Crash when working with text fields

[anusser]

Hi Otfried,

I experience crashes when working with text fields. The most reliable way to trigger this crash seems to be to create a text field, .e.g, containing $x$, and then change the font size several times and at some point it tends to crash on me. It also crashes in all sorts of other situations when working with text fields, but most reliably when changing the font size.

Operating System: Manjaro (fully updated)
Ipe Version: 7.2.21
Desktop (if this might be important for any reason): KDE

As I regularly use ipe, I strongly suspect that this bug was introduced in 7.2.21.
I created a trace on a crash that was triggered as described above. Unfortunately, it is not compiled with debug information, but I still hope that it is of help or that you can at least reproduce it.

Thread 1 "ipe" received signal SIGSEGV, Segmentation fault
#0  0x00007ffff7eb45d0 in ipe::String::operator==(ipe::String const&) const () from /usr/lib/libipe.so.7.2.21
#1  0x00007ffff7ee6ca6 in ipe::PdfDict::get(ipe::String, ipe::PdfFile const*) const ()
   from /usr/lib/libipe.so.7.2.21
#2  0x00007ffff7ef3cc5 in ipe::PdfResourceBase::resourcesOfKind(ipe::String) const ()
   from /usr/lib/libipe.so.7.2.21
#3  0x00007ffff7ef3d6f in ipe::PdfResourceBase::findResource(ipe::String, ipe::String) const ()
   from /usr/lib/libipe.so.7.2.21
#4  0x00007ffff7f5eaa6 in ipe::CairoPainter::findResource(ipe::String, ipe::String) ()
   from /usr/lib/libipecairo.so.7.2.21
#5  0x00007ffff7f634a3 in ipe::CairoPainter::doDrawText(ipe::Text const*) () from /usr/lib/libipecairo.so.7.2.21
#6  0x00007ffff7eceba2 in ipe::Text::draw(ipe::Painter&) const () from /usr/lib/libipe.so.7.2.21
#7  0x00007ffff7f82769 in ipe::CanvasBase::drawObjects(_cairo*) () from /usr/lib/libipecanvas.so.7.2.21
#8  0x00007ffff7f83af0 in ipe::CanvasBase::refreshSurface() () from /usr/lib/libipecanvas.so.7.2.21
#9  0x00007ffff7f85da3 in ipe::Canvas::paintEvent(QPaintEvent*) () from /usr/lib/libipecanvas.so.7.2.21
#10 0x00007ffff7931b0e in QWidget::event(QEvent*) () from /usr/lib/libQt5Widgets.so.5
#11 0x00007ffff78f0752 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib/libQt5Widgets.so.5
#12 0x00007ffff6e28a7a in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /usr/lib/libQt5Core.so.5
#13 0x00007ffff79298e8 in QWidgetPrivate::sendPaintEvent(QRegion const&) () from /usr/lib/libQt5Widgets.so.5
#14 0x00007ffff792a15c in QWidgetPrivate::drawWidget(QPaintDevice*, QRegion const&, QPoint const&, QFlags, QPainter*, QWidgetRepaintManager*) () from /usr/lib/libQt5Widgets.so.5
#15 0x00007ffff790129e in ?? () from /usr/lib/libQt5Widgets.so.5
#16 0x00007ffff793225b in QWidget::event(QEvent*) () from /usr/lib/libQt5Widgets.so.5
#17 0x00007ffff78f0752 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib/libQt5Widgets.so.5
#18 0x00007ffff6e28a7a in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /usr/lib/libQt5Core.so.5
#19 0x00007ffff6e2b573 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) ()
   from /usr/lib/libQt5Core.so.5
#20 0x00007ffff6e820a4 in ?? () from /usr/lib/libQt5Core.so.5
#21 0x00007ffff56fe914 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#22 0x00007ffff57527d1 in ?? () from /usr/lib/libglib-2.0.so.0
#23 0x00007ffff56fd121 in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#24 0x00007ffff6e816e1 in QEventDispatcherGlib::processEvents(QFlags) ()
   from /usr/lib/libQt5Core.so.5
#25 0x00007ffff6e273fc in QEventLoop::exec(QFlags) () from /usr/lib/libQt5Core.so.5
#26 0x00007ffff7af420a in QDialog::exec() () from /usr/lib/libQt5Widgets.so.5
#27 0x00007ffff7e7d698 in ?? () from /usr/lib/libipeui.so.7.2.21
#28 0x00007ffff7e3afff in ?? () from /usr/lib/liblua5.3.so.5.3
#29 0x00007ffff7e4872d in ?? () from /usr/lib/liblua5.3.so.5.3
#30 0x00007ffff7e3b3b8 in ?? () from /usr/lib/liblua5.3.so.5.3
#31 0x00007ffff7e3684c in lua_callk () from /usr/lib/liblua5.3.so.5.3
#32 0x000055555557227f in ?? ()
#33 0x00007ffff6e5fe10 in ?? () from /usr/lib/libQt5Core.so.5
#34 0x00007ffff6e6154f in QSignalMapper::mapped(int) () from /usr/lib/libQt5Core.so.5
#35 0x00007ffff6e62a9d in QSignalMapper::map(QObject*) () from /usr/lib/libQt5Core.so.5
#36 0x00007ffff6e5fe10 in ?? () from /usr/lib/libQt5Core.so.5
#37 0x00007ffff79f3832 in QComboBox::activated(int) () from /usr/lib/libQt5Widgets.so.5
#38 0x00007ffff79f595f in ?? () from /usr/lib/libQt5Widgets.so.5
#39 0x00007ffff6e5fe10 in ?? () from /usr/lib/libQt5Core.so.5
#40 0x00007ffff79f39a3 in QComboBoxPrivateContainer::itemSelected(QModelIndex const&) ()
   from /usr/lib/libQt5Widgets.so.5
#41 0x00007ffff79f41d0 in QComboBoxPrivateContainer::eventFilter(QObject*, QEvent*) ()
   from /usr/lib/libQt5Widgets.so.5
#42 0x00007ffff6e287e3 in QCoreApplicationPrivate::sendThroughObjectEventFilters(QObject*, QEvent*) ()
   from /usr/lib/libQt5Core.so.5
#43 0x00007ffff78f0741 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib/libQt5Widgets.so.5
#44 0x00007ffff78f787b in QApplication::notify(QObject*, QEvent*) () from /usr/lib/libQt5Widgets.so.5
#45 0x00007ffff6e28a7a in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /usr/lib/libQt5Core.so.5
#46 0x00007ffff78f687e in QApplicationPrivate::sendMouseEvent(QWidget*, QMouseEvent*, QWidget*, QWidget*, QWidget**, QPointer&, bool, bool) () from /usr/lib/libQt5Widgets.so.5
#47 0x00007ffff794a7cf in ?? () from /usr/lib/libQt5Widgets.so.5
#48 0x00007ffff794d63f in ?? () from /usr/lib/libQt5Widgets.so.5
--Type  for more, q to quit, c to continue without paging--
#49 0x00007ffff78f0752 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib/libQt5Widgets.so.5
#50 0x00007ffff6e28a7a in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /usr/lib/libQt5Core.so.5
#51 0x00007ffff7202594 in QGuiApplicationPrivate::processMouseEvent(QWindowSystemInterfacePrivate::MouseEvent*) ()
   from /usr/lib/libQt5Gui.so.5
#52 0x00007ffff71d7bb5 in QWindowSystemInterface::sendWindowSystemEvents(QFlags) ()
   from /usr/lib/libQt5Gui.so.5
#53 0x00007ffff319016c in ?? () from /usr/lib/libQt5XcbQpa.so.5
#54 0x00007ffff56fe914 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#55 0x00007ffff57527d1 in ?? () from /usr/lib/libglib-2.0.so.0
#56 0x00007ffff56fd121 in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#57 0x00007ffff6e816e1 in QEventDispatcherGlib::processEvents(QFlags) ()
   from /usr/lib/libQt5Core.so.5
#58 0x00007ffff6e273fc in QEventLoop::exec(QFlags) () from /usr/lib/libQt5Core.so.5
#59 0x00007ffff6e2f894 in QCoreApplication::exec() () from /usr/lib/libQt5Core.so.5
#60 0x000055555556f83a in ?? ()
#61 0x00007ffff7e3afff in ?? () from /usr/lib/liblua5.3.so.5.3
#62 0x00007ffff7e4872d in ?? () from /usr/lib/liblua5.3.so.5.3
#63 0x00007ffff7e3b3b8 in ?? () from /usr/lib/liblua5.3.so.5.3
#64 0x00007ffff7e3684c in lua_callk () from /usr/lib/liblua5.3.so.5.3
#65 0x00007ffff7e58660 in ?? () from /usr/lib/liblua5.3.so.5.3
#66 0x00007ffff7e3afff in ?? () from /usr/lib/liblua5.3.so.5.3
#67 0x00007ffff7e4872d in ?? () from /usr/lib/liblua5.3.so.5.3
#68 0x00007ffff7e3b3b8 in ?? () from /usr/lib/liblua5.3.so.5.3
#69 0x00007ffff7e3a710 in ?? () from /usr/lib/liblua5.3.so.5.3
#70 0x00007ffff7e3b73b in ?? () from /usr/lib/liblua5.3.so.5.3
#71 0x00007ffff7e3691a in lua_pcallk () from /usr/lib/liblua5.3.so.5.3
#72 0x0000555555566f09 in ?? ()
#73 0x00007ffff66ad152 in __libc_start_main () from /usr/lib/libc.so.6
#74 0x000055555556700e in ?? ()

Tell me if I can provide more useful information.

Thanks a lot for creating and maintaining ipe! :)

[otfried]

It seems this is the same problem as #354. I hadn't been able to figure out what caused that, but with your new details a theory is emerging.

Since 7.2.18, the UI no longer freezes while Latex is running. At some point, the Latex run updates all the PDF resources, and it would seem that this might not be thread-safe: if a text object is being redisplayed exactly while the resources update, then this could explain this crash.

Is it true that the crash always happens while Latex is running (that is, just after you modified a text object)?

Could you try to edit the file model.lua in the Ipe lua directory, finding the function MODEL:runLatex(), and changing the following lines:

  ipeui.waitDialog(self.ui:win(),
		   function ()
		     success, errmsg, result, log = self.doc:runLatex(self.file_name)
		   end, "Compiling Latex")

into

     success, errmsg, result, log = self.doc:runLatex(self.file_name)

This moves the Latex run into the GUI thread. If the problem is caused by a race condition, this would fix it.

I'll have to think about a proper fix. Most likely I'll move the update of the resources into the main thread.

[anusser]

Thanks for the quick answer!

What you are describing very accurately matches what I am experiencing. When the latex compiles there's always a very small delay (I mean, also when everything works), and it seems to crash exactly after this short delay. And as far as I can tell, all the crashes that I experienced happened after the latex rendering ran.

Unfortunately, right now I somehow cannot reproduce it anymore. As soon as it comes back, I will check what you suggested and report back.

Maybe it also just occurs shortly before SoCG deadlines. ;D

[lorenzhs]

That sounds consistent with my experience in #354. The crashes tend to happen when I rapidly undo multiple times, so it would be plausible that the results of one compile run come in just as I'm pressing Ctrl+Z again. I've noticed this especially with files for which the latex run doesn't complete instantaneously, which makes it easier to hit undo again before the previous undo operation's latex run has completed and updated the document's fields.

[anusser]

Could you try to edit the file model.lua in the Ipe lua directory, finding the function MODEL:runLatex(), and changing the following lines:

  ipeui.waitDialog(self.ui:win(),
		   function ()
		     success, errmsg, result, log = self.doc:runLatex(self.file_name)
		   end, "Compiling Latex")

into

     success, errmsg, result, log = self.doc:runLatex(self.file_name)

This moves the Latex run into the GUI thread. If the problem is caused by a race condition, this would fix it.

I now tried this again (when creating a text field containing "$x$" and changing the font size multiple times) and got a crash 3 out of 3 tries without this modification and could not get any crash with this modification. So, from my side it looks a lot like you found the cause! :)

Tell me if I can help you further with resolving this bug.

[budinero]

Could you try to edit the file model.lua in the Ipe lua directory, finding the function MODEL:runLatex(), and changing the following lines:

  ipeui.waitDialog(self.ui:win(),
		   function ()
		     success, errmsg, result, log = self.doc:runLatex(self.file_name)
		   end, "Compiling Latex")

into

     success, errmsg, result, log = self.doc:runLatex(self.file_name)

I can also confirm that the proposed change solves the segfault in a debian/KDE system. In addition, if the option "Enable the online latex compilation" is set, the problem does not occur, but I think there is no a race condition in this case.

[otfried]

Here is a proposed fix for this bug. If you can compile Ipe yourself, it would be great if you could test if it really fixes the issue for you (I have never encountered it on my own system).

ipe-7.2.21-src.tar.gz

[anusser]

I could not make it crash anymore with the version that you linked. However, as I also couldn't reproduce the bug deterministically, I cannot say with full certainty that it is fixed.

It might be good if other people check as well.

[budinero]

Here is a proposed fix for this bug. If you can compile Ipe yourself, it would be great if you could test if it really fixes the issue for you (I have never encountered it on my own system).

ipe-7.2.21-src.tar.gz

I checked this fix and it is working well in my system. Thanks!

[anusser]

This bug appears again for me in version 7.2.26. Unfortunately, I cannot tell you exactly in which version the regression happened. The fix proposed above again resolves the issue for me. (actually, I just added prefs.freeze_in_latex = true to my prefs.lua which seems to be equivalent to the fix in your post as far as I understand).

Is there anything I can do to help resolving the issue?

[Steven--]

I am also experiencing the same problem in version 7.2.26. I can confirm that adding prefs.freeze_in_latex = true to my configuration fixes the issue.