[cairo-bugs] [Bug 91431] New: AddressSanitizer: heap-use-after-free: attaching concurrently many snapshots to a surface

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=91431

            Bug ID: 91431
           Summary: AddressSanitizer: heap-use-after-free: attaching
                    concurrently many snapshots to a surface
           Product: cairo
           Version: unspecified
          Hardware: Other
                OS: All
            Status: NEW
          Severity: normal
          Priority: medium
         Component: general
          Assignee: chris at chris-wilson.co.uk
          Reporter: sixtysix at inwind.it
        QA Contact: cairo-bugs at cairographics.org

Created attachment 117300
  --> https://bugs.freedesktop.org/attachment.cgi?id=117300&action=edit
AddressSanitizer report

Running few times (in a bash loop)

> (cd test; CAIRO_TEST_TARGET_FORMAT=rgba CAIRO_TEST_TARGET=recording ./cairo-test-suite -f pthread-same-source )

on a multi core machine AddressSanitizer once in a while reports:

> ERROR: AddressSanitizer: heap-use-after-free on address 0x61500000fa98 at pc 0x7f638c08d2ef bp 0x7ffeeba49f70 sp 0x7ffeeba49f60

The problem is that when multiple threads attach concurrently a snapshot
to the same surface as test/pthread-same-source.c does, the list of
snapshots attached to the surface possibly becomes corrupt and when
the surface is destroyed not all snapshots are notified to copy on write
their snapshot, one of them keeps a pointer to the surface destroyed,
when later that snapshot is used it accesses the freed data.

Basically cairo_list_t is not thread safe.

Building without optimizations 

export CFLAGS=-g
./autogen.sh ...

running the same test sometimes instead triggers the assertion: 

> lt-cairo-test-suite: cairo-surface.c:371: _cairo_surface_attach_snapshot: Assertion `_cairo_surface_has_snapshot (surface, snapshot->backend) == snapshot' failed.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cairographics.org/archives/cairo-bugs/attachments/20150722/3130dcf6/attachment.html>