Bug 10165

Summary:	Cairo crashes on complex multipath curve
Product:	cairo	Reporter:	Igor Novikov <igor.e.novikov>
Component:	xlib backend	Assignee:	Carl Worth <cworth>
Status:	CLOSED FIXED	QA Contact:	cairo-bugs mailing list <cairo-bugs>
Severity:	normal
Priority:	high
Version:	1.3.9
Hardware:	x86 (IA32)
OS:	Linux (All)
Whiteboard:
i915 platform:		i915 features:

Description Igor Novikov 2007-03-02 17:19:00 UTC

Complex multipath curve results Cairo crash without any error message. Application just disappeares. Sample curve you can find on following link:

http://sk1.sf.net/screenshots/cairo/cairo_test.svg

This bug is reproduced on sK1 app. sK1 has two renderers: Xlib based and Cairo based. Test curve doesn't crash Xlib-based renderer as for wireframe and for normal view:

http://sk1.sf.net/screenshots/cairo/sk2_cairo_wireframe.png

Cairo-based renderer works well for wireframe mode:

http://sk1.sf.net/screenshots/cairo/sk2_cairo_wireframe.png

but for normal view it is crashed. Simple tracing shows that that problem cause is cairo_fill() function call. Tolerance increasing using cairo_set_tolerance() slightly improve situation, but if number of paths in this curve will be increased, Cairo crashes anyway.

We use x11-backend for direct painting on canvas. The testcase was specially created to reproduce problem avoiding any additional factors. Usually we got such failure on text converted to curve:

http://sk1.sf.net/screenshots/for_lor.png

To produce this screen the text on canvas was splitted on separate lines. Even two text lines combined in one curve results Cairo crash. For non complex curves which have not multipath content Cairo works fine:

http://sk1.sf.net/screenshots/cairo/sk1_cairo_car1.png
http://sk1.sf.net/screenshots/cairo/sk1_cairo_car2.png

This drawing is a bitmap vectorization result (traced in CorelTRACE). Initial ai file size is ~9Mb.

If you will have any additional questions please dotn't hesitate to contact us.

Comment 1 Igor Novikov 2007-03-02 18:12:33 UTC

Sorry, for Xlib-based renderer screenshot should be following link:

http://sk1.sf.net/screenshots/cairo/sk1_xlib.png

Comment 2 Behdad Esfahbod 2007-04-03 16:39:23 UTC

How many items in the curve are we talking about here?
Can you attach a simple svg that when viewed by rsvg-view, crashes cairo?
Or any other simple test case?

Comment 3 Igor Novikov 2007-04-04 18:46:51 UTC

This curve contains 192 paths and 768 nodes.
It seems this bug cannot be reproduced using rsvg-view because librsvg uses Cairo Image Surface but not Xlib Surface.

Comment 4 Igor Novikov 2007-06-01 00:41:29 UTC

This bug is fixed in Cairo 1.4.6. Now Cairo works for sK1 like a sharm! You can test it on sK1 which now available in SF repository.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.