator[](std::vector<_Tp, _Alloc>::size_type) const [with _Tp = Inkscape::Text::Layout::Character; _Alloc = std::allocator<Inkscape::Text::Layout::Character>; std::vector<_Tp, _Alloc>::const_reference = const Inkscape::Text::Layout::Character&; std::vector<_Tp, _Alloc>::size_type = long unsigned int]: Assertion '__builtin_expect(__n < this->size(), true)' failed.

Emergency save activated!

Emergency save document locations:
  /home/user/New document 1.2018_05_03_21_36_49.0.svg
Emergency save completed. Inkscape will close now.
If you can reproduce this crash, please file a bug at www.inkscape.org
with a detailed description of the steps leading to the crash, so we can fix it.
/usr/include/c++/8/bits/stl_vector.h:950: std::vector<_Tp, _Alloc>::const_reference std::vector<_Tp, _Alloc>::operator[](std::vector<_Tp, _Alloc>::size_type) const [with _Tp = Inkscape::Text::Layout::Character; _Alloc = std::allocator<Inkscape::Text::Layout::Character>; std::vector<_Tp, _Alloc>::const_reference = const Inkscape::Text::Layout::Character&; std::vector<_Tp, _Alloc>::size_type = long unsigned int]: Assertion '__builtin_expect(__n < this->size(), true)' failed.
Aborted (core dumped)

Comment 1 Toon Verstraelen 2018-05-08 06:18:46 UTC
Here is a similar bug report, probably same issue, with example SVG files. The file test.svg crashes Inkscape upon opening the file.

Comment 2 Toon Verstraelen 2018-05-08 06:19:09 UTC
https://bugs.launchpad.net/inkscape/+bug/1769662

Comment 3 Sebastian Köhler 2018-05-08 06:27:57 UTC
(In reply to Toon Verstraelen from comment #2)
> https://bugs.launchpad.net/inkscape/+bug/1769662

Yes, that seems to be the same bug. I initially stumbled on it because some of my files would crash Inkscape when opening. They all had text objects. 

The problem seems to be the line break in a regular text object. The "flow text" in Inkscape is not affected though.

And apparently the bug cannot be reproduced in current versions for Windows or other distros. IIRC I also didn't have this problem in 27 and Inkscape version 0.92.3, so something has changed in Fedora 28.

Comment 4 Euan de Kock 2018-05-11 04:16:44 UTC
I'm also experiencing this - only after the Fedora 28 upgrade. I've tried:

1: Changing my LANG settings.
2: Cut and pasting the text rather than entering it.
3: Manually modifying the text in the auto-saved file to add a newline.

All still crash - 3 crashes on opening the file.

inkscape 
/usr/include/c++/8/bits/stl_vector.h:950: std::vector<_Tp, _Alloc>::const_reference std::vector<_Tp, _Alloc>::operator[](std::vector<_Tp, _Alloc>::size_type) const [with _Tp = Inkscape::Text::Layout::Character; _Alloc = std::allocator<Inkscape::Text::Layout::Character>; std::vector<_Tp, _Alloc>::const_reference = const Inkscape::Text::Layout::Character&; std::vector<_Tp, _Alloc>::size_type = long unsigned int]: Assertion '__builtin_expect(__n < this->size(), true)' failed.

Emergency save activated!

Emergency save document locations:
  /home/euan/New document 1.2018_05_11_12_14_06.0.svg
Emergency save completed. Inkscape will close now.
If you can reproduce this crash, please file a bug at www.inkscape.org
with a detailed description of the steps leading to the crash, so we can fix it.
/usr/include/c++/8/bits/stl_vector.h:950: std::vector<_Tp, _Alloc>::const_reference std::vector<_Tp, _Alloc>::operator[](std::vector<_Tp, _Alloc>::size_type) const [with _Tp = Inkscape::Text::Layout::Character; _Alloc = std::allocator<Inkscape::Text::Layout::Character>; std::vector<_Tp, _Alloc>::const_reference = const Inkscape::Text::Layout::Character&; std::vector<_Tp, _Alloc>::size_type = long unsigned int]: Assertion '__builtin_expect(__n < this->size(), true)' failed.
Aborted (core dumped)



[euan@asus ~]$ vi New\ document\ 1.2018_05_11_12_14_06.0.svg 
[euan@asus ~]$ inkscape New\ document\ 1.2018_05_11_12_14_06.0.svg 
/usr/include/c++/8/bits/stl_vector.h:950: std::vector<_Tp, _Alloc>::const_reference std::vector<_Tp, _Alloc>::operator[](std::vector<_Tp, _Alloc>::size_type) const [with _Tp = Inkscape::Text::Layout::Character; _Alloc = std::allocator<Inkscape::Text::Layout::Character>; std::vector<_Tp, _Alloc>::const_reference = const Inkscape::Text::Layout::Character&; std::vector<_Tp, _Alloc>::size_type = long unsigned int]: Assertion '__builtin_expect(__n < this->size(), true)' failed.

Emergency save activated!
Emergency save completed. Inkscape will close now.
If you can reproduce this crash, please file a bug at www.inkscape.org
with a detailed description of the steps leading to the crash, so we can fix it.
Aborted (core dumped)

Comment 5 Euan de Kock 2018-05-11 04:52:59 UTC
I downgraded to an earlier RPM from here:

https://fedora.pkgs.org/28/fedora-x86_64/inkscape-0.92.2-6.fc28.x86_64.rpm.html

This version also crashes with the same error.

Comment 6 Sebastian Köhler 2018-05-11 05:34:42 UTC
(In reply to Euan de Kock from comment #5)
> I downgraded to an earlier RPM from here:
> 
> https://fedora.pkgs.org/28/fedora-x86_64/inkscape-0.92.2-6.fc28.x86_64.rpm.
> html
> 
> This version also crashes with the same error.

I can confirm.

This is probably not an Inkscape bug, but a bug introduced with fedora 28. Some Inkscape dependency triggers this.

Comment 7 noraef 2018-05-14 19:55:07 UTC
Damn... there's text in about everything I do with Inkscape. And I use Inkscape a lot...

Also noticed it crashes in the same fashion on pre-F28 documents (with text inside) if I just select a mere rectangle, and try to shift the thickness unit from mm to px, for instance. Doesn't do it if I create a new document without text, and do the same unit thing to a rectangle object.

Comment 8 Martin 2018-05-24 09:35:59 UTC
Workaround that works for me: past text in new doc-> save as-> change object to path -> crl-shift-g -> adjust if necessary-> crtl+g->save. No problems anymore. Something seems to be wrong in connect with fonts.(???)

Comment 9 noraef 2018-05-24 14:33:29 UTC
(In reply to Martin from comment #8)
> Workaround that works for me: past text in new doc-> save as-> change object
> to path -> crl-shift-g -> adjust if necessary-> crtl+g->save. No problems
> anymore. Something seems to be wrong in connect with fonts.(???)

Pasting text containing a newline doesn't work: Inkscape crashes right from the moment you paste text. On already existing documents, copying a tex object including a newline, then pasting it, also makes Inkscape crash.

As said above, it also crashes if I try to switch the thickness unit from a rectangle from mm to px. I noticed it only does it on pre-F28 documents, but not on new ones, though.

It's quite annoying as it makes Inkscape totally unusable to me. And it only gets worse because of the crash analysis tool ABRT which also is completely botched up and maxes CPU for a few seconds before puking tons of selinux alerts (though it's a completely separate problem).

Comment 10 schlaffi 2018-05-24 16:50:46 UTC
Is anyone on this? This is really an important piece of software to me and it is broken just by the 27->28 switch.

Why std::vector::operator[] range checking? Since libqalculate had a similar problem, is it that Fedora enabled some extra range checks? Would be an option to just compile without that extra hardening (apart from ideological concerns)?

Comment 11 Fabian Dröge 2018-05-24 17:32:32 UTC
I experience these issues using the dnf version of Inkscape (both 0.92.2 and 0.92.3 on F28, MacBookPro12,1) as well. The snap version (0.92.3) however is working just fine for me without said problem. This might serve as a temporary workaround.

Comment 12 Jillian Morgan 2018-06-16 17:34:45 UTC
This patch resolved the issue for me:

--- src/libnrtype/Layout-TNG-OutIter.cpp~       2018-03-11 16:38:09.000000000 -0400
+++ src/libnrtype/Layout-TNG-OutIter.cpp        2018-06-16 13:17:03.129605681 -0400
@@ -182,6 +182,8 @@
     if (_input_stream[source_index]->Type() != TEXT_SOURCE)
         return iterator(this, char_index);

+    if (char_index >= _characters.size())
+        return end();
     return iterator(this, char_index);
     /* This code was never used, the text_iterator argument was "NULL" in all calling code
     InputStreamTextSource const *text_source = static_cast<InputStreamTextSource const *>(_input_stream[source_index]);

Comment 13 LaKing 2018-06-17 22:37:07 UTC
As of June 18, there is no fix in the fedora repos.

Comment 14 Euan de Kock 2018-06-27 13:32:06 UTC
Is there anything happening with this? - I am surprised that such an important piece of software is being left unresolved for so long.

The versions available in Snap and in Flatpak both work, so this is clearly an issue with the RPM version.

Comment 15 Gwyn Ciesla 2018-06-27 14:51:02 UTC
My apologies for the delay, I've been extremely busy. I will get this out today.

Comment 16 Fedora Update System 2018-06-27 17:09:54 UTC
inkscape-0.92.3-2.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-98ff255c49

Comment 17 Fedora Update System 2018-06-27 17:10:12 UTC
inkscape-0.92.3-2.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-803fe43b00

Comment 18 Fedora Update System 2018-06-28 12:32:42 UTC
inkscape-0.92.3-2.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-803fe43b00

Comment 19 Fedora Update System 2018-06-28 15:04:42 UTC
inkscape-0.92.3-2.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-98ff255c49

Comment 20 Fedora Update System 2018-06-29 08:43:18 UTC
inkscape-0.92.3-2.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.

Comment 21 Euan de Kock 2018-06-30 16:43:04 UTC
Thanks for working on this, I have now upgraded to the new RPM version.

inkscape-0.92.3-2.fc28.x86_64.rpm

However this is still causing errors with the text box. To recreate it follow the
steps below:

1: Open a new Inkscape Document.
2: Press F8 to select the text tool, and create a new text box
3: Fill the box with a single newline
4: Using the cursor keys press the UP arrow to navigate to the top row
5: Press the DOWN arrow to go back to the second line - Inkscape will crash.

The error reported now is:

/usr/include/c++/8/bits/stl_vector.h:950: std::vector<_Tp, _Alloc>::const_reference std::vector<_Tp, _Alloc>::operator[](std::vector<_Tp, _Alloc>::size_type) const [with _Tp = Inkscape::Text::Layout::Character; _Alloc = std::allocator<Inkscape::Text::Layout::Character>; std::vector<_Tp, _Alloc>::const_reference = const Inkscape::Text::Layout::Character&; std::vector<_Tp, _Alloc>::size_type = long unsigned int]: Assertion '__builtin_expect(__n < this->size(), true)' failed.

Comment 22 flaviusglamfenix 2018-07-01 16:36:53 UTC
Thanks for update. 

inkscape.x86_64 0.92.3-2.fc28

Pressing ENTER key is not cause a crash anymore, but there is related issue. 

Steps to reproduce:
1. Create Text;
2. Type some multiline text;
3. Try to highlight some text with mouse;

And here is error text.
/usr/include/c++/8/bits/stl_vector.h:950: std::vector<_Tp, _Alloc>::const_reference std::vector<_Tp, _Alloc>::operator[](std::vector<_Tp, _Alloc>::size_type) const [with _Tp = Inkscape::Text::Layout::Character; _Alloc = std::allocator<Inkscape::Text::Layout::Character>; std::vector<_Tp, _Alloc>::const_reference = const Inkscape::Text::Layout::Character&; std::vector<_Tp, _Alloc>::size_type = long unsigned int]: Assertion '__builtin_expect(__n < this->size(), true)' failed.

Comment 23 Fedora Update System 2018-07-06 15:44:39 UTC
inkscape-0.92.3-2.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.

Comment 24 flaviusglamfenix 2018-07-06 21:32:16 UTC
Defect is reproducible with the same error if select one part of the text and then try to select another part. 

inkscape.x86_64  0.92.3-2.fc28

Comment 25 christianbueno 2018-08-22 17:32:34 UTC
The problem persist,:
 - Inkscape-0.92.3-2.fc28 from official fedora repository( source=fedoraproject.org).
 - Fedora workstation 28

Comment 26 Paul Lazaga 2018-10-04 19:43:50 UTC
(In reply to flaviusglamfenix from comment #22)
> Thanks for update. 
> 
> inkscape.x86_64 0.92.3-2.fc28
> 
> Pressing ENTER key is not cause a crash anymore, but there is related issue. 
> 
> Steps to reproduce:
> 1. Create Text;
> 2. Type some multiline text;
> 3. Try to highlight some text with mouse;
> 
> And here is error text.
> /usr/include/c++/8/bits/stl_vector.h:950: std::vector<_Tp,
> _Alloc>::const_reference std::vector<_Tp,
> _Alloc>::operator[](std::vector<_Tp, _Alloc>::size_type) const [with _Tp =
> Inkscape::Text::Layout::Character; _Alloc =
> std::allocator<Inkscape::Text::Layout::Character>; std::vector<_Tp,
> _Alloc>::const_reference = const Inkscape::Text::Layout::Character&;
> std::vector<_Tp, _Alloc>::size_type = long unsigned int]: Assertion
> '__builtin_expect(__n < this->size(), true)' failed.

I run into this error on my laptop with AMD Radeon using default driver, but not on my desktop with Nvidia using Nvidia driver.

Comment 27 Paul Lazaga 2018-10-05 05:08:12 UTC
(In reply to Paul Lazaga from comment #26)
> (In reply to flaviusglamfenix from comment #22)
> > Thanks for update. 
> > 
> > inkscape.x86_64 0.92.3-2.fc28
> > 
> > Pressing ENTER key is not cause a crash anymore, but there is related issue. 
> > 
> > Steps to reproduce:
> > 1. Create Text;
> > 2. Type some multiline text;
> > 3. Try to highlight some text with mouse;
> > 
> > And here is error text.
> > /usr/include/c++/8/bits/stl_vector.h:950: std::vector<_Tp,
> > _Alloc>::const_reference std::vector<_Tp,
> > _Alloc>::operator[](std::vector<_Tp, _Alloc>::size_type) const [with _Tp =
> > Inkscape::Text::Layout::Character; _Alloc =
> > std::allocator<Inkscape::Text::Layout::Character>; std::vector<_Tp,
> > _Alloc>::const_reference = const Inkscape::Text::Layout::Character&;
> > std::vector<_Tp, _Alloc>::size_type = long unsigned int]: Assertion
> > '__builtin_expect(__n < this->size(), true)' failed.
> 
> I run into this error on my laptop with AMD Radeon using default driver, but
> not on my desktop with Nvidia using Nvidia driver.

Ok, I take that back, the error exists on both systems.

Comment 28 tom.bamford 2018-11-14 11:42:24 UTC
Still seeing this error on F29 - version: inkscape-0.92.3-5.fc29

Comment 29 Gilbert 2018-11-17 12:54:40 UTC
Still seeting this on Fedora 29 with a fully upgraded system:

inkscape --version: Inkscape 0.92.3 (2405546, 2018-03-11)

Inkscape is superimportant to me. This keeps me from working with Inkscape! 

It does not happen with flatpak, but the problem with the flatpak (etc) packages is that they often are not completely working (e.g., not supporting gvfs, etc).

It would be nice if it would be easier if there were at least instructions on how to compile inkscape the same way that Fedora compiles it (with GVFS support).

Comment 30 Adam Matejko 2018-11-21 13:28:13 UTC
Fedora 29 / Inkscape 0.92.3 (2405546, 2018-03-11)

Error when selecting text:

/usr/include/c++/8/bits/stl_vector.h:950: std::vector<_Tp, _Alloc>::const_reference std::vector<_Tp, _Alloc>::operator[](std::vector<_Tp, _Alloc>::size_type) const [with _Tp = Inkscape::Text::Layout::Character; _Alloc = std::allocator<Inkscape::Text::Layout::Character>; std::vector<_Tp, _Alloc>::const_reference = const Inkscape::Text::Layout::Character&; std::vector<_Tp, _Alloc>::size_type = long unsigned int]: Assertion '__builtin_expect(__n < this->size(), true)' failed.

Emergency save activated!
Emergency save completed. Inkscape will close now.
If you can reproduce this crash, please file a bug at www.inkscape.org
with a detailed description of the steps leading to the crash, so we can fix it.
/usr/include/c++/8/bits/stl_vector.h:950: std::vector<_Tp, _Alloc>::const_reference std::vector<_Tp, _Alloc>::operator[](std::vector<_Tp, _Alloc>::size_type) const [with _Tp = Inkscape::Text::Layout::Character; _Alloc = std::allocator<Inkscape::Text::Layout::Character>; std::vector<_Tp, _Alloc>::const_reference = const Inkscape::Text::Layout::Character&; std::vector<_Tp, _Alloc>::size_type = long unsigned int]: Assertion '__builtin_expect(__n < this->size(), true)' failed.
Aborted (core dumped)