[cairo] Cairo crash with a simple stroke (win32)

[Fred bca21]

Hi,

I am new to this list but I have been using cairo and monitoring posts
for a couple of months now. I have a strange issue on windows when the
intersection between the clipping region and the drawing is very
small, so I am posting here with the hope that someone can help (I am
a bit too new to cairo's internals to debug this problem).

Typically, the simple code below crashes (I am using a DDB bitmap for
the example, but it also crashes with any DC).

#include "cairo.h"
#include "cairo-win32.h"
#include <windows.h>
{
// build a bitmap (same issue with DIB, whatever the bit depth)
HDC dc=::CreateCompatibleDC(NULL);
HBITMAP hBmp=::CreateCompatibleBitmap(dc,100,200);
::SelectObject(dc,hBmp);

// set clip region for the DC to one single line in the middle of the bitmap
HRGN hrgn = CreateRectRgn(0,100,100, 101);
SelectClipRgn(dc, hrgn);
::DeleteObject(hrgn);

// create cairo context
cairo_surface_t* surface=cairo_win32_surface_create(dc);
if(surface)
{
cairo_t* context=cairo_create(surface);
if(context)
{
// draw one line
cairo_move_to(context,1, 1);
cairo_line_to(context,10,120);
cairo_set_source_rgb(context,1,1,1);

// CRASHES HERE (see below):
cairo_stroke(context);

// cleanup
cairo_destroy(context);
}
cairo_surface_destroy(surface);
}
}

The crash occurs in cairo-image-compositor.c, on line 2197, in
_fill_xrgb32_lerp_opaque_spans():

		} else while (len--) {
                    // On this line below, d has an invalid address
		    *d = lerp8x4 (r->u.fill.pixel, a, *d);
		    d++;
		}

If it may help, am using the static lib version of the latest release
(1.12.4 - pixman 26.2), and it crashes in debug or release mode, 32 or
64-bit windows. It's too bad because this crash occurs all the time in
my code that extensively uses clipping regions!

This crash also occurs with the previous version of cairo (1.12.2) and
pixman 26.0, but at a different stage (in pixman if I remember well),