[cairo] Random crash in cairo via gtk/gdk under win32

[Anton Fedorov]

Hello!

I'm seems to be in stuck.
My app randomly crashes, rare (around 1 times per 2 days avg), but i can't get why.

Windows shows that in its crash log:
Module:   libcairo-2.dll
Module timestamp:   4ecb6fdf
Exception code: c0000005
Exception offset:    000205bd
Additional information 1:  0a9e
Additional information 2:  0a9e372d3b4ad19135b953a78882e789
Additional information 3:  0a9e
Additional information 4:  0a9e372d3b4ad19135b953a78882e789
Code:    3658371899

I have enabled minidumps, but that doesn't help much.
Minidump prepared in several ways attached.

I have used gtk all-in-one bundle, so there no .pdb symbols to get info; BUT.

crash is at: libcairo_2!cairo_image_surface_get_data+0x9
disasm at that place:
  Wine-dbg>disas
  0x02fa05bd: cmpl	$0x3073e20,0x0(%eax)
  0x02fa05c3: jnz	0x02fa05d0
  0x02fa05c5: movl	0x108(%eax),%eax
  0x02fa05cb: leave
  0x02fa05cc: ret
  0x02fa05cd: leal	0x0(%esi),%esi
  0x02fa05d0: movl	$0xd,0x0(%esp)
  0x02fa05d7: call	0x02f8d924
  0x02fa05dc: xorl	%eax,%eax
  0x02fa05de: leave

So it seems, that crash itself on cast at line:
   cairo_image_surface_t *image_surface = (cairo_image_surface_t *) surface

And argument is zero ( EAX:00000000 ).

According to stack backtrace, call to it from gdk:
  0:000> dds ebp
  0018ef68  0018f3f8
  0018ef6c  6c38d268 libgdk_win32_2_0_0!gdk_window_set_startup_id+0x3144

But since i haven't symbol codes, i'm unsure exact place.

    find . -name '*.c' | xargs grep cairo_image_surface_get_data
in gtk sources gives only one place, from where call can be:
   gdk/win32/gdkpixmap-win32.c

In function  GdkPixmap* _gdk_pixmap_new
  if (depth != 15 && depth != 16)
  {
    ....
      /* Cairo_win32_surface_get_image() returns NULL on failure, but
         this is likely an oversight and future versions will return a
         "nil" surface.
       */
      image_surface = cairo_win32_surface_get_image (dib_surface);
      if (image_surface == NULL ||
          cairo_surface_status (image_surface) != CAIRO_STATUS_SUCCESS)
      {
        cairo_surface_destroy (dib_surface);
        g_object_unref ((GObject*) pixmap);
        return NULL;
      }
      bits = cairo_image_surface_get_data (image_surface);
  }

According to that code, cairo_image_surface_get_data called only if
cairo_win32_surface_get_image successfully returned some surface.

And there i can't understand now how that possible -- get_data called with zero
argument (eax=0), but it can't be called with zero argument (if
image_surface==NULL => return NULL).

Plus, crash occurs randomly, i can't create stable reproduce environment, and it
never occurs in test env -- only on production :(

May be anyone know how/where/way to debug/found sqrt(evil_bug) ?

-- 
Regards,
Anton Fedorov
Call2ru service
E-Mail: datacompboy at call2ru.com
Jabber: datacompboy at call2ru.com
Skype: datacompboy
ICQ: 272-35-262
Mobile: +7-913-925-7974 [SMS 24h, Call 05:00-19:00 MSKT (GMT+3)]
-------------- next part --------------
A non-text attachment was scrubbed...
Name: himlab4.exe.4884.log.gz
Type: application/x-gzip
Size: 17218 bytes
Desc: not available
URL: <http://lists.cairographics.org/archives/cairo/attachments/20130702/941d4b28/attachment-0003.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: himlab4.exe.4884.log2.gz
Type: application/x-gzip
Size: 4537 bytes
Desc: not available
URL: <http://lists.cairographics.org/archives/cairo/attachments/20130702/941d4b28/attachment-0004.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: himlab4.exe.4884.log3.gz
Type: application/x-gzip
Size: 7422 bytes
Desc: not available
URL: <http://lists.cairographics.org/archives/cairo/attachments/20130702/941d4b28/attachment-0005.bin>