Mozilla Firefox 3.0.7 using Cairo 1.8.6 crashes on AIX. Below is the stacktrace details. pthread_kill(??, ??) at 0x9000000004786bc _p_raise(??) at 0x9000000004780d0 FatalSignalHandler__13nsProfileLockFi() at 0x100024420 cairo-surface._cairo_surface_clone_similar(surface = 0x0000000110f21510, src = 0x0000000110f21190, src_x = 0, src_y = 0, width = 2, height = 2, clone_offset_x = 0x0fffffffffffd7f0, clone_offset_y = 0x0fffffffffffd7f8, clone_out = 0x0fffffffffffdc88), line 1187 in "cairo-surface.c" unnamed block in cairo-pattern._cairo_pattern_acquire_surface_for_surface(pattern = 0x0fffffffffffd998, dst = 0x0000000110f21510, x = 1, y = 0, width = 2, height = 2, out = 0x0fffffffffffdc88, attr = 0x0fffffffffffdce0), line 1959 in "cairo-pattern.c" cairo-pattern._cairo_pattern_acquire_surface_for_surface(pattern = 0x0fffffffffffd998, dst = 0x0000000110f21510, x = 1, y = 0, width = 2, height = 2, out = 0x0fffffffffffdc88, attr = 0x0fffffffffffdce0), line 1959 in "cairo-pattern.c" unnamed block in cairo-pattern._cairo_pattern_acquire_surface(pattern = 0x0fffffffffffd998, dst = 0x0000000110f21510, x = 0, y = 0, width = 2, height = 2, surface_out = 0x0fffffffffffdc88, attributes = 0x0fffffffffffdce0), line 2075 in "cairo-pattern.c" cairo-pattern._cairo_pattern_acquire_surface(pattern = 0x0fffffffffffd998, dst = 0x0000000110f21510, x = 0, y = 0, width = 2, height = 2, surface_out = 0x0fffffffffffdc88, attributes = 0x0fffffffffffdce0), line 2075 in "cairo-pattern.c" cairo-pattern._cairo_pattern_acquire_surfaces(src = 0x0000000110f21bd0, mask = (nil), dst = 0x0000000110f21510, src_x = 0, src_y = 0, mask_x = 0, mask_y = 0, width = 2, height = 2, src_out = 0x0fffffffffffdc88, mask_out = 0x0fffffffffffdc80, src_attributes = 0x0fffffffffffdce0, mask_attributes = 0x0fffffffffffdc90), line 2168 in "cairo-pattern.c" cairo-image-surface._cairo_image_surface_composite() at 0x10034681c cairo-surface._cairo_surface_composite(op = CAIRO_OPERATOR_SOURCE, src = 0x0000000110f21bd0, mask = (nil), dst = 0x0000000110f21510, src_x = 0, src_y = 0, mask_x = 0, mask_y = 0, dst_x = 0, dst_y = 0, width = 2, height = 2), line 1287 in "cairo-surface.c" _composite_trap_region(clip = (nil), src = 0x0000000110f21bd0, op = CAIRO_OPERATOR_SOURCE, dst = 0x0000000110f21510, trap_region = 0x0fffffffffffe128, extents = 0x0fffffffffffe160), line 455 in "cairo-surface-fallback.c" unnamed block in _clip_and_composite_trapezoids(src = 0x0000000110f21bd0, op = CAIRO_OPERATOR_SOURCE, dst = 0x0000000110f21510, traps = 0x0fffffffffffe278, clip = (nil), antialias = CAIRO_ANTIALIAS_NONE), line 644 in "cairo-surface-fallback.c" _clip_and_composite_trapezoids(src = 0x0000000110f21bd0, op = CAIRO_OPERATOR_SOURCE, dst = 0x0000000110f21510, traps = 0x0fffffffffffe278, clip = (nil), antialias = CAIRO_ANTIALIAS_NONE), line 644 in "cairo-surface-fallback.c" _cairo_surface_fallback_paint(surface = 0x0000000110f21510, op = CAIRO_OPERATOR_SOURCE, source = 0x0000000110f21bd0), line 705 in "cairo-surface-fallback.c" cairo-surface._cairo_surface_paint(surface = 0x0000000110f21510, op = CAIRO_OPERATOR_SOURCE, source = 0x0fffffffffffe418), line 1492 in "cairo-surface.c" cairo-gstate._cairo_gstate_paint(gstate = 0x0000000110f216e0), line 878 in "cairo-gstate.c" _moz_cairo_paint@AF155_71() at 0x10036ec10 _moz_cairo_paint_with_alpha@AF156_70() at 0x10036ed14 Paint__10gfxContextFd() at 0x100336fb4 OptimizeImage__11gfxPlatformFP15gfxImageSurfaceQ2_11gfxASurface14gfxImageFormat() at 0x100381100 Optimize__13nsThebesImageFP16nsIDeviceContext() at 0x100383950 SetMutable__13gfxImageFrameFi@AF43_10() at 0x100e29aec SetMutable__13gfxImageFrameFi() at 0x100e29160 DecodingComplete__12imgContainerFv() at 0x1003ceaa0 EndGIF__13nsGIFDecoder2Fv@AF36_15() at 0x100e2d854 EndGIF__13nsGIFDecoder2Fv() at 0x100e2bc68 Close__13nsGIFDecoder2Fv() at 0x100e2b718 OnStopRequest__10imgRequestFP10nsIRequestP11nsISupportsUi() at 0x1003cc0d8 OnStopRequest__13ProxyListenerFP10nsIRequestP11nsISupportsUi() at 0x1003c556c OnStopRequest__12nsJARChannelFP10nsIRequestP11nsISupportsUi() at 0x9000000097b6358 OnStateStop__17nsInputStreamPumpFv() at 0x1000b34b8 OnInputStreamReady__17nsInputStreamPumpFP19nsIAsyncInputStream() at 0x1000b309c Run__23nsInputStreamReadyEventFv() at 0x90000000969a07c ProcessNextEvent__8nsThreadFiPi() at 0x9000000096a9374 NS_ProcessNextEvent_P__FP9nsIThreadi() at 0x900000009641220 Run__14nsBaseAppShellFv() at 0x100d2aac8 Run__12nsAppStartupFv() at 0x10122e568 XRE_main() at 0x10000dffc main() at 0x10000a6a4
How reproducible is this crash? It would seem to indicate that the cloned surface was invalid, but we failed to report an error. Knowing the contents of *clone_out, src and the various locals might help. Also the real bug is likely in either the backend or the surface fallback, so we may need to dig a little deeper to find the mistake. Thank you for your help.
This crash is consistently reproducible and it is crashing at the same place. File : cairo-surface.c Function :_cairo_surface_clone_similar Line : (*clone_out)->device_transform = src->device_transform; I tried printing the 'device_transform' structure elements of *clone_out and src with '%f' format just before the line where it crashes. As you can see below, some of the structure values (like device_transform::xx, device_transform::xy) of *clone_out are very large numbers. The device_transform structure values for src --------------------------------------------- src:device_transform::xx =1.000000 src:device_transform::xy =0.000000 src:device_transform::yx =0.000000 src:device_transform::yy =1.000000 src:device_transform::x0 =0.000000 src:device_transform::y0 =0.000000 The device_transform structure values for *clone_out --------------------------------------------------- *clone_out:device_transform::xx =351531681203464524010636727616000000000000000000000000000000.000000 *clone_out:device_transform::xy =352950744217554670056361252370000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000.000000 *clone_out:device_transform::yx =295043486840638093569370430875000000.000000 clone_out:device_transform::yy =216053491769879882552292080688000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000.000000 clone_out:device_transform::x0 =0.000000 clone_out:device_transform::y0 =0.000000 Please let me know if you need any further details. I appreciate your help to investigate the root cause for the coredump.
I am still investigating the issue. Any information that you provide would be very helpfull. Thanks, Shailendra
-- GitLab Migration Automatic Message -- This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity. You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/cairo/cairo/issues/177.
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.