[cairo-bugs] [Bug 62885] [Patch] Fix for crasher in quartz backend

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=62885

--- Comment #2 from Andrea Canciani <ranma42 at gmail.com> ---
(In reply to comment #0)
> Created attachment 77176 [details]
> Fixes the crash.
> 
> There is currently a crash in the Quartz backend when performing certain
> operations. it's relatively easy to trigger, and actually happens 7 times in
> the test suite. It appears to have been a known problem for almost a year:
> http://lists.freedesktop.org/archives/cairo/2012-April/022950.html

Actually I still cannot reproduce the issue (fun fact: I don't get the crash
even if I release the cgDrawContext multiple times, so there might be some kind
of auto-ignore in the libs I'm using).
I'm running Lion (10.7.5) with an up-to-date development environment.
What environment should I use to reproduce the crashes on
9e0748e223cfb8c5557c73f3ab5068ec1323e7c2 ?

Side note: the CGContextRelease(status->cgDrawContext) is hit in 21 tests, yet
only 7 were crashing, so there might be something more to be fixed.

> 
> When the problem is triggered, CoreGraphics prints several error messages
> similar to the following:
> context_reclaim: invalid context 0x1da71050
> context_finalize: invalid context 0x1da71050
> 
> Then there is a hard crash:
> malloc: *** error for object 0x24485004: incorrect
> checksum for freed object - object was probably modified after being freed.
> [snip]
>     4   libsystem_c.dylib                   0x9889b4ec abort + 168
>     5   libsystem_c.dylib                   0x98885227 szone_error + 443
>     6   libsystem_c.dylib                   0x98886482
> free_list_checksum_botch + 50
>     7   libsystem_c.dylib                   0x98886564
> tiny_free_list_remove_ptr + 112
>     8   libsystem_c.dylib                   0x9887ff11 szone_free + 993
>     9   CoreFoundation                      0x954cad38
> __CFAllocatorSystemDeallocate + 24
>     10  CoreFoundation                      0x954cad18 CFAllocatorDeallocate
> + 232
>     11  CoreFoundation                      0x954caa7a CFRelease + 2042
>     12  libcairo.2.dylib                    0x06615d25
> _cairo_quartz_teardown_state + 117
>     13  libcairo.2.dylib                    0x06616fba _cairo_quartz_cg_fill
> + 378
>     14  libcairo.2.dylib                    0x0656318b
> _cairo_compositor_fill + 251
>     15  libcairo.2.dylib                    0x06618375
> _cairo_quartz_surface_fill + 165
>     16  libcairo.2.dylib                    0x065d42eb _cairo_surface_fill +
> 315
>     17  libcairo.2.dylib                    0x0656fbdc _cairo_gstate_fill +
> 812
>     18  libcairo.2.dylib                    0x06567e8c
> _cairo_default_context_fill + 44
>     19  libcairo.2.dylib                    0x0655a69b cairo_fill + 43
> 
> 
> I'm pretty sure the problem is that _cairo_quartz_teardown_state is
> releasing something it doesn't own. It does:
> CGContextRelease (state->cgDrawContext);
> 
> But, the only places that this field is assigned, it comes from a *Get*
> function and is therefore not owned by the caller, and is not ref'fed either:
> state->cgDrawContext = CGLayerGetContext (state->layer);

Sorry, my fault.

> 
> Since the state also keeps a reference to the layer that owns the context,
> ref'ing it would be redundant. Instead, I just removed the superfluous
> CGContextRelease.
> 
> The attaches patch fixes the 7 crashes in the test suite, and the crashes in
> the application I'm working on.

The patch looks good (and it has already been pushed to master).

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cairographics.org/archives/cairo-bugs/attachments/20130329/535cd723/attachment.html>