[cairo-bugs] [Bug 62885] New: [Patch] Fix for crasher in quartz backend

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=62885

          Priority: medium
            Bug ID: 62885
          Assignee: vladimir at pobox.com
           Summary: [Patch] Fix for crasher in quartz backend
        QA Contact: cairo-bugs at cairographics.org
          Severity: normal
    Classification: Unclassified
                OS: All
          Reporter: m.j.hutchinson at gmail.com
          Hardware: Other
            Status: NEW
           Version: 1.12.14
         Component: quartz backend
           Product: cairo

Created attachment 77176
  --> https://bugs.freedesktop.org/attachment.cgi?id=77176&action=edit
Fixes the crash.

There is currently a crash in the Quartz backend when performing certain
operations. it's relatively easy to trigger, and actually happens 7 times in
the test suite. It appears to have been a known problem for almost a year:
http://lists.freedesktop.org/archives/cairo/2012-April/022950.html

When the problem is triggered, CoreGraphics prints several error messages
similar to the following:
context_reclaim: invalid context 0x1da71050
context_finalize: invalid context 0x1da71050

Then there is a hard crash:
malloc: *** error for object 0x24485004: incorrect
checksum for freed object - object was probably modified after being freed.
[snip]
    4   libsystem_c.dylib                   0x9889b4ec abort + 168
    5   libsystem_c.dylib                   0x98885227 szone_error + 443
    6   libsystem_c.dylib                   0x98886482 free_list_checksum_botch
+ 50
    7   libsystem_c.dylib                   0x98886564
tiny_free_list_remove_ptr + 112
    8   libsystem_c.dylib                   0x9887ff11 szone_free + 993
    9   CoreFoundation                      0x954cad38
__CFAllocatorSystemDeallocate + 24
    10  CoreFoundation                      0x954cad18 CFAllocatorDeallocate +
232
    11  CoreFoundation                      0x954caa7a CFRelease + 2042
    12  libcairo.2.dylib                    0x06615d25
_cairo_quartz_teardown_state + 117
    13  libcairo.2.dylib                    0x06616fba _cairo_quartz_cg_fill +
378
    14  libcairo.2.dylib                    0x0656318b _cairo_compositor_fill +
251
    15  libcairo.2.dylib                    0x06618375
_cairo_quartz_surface_fill + 165
    16  libcairo.2.dylib                    0x065d42eb _cairo_surface_fill +
315
    17  libcairo.2.dylib                    0x0656fbdc _cairo_gstate_fill + 812
    18  libcairo.2.dylib                    0x06567e8c
_cairo_default_context_fill + 44
    19  libcairo.2.dylib                    0x0655a69b cairo_fill + 43


I'm pretty sure the problem is that _cairo_quartz_teardown_state is releasing
something it doesn't own. It does:
CGContextRelease (state->cgDrawContext);

But, the only places that this field is assigned, it comes from a *Get*
function and is therefore not owned by the caller, and is not ref'fed either:
state->cgDrawContext = CGLayerGetContext (state->layer);

Since the state also keeps a reference to the layer that owns the context,
ref'ing it would be redundant. Instead, I just removed the superfluous
CGContextRelease.

The attaches patch fixes the 7 crashes in the test suite, and the crashes in
the application I'm working on.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cairographics.org/archives/cairo-bugs/attachments/20130328/ffbcc1e1/attachment.html>