[cairo] Possible double free error (Cairo 1.4.12)

[Jan Slupski]

Hello,

I have a bit imprecise question, but maybe somebody will get any
ideas...

I got the report of Cairo 1.4.12 possible double free error, but
unfortunately, the bug isn't easily reproducible - that's why I'm unable
to provide more specific bug report as of now.

Here is a callstack:
#0  0x0000003503b2e25d in raise () from /lib64/tls/libc.so.6
#1  0x0000003503b2fa5e in abort () from /lib64/tls/libc.so.6
#2  0x0000003503b635e1 in __libc_message () from /lib64/tls/libc.so.6
#3  0x0000003503b691ee in _int_free () from /lib64/tls/libc.so.6
#4  0x0000003503b69586 in free () from /lib64/tls/libc.so.6
#5  0x0000002a95561126 in li_free (pUserData=0x2ad380e6b8) at /home/Mbuilder/views/Mbuilder_main_dbg_view/Kernel/SourceCode/MsiStackTrace/UnixHooking/memtrace.cpp:2040
#6  0x0000002a95561bb8 in free (p=0x2ad380e6b8) at /home/Mbuilder/views/Mbuilder_main_dbg_view/Kernel/SourceCode/MsiStackTrace/UnixHooking/Linux/memhook.cpp:117
#7  0x0000002aa33dd3be in *INT_cairo_surface_destroy (surface=0x2ad380e6b8) at cairo-surface.c:405
#8  0x0000002aa33e677e in _cairo_pattern_release_surface (pattern=0x4be5a630, surface=0x2ad380e6b8, attributes=0x4be59e90) at cairo-pattern.c:1777
#9  0x0000002aa33d196a in _cairo_image_surface_composite_trapezoids (op=CAIRO_OPERATOR_OVER, pattern=0x4be5a630, abstract_dst=0x2afced1448, antialias=CAIRO_ANTIALIAS_DEFAULT, src_x=44, src_y=55, dst_x=44, dst_y=55, width=78, height=29, traps=0x2afc8114b8, num_traps=3) at cairo-image-surface.c:1032
#10 0x0000002aa33deaf7 in _cairo_surface_composite_trapezoids (op=CAIRO_OPERATOR_OVER, pattern=0x4be5a630, dst=0x2afced1448, antialias=CAIRO_ANTIALIAS_DEFAULT, src_x=44, src_y=55, dst_x=44, dst_y=55, width=78, height=29, traps=0x2afc8114b8, num_traps=3) at cairo-surface.c:1501
#11 0x0000002aa33e05fb in _composite_traps_draw_func (closure=0x4be5a240, op=CAIRO_OPERATOR_OVER, src=0x4be5a630, dst=0x2afced1448, dst_x=0, dst_y=0, extents=0x4be5a250) at cairo-surface-fallback.c:501
#12 0x0000002aa33e01fe in _clip_and_composite (clip=0x0, op=CAIRO_OPERATOR_OVER, src=0x4be5a630, draw_func=0x2aa33e04ef <_composite_traps_draw_func>, draw_closure=0x4be5a240, dst=0x2afced1448, extents=0x4be5a250) at cairo-surface-fallback.c:395
#13 0x0000002aa33e09d1 in _clip_and_composite_trapezoids (src=0x4be5a630, op=CAIRO_OPERATOR_OVER, dst=0x2afced1448, traps=0x4be5a300, clip=0x0, antialias=CAIRO_ANTIALIAS_DEFAULT) at cairo-surface-fallback.c:664
#14 0x0000002aa33e0f55 in _cairo_surface_fallback_stroke (surface=0x2afced1448, op=CAIRO_OPERATOR_OVER, source=0x4be5a630, path=0x2ad344cf40, stroke_style=0x2ad344cdc0, ctm=0x4be5a410, ctm_inverse=0x4be5a3e0, tolerance=0.10000000000000001, antialias=CAIRO_ANTIALIAS_DEFAULT) at cairo-surface-fallback.c:847
#15 0x0000002aa33de877 in _cairo_surface_stroke (surface=0x2afced1448, op=CAIRO_OPERATOR_OVER, source=0x4be5a760, path=0x2ad344cf40, stroke_style=0x2ad344cdc0, ctm=0x2ad344cea0, ctm_inverse=0x2ad344ced0, tolerance=0.10000000000000001, antialias=CAIRO_ANTIALIAS_DEFAULT) at cairo-surface.c:1421
#16 0x0000002aa33ce17f in _cairo_gstate_stroke (gstate=0x2ad344cda8, path=0x2ad344cf40) at cairo-gstate.c:975
#17 0x0000002aa33c5c5d in *INT_cairo_stroke_preserve (cr=0x2ad344cd78) at cairo.c:2053
#18 0x0000002aa33c5c22 in cairo_stroke (cr=0x2ad344cd78) at cairo.c:2027

Eventually I can try upgrading Cairo to the newest 1.6.x version, but
due the fact that application is used under heavy multithread load, and
Cairo still didn't adopt David Turner's patches, it would mean that I
need to port these to the new branch first. I'm going to try that if you
think that there is any chance that the upgrade may make any difference.

So, I'll work to get more specific bug report (code snippet?), but any
ideas you might have - what can be going wrong, or how to debug the
possible problem would be very helpful...


Thanks,
Jan


    _  _  _  _  _____________________________________________
    | |_| |\ |  S L U P S K I             jslupski at juljas.net
  |_| | | | \|                             http://juljas.net/