[cairo] cairo_surface_create_similar_image() crashes on W32

[LRN]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

A simple testcase is attached.

Compile it with:

g++ ./crash.cpp -o ./crash.exe -lcairo -I/mingw/include/cairo

run it:

$ ./cairo-gdi-demo.exe
Assertion failed!

Program: C:\foobar\cairo-gdi-demo.exe
File: ../../cairo-1.12.14/src/cairo-surface.c, Line 930

Expression: CAIRO_REFERENCE_COUNT_HAS_REFERENCE (&surface->ref_count)

This application has requested the Runtime to terminate it in an unusual
way.
Please contact the application's support team for more information.

- -- 
O< ascii ribbon - stop html email! - www.asciiribbon.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (MingW32)

iQEcBAEBAgAGBQJSFy6iAAoJEOs4Jb6SI2CwYKsH/jY/1XLRxFwu1W1ythFNY1/7
liN5vvMf2o7NMprQqmxZv6eNqUjjZ6iWGi4psYsRYf521rpgzyeQXlu49hE6e+0c
6TE7MsocBsxrp50OyhI1SwSVkWrH7HYJUTvk7+c3PD1/nFsVpuitYpL3CTL5oPd3
4rxI5wHvcpjr23ldPEzwpTV284QAJsVOstudhm3D5pwq0VLy9Cw+Fe0XD9CEEnP9
ANs9vpOe84jxAIQpFwk4yHbyDzI3Q1wrmGKHyguOEFbHZYm8XN/G1XGkzLgufCjX
OXRR85LYy8fLEtlRvdZL01U5EW8odDXZV2bPjmlhGu3r0aJcuzrRU9KqkXgG9aM=
=hJDZ
-----END PGP SIGNATURE-----
-------------- next part --------------
#include <windows.h>
#include "cairo-win32.h"

LRESULT onPaint (HWND hwnd, WPARAM wParam, LPARAM lParam)
{
  PAINTSTRUCT ps ;
  HDC hdc;
  cairo_surface_t *surface;
  cairo_surface_t *isurface;

  hdc = BeginPaint (hwnd, &ps);

  surface = cairo_win32_surface_create (hdc);
  isurface = cairo_surface_create_similar_image (surface, CAIRO_FORMAT_ARGB32, 24, 24);
  cairo_surface_destroy (isurface);
  cairo_surface_destroy (surface);

  EndPaint (hwnd, &ps);

  return 0;
}

LRESULT CALLBACK WndProc( HWND hwnd,UINT msg,WPARAM wParam,LPARAM lParam ) {
  switch(msg) {
    case WM_PAINT: return onPaint( hwnd, wParam, lParam );
    default: return DefWindowProc(hwnd,msg,wParam,lParam);
  }
}

int WINAPI WinMain (HINSTANCE hInst, HINSTANCE hPrev, LPSTR args, int nShow)
{
  MSG msg;
  WNDCLASS wc;
  HWND hwnd;

  memset (&wc, 0, sizeof (wc));
  wc.lpszClassName = "CairoDemo";
  wc.hInstance     = hInst;
  wc.hbrBackground = GetSysColorBrush (COLOR_3DFACE);
  wc.lpfnWndProc   = WndProc;
  wc.hCursor       = LoadCursor (0, IDC_ARROW);
  RegisterClass(&wc);

  hwnd = CreateWindowA (wc.lpszClassName, "Cairo crash demo", WS_OVERLAPPEDWINDOW, 0, 0, 100, 100, 0, 0, hInst, 0);
  ShowWindow (hwnd, SW_SHOWNORMAL);

  while (GetMessage (&msg, 0, 0, 0) > 0)
  {
    TranslateMessage (&msg);
    DispatchMessage (&msg);
  }
  return 0;
}