<html> <head> <base href="https://bugs.freedesktop.org/" /> </head> <body> <div> <a class="bz_bug_link bz_status_RESOLVED bz_closed" title="RESOLVED FIXED - [Patch] Fix for crasher in quartz backend" href="https://bugs.freedesktop.org/show_bug.cgi?id=62885#c2">Comment # 2</a> on <a class="bz_bug_link bz_status_RESOLVED bz_closed" title="RESOLVED FIXED - [Patch] Fix for crasher in quartz backend" href="https://bugs.freedesktop.org/show_bug.cgi?id=62885">bug 62885</a> from <a class="email" href="mailto:ranma42@gmail.com" title="Andrea Canciani <ranma42@gmail.com>"> Andrea Canciani</a> <pre>(In reply to <a href="show_bug.cgi?id=62885#c0">comment #0</a>) > Created <a href="attachment.cgi?id=77176" name="attach_77176" title="Fixes the crash.">attachment 77176</a> <a href="attachment.cgi?id=77176&action=edit" title="Fixes the crash.">[details]</a> > Fixes the crash. > > There is currently a crash in the Quartz backend when performing certain > operations. it's relatively easy to trigger, and actually happens 7 times in > the test suite. It appears to have been a known problem for almost a year: > <a href="http://lists.freedesktop.org/archives/cairo/2012-April/022950.html">http://lists.freedesktop.org/archives/cairo/2012-April/022950.html</a> Actually I still cannot reproduce the issue (fun fact: I don't get the crash even if I release the cgDrawContext multiple times, so there might be some kind of auto-ignore in the libs I'm using). I'm running Lion (10.7.5) with an up-to-date development environment. What environment should I use to reproduce the crashes on 9e0748e223cfb8c5557c73f3ab5068ec1323e7c2 ? Side note: the CGContextRelease(status->cgDrawContext) is hit in 21 tests, yet only 7 were crashing, so there might be something more to be fixed. > > When the problem is triggered, CoreGraphics prints several error messages > similar to the following: > context_reclaim: invalid context 0x1da71050 > context_finalize: invalid context 0x1da71050 > > Then there is a hard crash: > malloc: *** error for object 0x24485004: incorrect > checksum for freed object - object was probably modified after being freed. > [snip] > 4 libsystem_c.dylib 0x9889b4ec abort + 168 > 5 libsystem_c.dylib 0x98885227 szone_error + 443 > 6 libsystem_c.dylib 0x98886482 > free_list_checksum_botch + 50 > 7 libsystem_c.dylib 0x98886564 > tiny_free_list_remove_ptr + 112 > 8 libsystem_c.dylib 0x9887ff11 szone_free + 993 > 9 CoreFoundation 0x954cad38 > __CFAllocatorSystemDeallocate + 24 > 10 CoreFoundation 0x954cad18 CFAllocatorDeallocate > + 232 > 11 CoreFoundation 0x954caa7a CFRelease + 2042 > 12 libcairo.2.dylib 0x06615d25 > _cairo_quartz_teardown_state + 117 > 13 libcairo.2.dylib 0x06616fba _cairo_quartz_cg_fill > + 378 > 14 libcairo.2.dylib 0x0656318b > _cairo_compositor_fill + 251 > 15 libcairo.2.dylib 0x06618375 > _cairo_quartz_surface_fill + 165 > 16 libcairo.2.dylib 0x065d42eb _cairo_surface_fill + > 315 > 17 libcairo.2.dylib 0x0656fbdc _cairo_gstate_fill + > 812 > 18 libcairo.2.dylib 0x06567e8c > _cairo_default_context_fill + 44 > 19 libcairo.2.dylib 0x0655a69b cairo_fill + 43 > > > I'm pretty sure the problem is that _cairo_quartz_teardown_state is > releasing something it doesn't own. It does: > CGContextRelease (state->cgDrawContext); > > But, the only places that this field is assigned, it comes from a *Get* > function and is therefore not owned by the caller, and is not ref'fed either: > state->cgDrawContext = CGLayerGetContext (state->layer); Sorry, my fault. > > Since the state also keeps a reference to the layer that owns the context, > ref'ing it would be redundant. Instead, I just removed the superfluous > CGContextRelease. > > The attaches patch fixes the 7 crashes in the test suite, and the crashes in > the application I'm working on. The patch looks good (and it has already been pushed to master).</pre> </div> <hr> You are receiving this mail because: <ul> <li>You are the QA Contact for the bug.</li> </ul> </body> </html>