Crash when closing Export dialog with multiple documents open
Summary:
Inkscape crashes when the Export dialog is closed.
Steps to reproduce:
- Start Inkscape
- In the welcome dialog, choose "create new file".
- File - Export (to make sure that the Export dialog is open)
- File - open recent - möp.svg.
- File - open recent - uhu.svg (opens in second tab)
- Close export dialog
Note that both example files have some export information stored in the file.
Maybe related:
- #9262
- Use-after-free in Export dialog inkscape#3501 (closed)
What happened?
Crash in Inkscape::UI::Dialog::BatchItem::on_parent_changed():
0# Inkscape::Application::crash_handler(int) at /home/u/inkscape/src/inkscape.cpp:547
1# 0x000071E032245320 in /lib/x86_64-linux-gnu/libc.so.6
2# Gtk::Widget::gobj() at ../gtkmm/untracked/gtk/gtkmm/widget.h:173
3# Gtk::Widget::get_parent() at ../gtkmm/untracked/gtk/gtkmm/widget.cc:2042
4# Inkscape::UI::Dialog::BatchItem::on_parent_changed() at /home/u/inkscape/src/ui/dialog/export-batch.cpp:202
5# sigc::internal::slot_call)::{lambda()#3}, void>::call_it(sigc::internal::slot_rep*) at /usr/include/sigc++-3.0/sigc++/functors/slot.h:156
6# void std::__invoke_impl(std::__invoke_other, void (*&&)(sigc::internal::slot_rep*), sigc::internal::slot_rep*&) at /usr/include/c++/13/bits/invoke.h:61
7# std::__invoke_result::type std::__invoke(void (*&&)(sigc::internal::slot_rep*), sigc::internal::slot_rep*&) at /usr/include/c++/13/bits/invoke.h:97
8# std::invoke_result::type std::invoke(void (*&&)(sigc::internal::slot_rep*), sigc::internal::slot_rep*&) at /usr/include/c++/13/functional:114
9# sigc::slot::operator()() const at /usr/include/sigc++-3.0/sigc++/functors/slot.h:224
10# Glib::PropertyProxyConnectionNode::callback(_GObject*, _GParamSpec*, void*) at ../glibmm/glib/glibmm/propertyproxy_base.cc:89
11# PropertyProxyConnectionNode_callback at ../glibmm/glib/glibmm/propertyproxy_base.cc:34
12# g_closure_invoke in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
13# 0x000071E033B50C79 in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
14# 0x000071E033B41591 in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
15# g_signal_emit_valist in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
16# g_signal_emit in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
17# 0x000071E033B2D2E4 in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
18# 0x000071E033B21BCF in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
19# gtk_widget_unparent in /lib/x86_64-linux-gnu/libgtk-4.so.1
20# 0x000071E030B52350 in /lib/x86_64-linux-gnu/libgtk-4.so.1
21# Gtk::Widget_Class::dispose_vfunc_callback(_GObject*) at ../gtkmm/untracked/gtk/gtkmm/widget.cc:444
22# Widget_dispose_vfunc_c_callback at ../gtkmm/untracked/gtk/gtkmm/widget.cc:57
23# g_object_unref in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
24# 0x000071E030C8AD19 in /lib/x86_64-linux-gnu/libgtk-4.so.1
25# Gtk::Widget_Class::dispose_vfunc_callback(_GObject*) at ../gtkmm/untracked/gtk/gtkmm/widget.cc:444
26# Widget_dispose_vfunc_c_callback at ../gtkmm/untracked/gtk/gtkmm/widget.cc:57
27# g_object_unref in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
28# 0x000071E030BF9E26 in /lib/x86_64-linux-gnu/libgtk-4.so.1
29# Gtk::Widget_Class::dispose_vfunc_callback(_GObject*) at ../gtkmm/untracked/gtk/gtkmm/widget.cc:444
30# Widget_dispose_vfunc_c_callback at ../gtkmm/untracked/gtk/gtkmm/widget.cc:57
31# g_object_unref in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
32# 0x000071E030B6ADD0 in /lib/x86_64-linux-gnu/libgtk-4.so.1
33# Gtk::Widget_Class::dispose_vfunc_callback(_GObject*) at ../gtkmm/untracked/gtk/gtkmm/widget.cc:444
34# Widget_dispose_vfunc_c_callback at ../gtkmm/untracked/gtk/gtkmm/widget.cc:57
35# g_object_unref in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
36# 0x000071E030C8AD19 in /lib/x86_64-linux-gnu/libgtk-4.so.1
37# Gtk::Widget_Class::dispose_vfunc_callback(_GObject*) at ../gtkmm/untracked/gtk/gtkmm/widget.cc:444
38# Widget_dispose_vfunc_c_callback at ../gtkmm/untracked/gtk/gtkmm/widget.cc:57
39# g_object_unref in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
40# 0x000071E030BF9E26 in /lib/x86_64-linux-gnu/libgtk-4.so.1
41# Gtk::Widget_Class::dispose_vfunc_callback(_GObject*) at ../gtkmm/untracked/gtk/gtkmm/widget.cc:444
42# Widget_dispose_vfunc_c_callback at ../gtkmm/untracked/gtk/gtkmm/widget.cc:57
43# g_object_unref in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
44# 0x000071E030AE30ED in /lib/x86_64-linux-gnu/libgtk-4.so.1
45# Gtk::Widget_Class::dispose_vfunc_callback(_GObject*) at ../gtkmm/untracked/gtk/gtkmm/widget.cc:444
46# Widget_dispose_vfunc_c_callback at ../gtkmm/untracked/gtk/gtkmm/widget.cc:57
47# g_object_unref in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
48# 0x000071E030BC405D in /lib/x86_64-linux-gnu/libgtk-4.so.1
49# Gtk::Widget_Class::dispose_vfunc_callback(_GObject*) at ../gtkmm/untracked/gtk/gtkmm/widget.cc:444
50# Widget_dispose_vfunc_c_callback at ../gtkmm/untracked/gtk/gtkmm/widget.cc:57
51# g_object_unref in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
52# 0x000071E030BB92A6 in /lib/x86_64-linux-gnu/libgtk-4.so.1
53# g_object_unref in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
54# 0x000071E033CFFC22 in /lib/x86_64-linux-gnu/libglib-2.0.so.0
55# g_hash_table_remove_all in /lib/x86_64-linux-gnu/libglib-2.0.so.0
56# g_hash_table_destroy in /lib/x86_64-linux-gnu/libglib-2.0.so.0
57# 0x000071E030AEC4D0 in /lib/x86_64-linux-gnu/libgtk-4.so.1
58# g_object_unref in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
59# Glib::ObjectBase::unreference() const at ../glibmm/glib/glibmm/objectbase.cc:213
60# void Glib::RefPtrDeleter(Gtk::Builder*) at /usr/include/glibmm-2.68/glibmm/refptr.h:34
61# std::_Sp_counted_deleter, (__gnu_cxx::_Lock_policy)2>::_M_dispose() at /usr/include/c++/13/bits/shared_ptr_base.h:527
62# std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release() at /usr/include/c++/13/bits/shared_ptr_base.h:347
63# Inkscape::UI::Dialog::Export::~Export() at /home/u/inkscape/src/ui/dialog/export.cpp:81
64# Inkscape::UI::Dialog::Export::~Export() at /home/u/inkscape/src/ui/dialog/export.cpp:81
65# Gtk::Object::destroy_notify_() at ../gtkmm/gtk/gtkmm/object.cc:251
66# Glib::ObjectBase::destroy_notify_callback_(void*) at ../glibmm/glib/glibmm/objectbase.cc:299
67# ObjectBase_destroy_notify_callback at ../glibmm/glib/glibmm/objectbase.cc:44
68# g_datalist_clear in /lib/x86_64-linux-gnu/libglib-2.0.so.0
69# g_object_unref in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
70# Gtk::Notebook::remove_page(int) at ../gtkmm/untracked/gtk/gtkmm/notebook.cc:393
71# Inkscape::UI::Dialog::DialogNotebook::close_tab_callback() at /home/u/inkscape/src/ui/dialog/dialog-notebook.cpp:386
72# Inkscape::UI::Dialog::DialogNotebook::on_close_button_click_event(Gtk::Widget*) at /home/u/inkscape/src/ui/dialog/dialog-notebook.cpp:747
73# void std::__invoke_impl(std::__invoke_memfun_ref, void (Inkscape::UI::Dialog::DialogNotebook::* const&)(Gtk::Widget*), Inkscape::UI::Dialog::DialogNotebook&, Gtk::Widget* const&) at /usr/include/c++/13/bits/invoke.h:67
74# decltype(auto) sigc::bind_functor<-1, sigc::bound_mem_functor, Gtk::Widget*>::operator()<>() at /usr/include/sigc++-3.0/sigc++/adaptors/bind.h:195
75# sigc::internal::slot_call, Gtk::Widget*>, void>::call_it(sigc::internal::slot_rep*) at /usr/include/sigc++-3.0/sigc++/functors/slot.h:156
76# void std::__invoke_impl(std::__invoke_other, void (*&&)(sigc::internal::slot_rep*), sigc::internal::slot_rep*&) at /usr/include/c++/13/bits/invoke.h:61
77# std::__invoke_result::type std::__invoke(void (*&&)(sigc::internal::slot_rep*), sigc::internal::slot_rep*&) at /usr/include/c++/13/bits/invoke.h:97
78# std::invoke_result::type std::invoke(void (*&&)(sigc::internal::slot_rep*), sigc::internal::slot_rep*&) at /usr/include/c++/13/functional:114
79# sigc::slot::operator()() const at /usr/include/sigc++-3.0/sigc++/functors/slot.h:224
80# Glib::SignalProxyNormal::slot0_void_callback(_GObject*, void*) at ../glibmm/glib/glibmm/signalproxy.cc:124
81# SignalProxyNormal_slot0_void_callback at ../glibmm/glib/glibmm/signalproxy.cc:32
82# g_closure_invoke in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
83# 0x000071E033B50C79 in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
84# 0x000071E033B41591 in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
85# g_signal_emit_valist in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
86# g_signal_emit in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
87# 0x000071E030ABE053 in /lib/x86_64-linux-gnu/libgtk-4.so.1
88# 0x000071E033B416BD in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
89# g_signal_emit_valist in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
90# g_signal_emit in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
91# 0x000071E030B5FC53 in /lib/x86_64-linux-gnu/libgtk-4.so.1
92# g_cclosure_marshal_VOID__BOXEDv in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
93# 0x000071E033B416BD in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
94# g_signal_emit_valist in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
95# g_signal_emit in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
96# 0x000071E030B6444C in /lib/x86_64-linux-gnu/libgtk-4.so.1
97# 0x000071E030B655EB in /lib/x86_64-linux-gnu/libgtk-4.so.1
98# 0x000071E030B6665D in /lib/x86_64-linux-gnu/libgtk-4.so.1
99# 0x000071E030C90423 in /lib/x86_64-linux-gnu/libgtk-4.so.1
100# 0x000071E030C90702 in /lib/x86_64-linux-gnu/libgtk-4.so.1
101# 0x000071E030BA5ED2 in /lib/x86_64-linux-gnu/libgtk-4.so.1
102# 0x000071E030BA6A9F in /lib/x86_64-linux-gnu/libgtk-4.so.1
103# 0x000071E030AC2AB4 in /lib/x86_64-linux-gnu/libgtk-4.so.1
104# 0x000071E030E99A36 in /lib/x86_64-linux-gnu/libgtk-4.so.1
105# g_closure_invoke in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
106# 0x000071E033B5090C in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
107# 0x000071E033B40EF2 in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
108# g_signal_emit_valist in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
109# g_signal_emit in /lib/x86_64-linux-gnu/libgobject-2.0.so.0
110# 0x000071E030F35827 in /lib/x86_64-linux-gnu/libgtk-4.so.1
111# 0x000071E030E4F136 in /lib/x86_64-linux-gnu/libgtk-4.so.1
112# 0x000071E033D145B5 in /lib/x86_64-linux-gnu/libglib-2.0.so.0
113# 0x000071E033D73717 in /lib/x86_64-linux-gnu/libglib-2.0.so.0
114# g_main_context_iteration in /lib/x86_64-linux-gnu/libglib-2.0.so.0
115# g_application_run in /lib/x86_64-linux-gnu/libgio-2.0.so.0
116# Gio::Application::run(int, char**) at ../glibmm/untracked/gio/giomm/application.cc:1617
117# main at /home/u/inkscape/src/inkscape-main.cpp:213
118# __libc_start_call_main at ../sysdeps/nptl/libc_start_call_main.h:74
119# __libc_start_main at ../csu/libc-start.c:347
120# _start in /home/u/inkscape/build/install_dir/bin/inkscape
What should have happened?
No crash
Sample attachments:
Version info
The first version in which I could reproduce the issue is 268b9e11bb (which introduces the tab UI). However, my guess is that the issue was already present before but difficult to trigger.
System info
Inkscape 1.5-dev (268b9e11bb, 2024-12-22) Compile (Run)
GLib version: 2.80.0
GTK version: 4.14.2 (4.14.2)
glibmm version: 2.78.1
gtkmm version: 4.14.0
libxml2 version: 2.9.14
libxslt version: 1.1.39
Cairo version: 1.18.0 (1.18.0)
Pango version: 1.52.1 (1.52.1)
HarfBuzz version: 8.3.0 (8.3.0)
Poppler version: 24.02.0
OS version: Ubuntu 24.04.1 LTS