[cairo-bugs] [Bug 19655] New: Cairo asserts on font-face destroy (SIGABRT)

[bugzilla-daemon at freedesktop.org]

http://bugs.freedesktop.org/show_bug.cgi?id=19655

           Summary: Cairo asserts on font-face destroy (SIGABRT)
           Product: cairo
           Version: 1.8.6
          Platform: x86 (IA32)
               URL: http://gaphor.devjavu.com/ticket/158
        OS/Version: Mac OS X (All)
            Status: NEW
          Keywords: have-backtrace
          Severity: major
          Priority: high
         Component: general
        AssignedTo: cworth at cworth.org
        ReportedBy: gaphor at gmail.com
         QAContact: cairo-bugs at cairographics.org


I'm using Cairo + PyCairo + GTK+ on Mac OS X 10.5.6. When loading a large file
or in my modeling tool or doing some testing with the canvas library at a
certain point the application crashes with the following message:

Assertion failed: (CAIRO_REFERENCE_COUNT_HAS_REFERENCE
(&font_face->ref_count)), function cairo_font_face_destroy, file
cairo-font-face.c, line 191.
Abort trap (core dumped)

All stack traces produced look like this:

0   libSystem.B.dylib                   0x90c53e42 __kill + 10
1   libSystem.B.dylib                   0x90cc623a raise + 26
2   libSystem.B.dylib                   0x90cd2679 abort + 73
3   libSystem.B.dylib                   0x90cc73db __assert_rtn + 101
4   libcairo.2.dylib                    0x0120e9a6 cairo_font_face_destroy +
150 (cairo-font-face.c:191)
5   libcairo.2.dylib                    0x01225481
_cairo_scaled_font_fini_internal + 65 (cairo-scaled-font.c:725)
6   libcairo.2.dylib                    0x012258ba cairo_scaled_font_destroy +
154 (cairo-scaled-font.c:1066)
7   libcairo.2.dylib                    0x01227da3 cairo_scaled_font_create +
643 (cairo-scaled-font.c:917)
8   libcairo.2.dylib                    0x012117ff
_cairo_gstate_ensure_scaled_font + 111 (cairo-gstate.c:1489)
9   libcairo.2.dylib                    0x012118fe _cairo_gstate_text_to_glyphs
+ 78 (cairo-gstate.c:1531)
10  libcairo.2.dylib                    0x0120ce36 cairo_text_extents + 198
(cairo.c:2983)
11  _cairo.so                           0x007e331c pycairo_text_extents + 60
(pycairo-context.c:1271)
12  org.python.python                   0x00239b2b PyEval_EvalFrameEx + 25131


It appears that the problem is that the ref_count of the font_face reaches 0
and then is destroyed again.
The font being destroyed seems to come from the font_map used to store scaled
donts (cairo_scaled_font_destroy).


#4  0x0120e9a6 in cairo_font_face_destroy (font_face=<value temporarily
unavailable, due to optimizations>) at cairo-font-face.c:191
191         assert (CAIRO_REFERENCE_COUNT_HAS_REFERENCE
(&font_face->ref_count));
(gdb) l
186     {
187         if (font_face == NULL ||
188                 CAIRO_REFERENCE_COUNT_IS_INVALID (&font_face->ref_count))
189             return;
190     
191         assert (CAIRO_REFERENCE_COUNT_HAS_REFERENCE
(&font_face->ref_count));
192     
193         if (! _cairo_reference_count_dec_and_test (&font_face->ref_count))
194             return;
195     
(gdb) p font_face->ref_count
$1 = {
  ref_count = 0
}
(gdb) p font_face
$2 = <value temporarily unavailable, due to optimizations>
(gdb) p *font_face
$3 = {
  hash_entry = {
    hash = 0
  }, 
  status = CAIRO_STATUS_SUCCESS, 
  ref_count = {
    ref_count = 0
  }, 
  user_data = {
    size = 0, 
    num_elements = 0, 
    element_size = 0, 
    elements = 0x0, 
    is_snapshot = 0
  }, 
  backend = 0x0
}

IMHO this is not the desired behaviour. I haven;t been able to create a test
case that triggers this behaviour though.

Some library versions (compiled with MacPorts, although I recompiled Cairo and
PyCairo with debugging symbols):

  cairo @1.8.6_2+macosx (active)
  freetype @2.3.8_0+macosx (active)
  gtk2 @2.14.7_0+x11 (active)
  py25-cairo @1.8.0_0+darwin_9 (active)
  py25-gobject @2.16.0_0+darwin_9 (active)
  py25-gtk @2.12.1_0+darwin_9 (active)
  python25 @2.5.4_0+darwin_9+macosx (active)

Regards,

Arjan Molenaar
http://gaphor.devjavu.com


-- 
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.