On Wed, 2008-02-27 at 06:03 -0800, bugzilla-daemon at freedesktop.org
wrote:
[snip]
> "#0 0xb7556968 in _cairo_surface_is_image (surface=0x0)
> at /build/buildd/cairo-1.5.8/src/cairo-image-surface.c:1257
> No locals.
> #1 0x0808b4be in paint_surface (cr=0x860f4f0, surface=0x0, x_offset=0,
> y_offset=0, alpha=0, page_area=
> {x = 0, y = 0, width = 1035, height = 800})
> at /build/buildd/evince-2.21.91/./shell/ev-transition-animation.c:197
> width = 140519960
> height = <value optimized out>
Snippet of evince/shell/ev-transition-animation.c:197:
static void
paint_surface (cairo_t *cr,
cairo_surface_t *surface,
gdouble x_offset,
gdouble y_offset,
gdouble alpha,
GdkRectangle page_area)
{
gint width, height;
gdk_cairo_rectangle (cr, &page_area);
cairo_clip (cr);
width = cairo_image_surface_get_width (surface);
height = cairo_image_surface_get_height (surface);
cairo_save (cr);
Now although this is clearly a bug in evince - passing a NULL surface to
be used as a source to copy on to its GDK window - the question is
whether cairo should crash given such input?
The argument for crashing early is to force the developers of the broken
app to fix it quickly. Alternatively we can look at the lax input
validation combined with inadequate error reporting as our problem.
What I propose is that we replace all checks like surface->status with a
call to cairo_surface_status(surface) and insert NULL pointer checks
into cairo_surface_status() and friends. And obviously add the missing
guard to the public entry points. I've attached a few patches which
should illustrate the changes, but as they as currently based on my
memfault branch (I was waiting for 1.6 before suggesting such changes!)
they may need a little futzing. Further along this path is to improve
the error reporting with a pool of dynamic error objects (i.e. to avoid
always returning a NO_MEMORY nil object).
--
Chris Wilson
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0051-cairo-Use-cairo_status-rather-than-open-coding-c.patch
Type: application/mbox
Size: 0 bytes
Desc:
Url : http://lists.cairographics.org/archives/cairo/attachments/20080227/fd2bbc85/attachment-0007.bin