Segfault: URIReference refcount is broken and causes use after free
Summary:
Segmentation fault when copying an object to clipboard.
Steps to reproduce:
Copy both files into a single directory. Open main.svg. It shows two rectangle-ish boxes with a gradient. Select the boxes and copy then to the clipboard using Ctrl+C. SEGV triggered.
Minimal files to reproduce the issue attached. main.svg levelB.svg
Investigation
I did my own investigation and it seems the LinearGradient is being used after free.
The URIReference refcount reaches zero and it is freed. But the main document is still holding a
pointer to it.
I've seen some code that handles clones differently in the refcounting: if (_obj && (!_owner || !_owner->cloned))
Probably having a clone being referenced from a different file is triggering some corner case.
Seeing the Inkscape code for the first time it is hard to understand if the recount wasn't increased when copying the document, or if the decrease shouldn't happen.
Some insight from users familiar with the code would be helpful set the direction where to debug further.
Version info
Inkscape 1.3.2 (091e20ef0f, 2023-11-25)
GLib version: 2.80.3
GTK version: 3.24.43
glibmm version: 2.66.7
gtkmm version: 3.24.9
libxml2 version: 2.12.8
libxslt version: 1.1.41
Cairo version: 1.18.0
Pango version: 1.54.0
HarfBuzz version: 8.5.0
OS version: Fedora Linux 40 (Forty)
Hardware: x86_64Backtrace
Thread 1 "inkscape" received signal SIGSEGV, Segmentation fault.
Downloading source file /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/util/cast.h
0x00007ffff709ee86 in is<SPPaintServer, SPObject> () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/util/cast.h:44
44 auto const s_tag = s->tag();(gdb) bt full
#0 0x00007ffff709ee86 in is<SPPaintServer, SPObject> () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/util/cast.h:44
#1 cast<SPPaintServer, SPObject> () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/util/cast.h:83
#2 SPItem::fill_ps_ref_changed () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/object/sp-item.cpp:646
#3 0x00007ffff709a4e8 in sigc::internal::signal_emit2<void, Geom::Affine const*, SPItem*, sigc::nil>::emit () at /usr/include/sigc++-2.0/sigc++/signal.h:1296
#4 0x00007ffff7801e23 in sigc::signal2<void, SPObject*, SPObject*, sigc::nil>::emit () at /usr/include/sigc++-2.0/sigc++/signal.h:3119
#5 sp_style_fill_paint_server_ref_changed () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/style.cpp:1206
#6 0x00007ffff709a4e8 in sigc::internal::signal_emit2<void, Geom::Affine const*, SPItem*, sigc::nil>::emit () at /usr/include/sigc++-2.0/sigc++/signal.h:1296
#7 0x00007ffff7117cad in sigc::signal2<void, SPObject*, SPObject*, sigc::nil>::emit () at /usr/include/sigc++-2.0/sigc++/signal.h:3119
#8 Inkscape::URIReference::_setObject () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/object/uri-references.cpp:235
#9 0x00007ffff7118963 in Inkscape::URIReference::~URIReference () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/object/uri-references.cpp:52
#10 0x00007ffff70d6ea1 in std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release () at /usr/include/c++/14/bits/shared_ptr_base.h:346
#11 std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release () at /usr/include/c++/14/bits/shared_ptr_base.h:317
#12 std::__shared_count<(__gnu_cxx::_Lock_policy)2>::~__shared_count () at /usr/include/c++/14/bits/shared_ptr_base.h:1069
#13 std::__shared_ptr<SPPaintServerReference, (__gnu_cxx::_Lock_policy)2>::~__shared_ptr () at /usr/include/c++/14/bits/shared_ptr_base.h:1525
#14 std::__shared_ptr<SPPaintServerReference, (__gnu_cxx::_Lock_policy)2>::reset () at /usr/include/c++/14/bits/shared_ptr_base.h:1643
#15 SPObject::release () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/object/sp-object.cpp:724
#16 0x00007ffff709d73c in SPItem::release () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/object/sp-item.cpp:472
#17 0x00007ffff70d6b4b in SPObject::releaseReferences () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/object/sp-object.cpp:922
#18 0x00007ffff70d6c50 in SPObject::detach () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/object/sp-object.cpp:646
#19 SPObject::detach () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/object/sp-object.cpp:640
#20 0x00007ffff70d6e1b in SPObject::release () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/object/sp-object.cpp:733
#21 0x00007ffff709d73c in SPItem::release () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/object/sp-item.cpp:472
#22 0x00007ffff70d6b4b in SPObject::releaseReferences () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/object/sp-object.cpp:922
#23 0x00007ffff70d6c50 in SPObject::detach () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/object/sp-object.cpp:646
#24 SPObject::detach () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/object/sp-object.cpp:640
#25 0x00007ffff710b717 in SPUse::href_changed () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/object/sp-use.cpp:596
#26 0x00007ffff709a4e8 in sigc::internal::signal_emit2<void, Geom::Affine const*, SPItem*, sigc::nil>::emit () at /usr/include/sigc++-2.0/sigc++/signal.h:1296
#27 0x00007ffff7117cad in sigc::signal2<void, SPObject*, SPObject*, sigc::nil>::emit () at /usr/include/sigc++-2.0/sigc++/signal.h:3119
#28 Inkscape::URIReference::_setObject () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/object/uri-references.cpp:235
#29 0x00007ffff6d86c90 in sigc::internal::signal_emit1<void, Inkscape::Display::TemporaryItem*, sigc::nil>::emit () at /usr/include/sigc++-2.0/sigc++/signal.h:1041
#30 0x00007ffff70d6b42 in sigc::signal1<void, SPObject*, sigc::nil>::emit () at /usr/include/sigc++-2.0/sigc++/signal.h:2961
#31 SPObject::releaseReferences () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/object/sp-object.cpp:920
#32 0x00007ffff70d6c50 in SPObject::detach () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/object/sp-object.cpp:646
#33 SPObject::detach () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/object/sp-object.cpp:640
#34 0x00007ffff70d6e1b in SPObject::release () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/object/sp-object.cpp:733
#35 0x00007ffff709d73c in SPItem::release () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/object/sp-item.cpp:472
#36 0x00007ffff70d6b4b in SPObject::releaseReferences () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/object/sp-object.cpp:922
#37 0x00007ffff70d6c50 in SPObject::detach () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/object/sp-object.cpp:646
#38 SPObject::detach () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/object/sp-object.cpp:640
#39 0x00007ffff70d6e1b in SPObject::release () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/object/sp-object.cpp:733
#40 0x00007ffff709d73c in SPItem::release () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/object/sp-item.cpp:472
#41 0x00007ffff70d6b4b in SPObject::releaseReferences () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/object/sp-object.cpp:922
#42 0x00007ffff773793c in SPDocument::~SPDocument () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/document.cpp:190
#43 0x00007ffff7737d29 in SPDocument::~SPDocument () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/document.cpp:231
#44 boost::checked_delete<SPDocument const> () at /usr/include/boost/core/checked_delete.hpp:44
#45 boost::delete_clone<SPDocument> () at /usr/include/boost/ptr_container/clone_allocator.hpp:45
#46 boost::heap_clone_allocator::deallocate_clone<SPDocument> () at /usr/include/boost/ptr_container/clone_allocator.hpp:63
#47 boost::ptr_container_detail::reversible_ptr_container<boost::ptr_container_detail::sequence_config<SPDocument, std::__cxx11::list<void*, std::allocator<void*> > >, boost::heap_clone_allocator>::remove<boost::void_ptr_iterator<std::_List_iterator<void*>, SPDocument> > () at /usr/include/boost/ptr_container/detail/reversible_ptr_container.hpp:237
#48 boost::ptr_container_detail::reversible_ptr_container<boost::ptr_container_detail::sequence_config<SPDocument, std::__cxx11::list<void*, std::allocator<void*> > >, boost::heap_clone_allocator>::remove<boost::void_ptr_iterator<std::_List_iterator<void*>, SPDocument> > () at /usr/include/boost/ptr_container/detail/reversible_ptr_container.hpp:244
#49 boost::ptr_container_detail::reversible_ptr_container<boost::ptr_container_detail::sequence_config<SPDocument, std::__cxx11::list<void*, std::allocator<void*> > >, boost::heap_clone_allocator>::remove_all ()
at /usr/include/boost/ptr_container/detail/reversible_ptr_container.hpp:205
#50 boost::ptr_container_detail::reversible_ptr_container<boost::ptr_container_detail::sequence_config<SPDocument, std::__cxx11::list<void*, std::allocator<void*> > >, boost::heap_clone_allocator>::~reversible_ptr_container ()
at /usr/include/boost/ptr_container/detail/reversible_ptr_container.hpp:499
#51 boost::ptr_sequence_adapter<SPDocument, std::__cxx11::list<void*, std::allocator<void*> >, boost::heap_clone_allocator>::~ptr_sequence_adapter () at /usr/include/boost/ptr_container/ptr_sequence_adapter.hpp:128
#52 boost::ptr_list<SPDocument, boost::heap_clone_allocator, std::allocator<void*> >::~ptr_list () at /usr/include/boost/ptr_container/ptr_list.hpp:37
#53 SPDocument::~SPDocument () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/document.cpp:231
#54 0x00007ffff6dba319 in SPDocument::~SPDocument () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/document.cpp:231
#55 std::default_delete<SPDocument>::operator() () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/document.h:520
#56 std::default_delete<SPDocument>::operator() () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/document.h:515
--Type <RET> for more, q to quit, c to continue without paging--c
#57 std::unique_ptr<SPDocument, std::default_delete<SPDocument> >::~unique_ptr () at /usr/include/c++/14/bits/unique_ptr.h:398
#58 Inkscape::Extension::Output::save () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/extension/output.cpp:226
#59 0x00007ffff71550e5 in Inkscape::UI::ClipboardManagerImpl::_onGet () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/ui/clipboard.cpp:1726
#60 0x00007ffff486bcc1 in sigc::slot2<void, Gtk::Menu*, Glib::RefPtr<Gio::AppInfo> const&>::operator() (this=0x5555581dd400, _A_a1=@0x7fffffffcf60: 0x7fffffffd3c0, _A_a2=...) at /usr/include/sigc++-2.0/sigc++/functors/slot.h:813
#61 (anonymous namespace)::SignalProxy_GetClear_gtk_callback_get (selection_data=<optimized out>, info=<optimized out>, data=0x5555581dd400) at ../untracked/gtk/gtkmm/clipboard.cc:71
cppSelectionData = {<Gtk::SelectionData> = {gobject_ = 0x7fffffffd3c0}, <No data fields>}
self = 0x5555581dd400
#65 0x00007ffff592b638 in <emit signal '0x7ffff423d2ba "selection-get"' on instance 0x5555590e3080 [GtkInvisible]> (instance=instance@entry=0x5555590e3080, detailed_signal=detailed_signal@entry=0x7ffff423d2ba "selection-get")
at ../gobject/gsignal.c:3624
var_args = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7fffffffd330, reg_save_area = 0x7fffffffd240}}
detail = <optimized out>
signal_id = 111
itype = 0x55555574b2a0 [GtkInvisible/GtkWidget/GInitiallyUnowned]
__func__ = "g_signal_emit_by_name"
#62 0x00007ffff3e89d18 in _gtk_marshal_VOID__BOXED_UINT_UINTv
(closure=0x555558f60d80, return_value=<optimized out>, instance=<optimized out>, args=<optimized out>, marshal_data=<optimized out>, n_params=<optimized out>, param_types=0x55555564e410) at gtk/gtkmarshalers.c:3789
cc = 0x555558f60d80
data1 = <optimized out>
data2 = 0x0
callback = 0x7ffff418c850 <selection_get_cb>
arg0 = 0x7fffffffd3c0
arg1 = 7
arg2 = 5
args_copy = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 0x7fffffffd330, reg_save_area = 0x7fffffffd240}}
#63 0x00007ffff592b254 in _g_closure_invoke_va (closure=0x555558f60d80, return_value=0x0, instance=0x5555590e3080, args=0x7fffffffd210, n_params=<optimized out>, param_types=0x55555564e410) at ../gobject/gclosure.c:897
marshal = <optimized out>
marshal_data = <optimized out>
in_marshal = 0
real_closure = 0x555558f60d60
real_closure = <optimized out>
__func__ = {<optimized out> <repeats 21 times>}
_g_boolean_var_50 = <optimized out>
marshal = <optimized out>
marshal_data = <optimized out>
in_marshal = <optimized out>
_g_boolean_var_51 = <optimized out>
cunion = <optimized out>
new_int = <optimized out>
old_int = <optimized out>
success = <optimized out>
tmp = {closure = {ref_count = <optimized out>, meta_marshal_nouse = <optimized out>, n_guards = <optimized out>, n_fnotifiers = <optimized out>, n_inotifiers = <optimized out>, in_inotify = <optimized out>, floating = <optimized out>, derivative_flag = <optimized out>, in_marshal = <optimized out>, is_invalid = <optimized out>, marshal = <optimized out>, data = <optimized out>, notifiers = <optimized out>}, vint = <optimized out>}
gaicae_oldval = <optimized out>
cunion = <optimized out>
new_int = <optimized out>
old_int = <optimized out>
success = <optimized out>
tmp = {closure = {ref_count = <optimized out>, meta_marshal_nouse = <optimized out>, n_guards = <optimized out>, n_fnotifiers = <optimized out>, n_inotifiers = <optimized out>, in_inotify = <optimized out>, floating = <optimized out>, derivative_flag = <optimized out>, in_marshal = <optimized out>, is_invalid = <optimized out>, marshal = <optimized out>, data = <optimized out>, notifiers = <optimized out>}, vint = <optimized out>}
gaicae_oldval = <optimized out>
#64 signal_emit_valist_unlocked (instance=instance@entry=0x5555590e3080, signal_id=signal_id@entry=111, detail=0, var_args=var_args@entry=0x7fffffffd210) at ../gobject/gsignal.c:3424
return_accu = 0x0
accu = {g_type = 0x0, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
emission = {next = 0x7fffffffd550, instance = 0x5555590e3080, ihint = {signal_id = 111, detail = 0, run_type = (G_SIGNAL_RUN_FIRST | G_SIGNAL_ACCUMULATOR_FIRST_RUN)}, state = EMISSION_RUN, chain_type = 0x55555574b2a0 [GtkInvisible/GtkWidget/GInitiallyUnowned]}
instance_type = 0x55555574b2a0 [GtkInvisible/GtkWidget/GInitiallyUnowned]
emission_return = {g_type = 0x0, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
rtype = 0x4
static_scope = <optimized out>
fastpath_handler = <optimized out>
closure = <optimized out>
run_type = <optimized out>
hlist = <optimized out>
l = <optimized out>
fastpath = <optimized out>
instance_and_params = <optimized out>
param_values = <optimized out>
node = <optimized out>
i = <optimized out>
node_copy = {signal_id = 111, itype = 0x555555639c40 [GtkWidget/GInitiallyUnowned], name = 0x7ffff423d2ba "selection-get", destroyed = 0, flags = 2, n_params = 3, single_va_closure_is_valid = 1, single_va_closure_is_after = 1, param_types = 0x55555564e410, return_type = 0x4, class_closure_bsa = 0x55555560a040, accumulator = 0x0, c_marshaller = 0x7ffff3e85a90 <_gtk_marshal_VOID__BOXED_UINT_UINT>, va_marshaller = 0x7ffff3e89c50 <_gtk_marshal_VOID__BOXED_UINT_UINTv>, emission_hooks = 0x0, single_va_closure = 0x555555647e40}
__func__ = "signal_emit_valist_unlocked"
#66 0x00007ffff408221a in gtk_selection_invoke_handler (widget=0x5555590e3080 [GtkInvisible], data=0x7fffffffd3c0, time=0) at ../gtk/gtkselection.c:3230
target_list = <optimized out>
info = 0
__func__ = "gtk_selection_invoke_handler"
#67 0x00007ffff4088cf0 in _gtk_selection_request (widget=0x5555590e3080 [GtkInvisible], event=event@entry=0x5555587fae90) at ../gtk/gtkselection.c:2617
data = {selection = 0x45, target = 0x48, type = 0x25, format = 2106020864, data = 0x0, length = -1, display = 0x5555555ea6d0 [GdkWaylandDisplay]}
items = 140733193388040
display = <optimized out>
info = 0x555557d32240
tmp_list = <optimized out>
i = 0
selection_max_size = 2147483647
__func__ = "_gtk_selection_request"
#72 0x00007ffff592b423 in <emit signal '???' on instance 0x5555590e3080 [GtkInvisible]> (instance=instance@entry=0x5555590e3080, signal_id=<optimized out>, detail=detail@entry=0) at ../gobject/gsignal.c:3583
var_args = {{gp_offset = 24, fp_offset = 48, overflow_arg_area = 0x7fffffffd7d0, reg_save_area = 0x7fffffffd710}}
#68 0x00007ffff3e888d9 in _gtk_marshal_BOOLEAN__BOXEDv
(closure=0x555555648170, return_value=0x7fffffffd600, instance=<optimized out>, args=<optimized out>, marshal_data=<optimized out>, n_params=<optimized out>, param_types=0x55555564f780) at gtk/gtkmarshalers.c:130
cc = 0x555555648170
data1 = <optimized out>
data2 = 0x555555639c40
callback = 0x7ffff4088a60 <_gtk_selection_request>
v_return = <optimized out>
arg0 = 0x5555587fae90
args_copy = {{gp_offset = 32, fp_offset = 48, overflow_arg_area = 0x7fffffffd7d0, reg_save_area = 0x7fffffffd710}}
__func__ = "_gtk_marshal_BOOLEAN__BOXEDv"
#69 0x00007ffff592b254 in _g_closure_invoke_va (closure=0x555555648170, return_value=0x7fffffffd600, instance=0x5555590e3080, args=0x7fffffffd6f0, n_params=<optimized out>, param_types=0x55555564f780) at ../gobject/gclosure.c:897
marshal = <optimized out>
marshal_data = <optimized out>
in_marshal = 0
real_closure = 0x555555648150
real_closure = <optimized out>
__func__ = {<optimized out> <repeats 21 times>}
_g_boolean_var_50 = <optimized out>
marshal = <optimized out>
marshal_data = <optimized out>
in_marshal = <optimized out>
_g_boolean_var_51 = <optimized out>
cunion = <optimized out>
new_int = <optimized out>
old_int = <optimized out>
success = <optimized out>
tmp = {closure = {ref_count = <optimized out>, meta_marshal_nouse = <optimized out>, n_guards = <optimized out>, n_fnotifiers = <optimized out>, n_inotifiers = <optimized out>, in_inotify = <optimized out>, floating = <optimized out>, derivative_flag = <optimized out>, in_marshal = <optimized out>, is_invalid = <optimized out>, marshal = <optimized out>, data = <optimized out>, notifiers = <optimized out>}, vint = <optimized out>}
gaicae_oldval = <optimized out>
cunion = <optimized out>
new_int = <optimized out>
old_int = <optimized out>
success = <optimized out>
tmp = {closure = {ref_count = <optimized out>, meta_marshal_nouse = <optimized out>, n_guards = <optimized out>, n_fnotifiers = <optimized out>, n_inotifiers = <optimized out>, in_inotify = <optimized out>, floating = <optimized out>, derivative_flag = <optimized out>, in_marshal = <optimized out>, is_invalid = <optimized out>, marshal = <optimized out>, data = <optimized out>, notifiers = <optimized out>}, vint = <optimized out>}
gaicae_oldval = <optimized out>
#70 signal_emit_valist_unlocked (instance=instance@entry=0x5555590e3080, signal_id=signal_id@entry=108, detail=detail@entry=0, var_args=var_args@entry=0x7fffffffd6f0) at ../gobject/gsignal.c:3424
return_accu = 0x7fffffffd600
accu = {g_type = 0x14, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
emission = {next = 0x0, instance = 0x5555590e3080, ihint = {signal_id = 108, detail = 0, run_type = (G_SIGNAL_RUN_LAST | G_SIGNAL_ACCUMULATOR_FIRST_RUN)}, state = EMISSION_RUN, chain_type = 0x55555574b2a0 [GtkInvisible/GtkWidget/GInitiallyUnowned]}
instance_type = 0x55555574b2a0 [GtkInvisible/GtkWidget/GInitiallyUnowned]
emission_return = {g_type = 0x14, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
rtype = 0x14
static_scope = <optimized out>
fastpath_handler = <optimized out>
closure = <optimized out>
run_type = <optimized out>
hlist = <optimized out>
l = <optimized out>
fastpath = <optimized out>
instance_and_params = <optimized out>
param_values = <optimized out>
node = <optimized out>
i = <optimized out>
node_copy = {signal_id = 108, itype = 0x555555639c40 [GtkWidget/GInitiallyUnowned], name = 0x7ffff4242aba "selection-request-event", destroyed = 0, flags = 2, n_params = 1, single_va_closure_is_valid = 1, single_va_closure_is_after = 1, param_types = 0x55555564f780, return_type = 0x14, class_closure_bsa = 0x5555556090b0, accumulator = 0x55555560a180, c_marshaller = 0x7ffff3e8d730 <_gtk_marshal_BOOLEAN__BOXED>, va_marshaller = 0x7ffff3e88830 <_gtk_marshal_BOOLEAN__BOXEDv>, emission_hooks = 0x0, single_va_closure = 0x555555648170}
__func__ = "signal_emit_valist_unlocked"
#71 0x00007ffff592b361 in g_signal_emit_valist (instance=0x5555590e3080, signal_id=108, detail=0, var_args=var_args@entry=0x7fffffffd6f0) at ../gobject/gsignal.c:3263
#73 0x00007ffff415fe3c in gtk_widget_event_internal.part.0.lto_priv.0 (widget=0x5555590e3080 [GtkInvisible], event=0x5555587fae90) at ../gtk/gtkwidget.c:7812
signal_num = <optimized out>
return_val = <optimized out>
handled = 0
__func__ = {<optimized out> <repeats 26 times>}
#74 0x00007ffff3ff543c in gtk_main_do_event (event=<optimized out>) at ../gtk/gtkmain.c:1861
grab_widget = 0x5555590e3080 [GtkInvisible]
window_group = 0x555558032b70 [GtkWindowGroup]
rewritten_event = <optimized out>
device = <optimized out>
tmp_list = <optimized out>
event_widget = 0x5555590e3080 [GtkInvisible]
topmost_widget = <optimized out>
event_widget = <optimized out>
grab_widget = <optimized out>
topmost_widget = <optimized out>
window_group = <optimized out>
rewritten_event = <optimized out>
device = <optimized out>
tmp_list = <optimized out>
cleanup = <optimized out>
__func__ = {<optimized out> <repeats 18 times>}
__inst = <optimized out>
__t = <optimized out>
__r = <optimized out>
window = <optimized out>
__inst = <optimized out>
__t = <optimized out>
__r = <optimized out>
__inst = <optimized out>
__t = <optimized out>
__r = <optimized out>
mnemonics_visible = <optimized out>
window = <optimized out>
__inst = <optimized out>
__t = <optimized out>
__r = <optimized out>
#75 gtk_main_do_event (event=<optimized out>) at ../gtk/gtkmain.c:1691
event_widget = <optimized out>
window_group = <optimized out>
device = <optimized out>
tmp_list = <optimized out>
cleanup = <optimized out>
__func__ = "gtk_main_do_event"
__inst = <optimized out>
__t = <optimized out>
__r = <optimized out>
window = <optimized out>
__inst = <optimized out>
__t = <optimized out>
__r = <optimized out>
__inst = <optimized out>
__t = <optimized out>
__r = <optimized out>
mnemonics_visible = <optimized out>
window = <optimized out>
__inst = <optimized out>
__t = <optimized out>
__r = <optimized out>
#76 0x00007ffff3d34807 in _gdk_event_emit (event=0x5555587fae90) at ../gdk/gdkevents.c:73
#77 _gdk_event_emit (event=0x5555587fae90) at ../gdk/gdkevents.c:67
#78 0x00007ffff3d6e3ce in gdk_event_source_dispatch (base=<optimized out>, callback=<optimized out>, data=<optimized out>) at ../gdk/wayland/gdkeventsource.c:124
source = <optimized out>
display = <optimized out>
event = 0x5555587fae90
#79 0x00007ffff650ee8c in g_main_dispatch (context=0x5555555d6500) at ../glib/gmain.c:3344
dispatch = 0x7ffff3d6e3a0 <gdk_event_source_dispatch>
prev_source = 0x0
begin_time_nsec = 15123475375227
was_in_call = 0
user_data = 0x0
callback = 0x0
cb_funcs = 0x0
cb_data = 0x0
need_destroy = <optimized out>
source = 0x555555601e40
current = 0x5555555db790
i = 0
__func__ = {<optimized out> <repeats 16 times>}
#80 g_main_context_dispatch_unlocked (context=0x5555555d6500) at ../glib/gmain.c:4152
#81 0x00007ffff6570c98 in g_main_context_iterate_unlocked.isra.0 (context=context@entry=0x5555555d6500, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:4217
max_priority = 0
timeout = 0
some_ready = 1
nfds = 4
allocated_nfds = <optimized out>
fds = 0x555557e5e540
begin_time_nsec = 15123475372710
#82 0x00007ffff6510383 in g_main_context_iteration (context=context@entry=0x5555555d6500, may_block=may_block@entry=1) at ../glib/gmain.c:4282
retval = <optimized out>
#83 0x00007ffff55130fd in g_application_run (application=0x555555729f60 [gtkmm__GtkApplication], argc=<optimized out>, argv=0x5555555b0ed0) at ../gio/gapplication.c:2712
arguments = 0x5555555b0f30
status = 0
context = 0x5555555d6500
acquired_context = <optimized out>
__func__ = "g_application_run"
#84 0x0000555555557041 in main () at /usr/src/debug/inkscape-1.3.2-8.fc40.x86_64/src/inkscape-main.cpp:232Edited by Rainer Keller