Bug 11855

Summary: Segfault with cairo_pattern_set_user_data
Product: cairo Reporter: Yevgen Muntyan <muntyan>
Component: generalAssignee: Carl Worth <cworth>
Status: RESOLVED FIXED QA Contact: cairo-bugs mailing list <cairo-bugs>
Severity: critical    
Priority: medium    
Version: 1.5.1   
Hardware: Other   
OS: All   
Whiteboard:
i915 platform: i915 features:
Attachments: test case

Description Yevgen Muntyan 2007-08-05 22:00:10 UTC 
See attached program (tutorial one, modified). In short, this segfaults:

cairo_pattern_set_user_data (pattern, ...);
cairo_mask (cr, pattern);

A related question: does any cairo function ever return a pattern_t object which was passed to any other function at some point? I am using cairo_pattern_set_user_data() to make sure I don't have many wrapper objects for the same cairo object in a language binding, so this bug is kind of a show stopper for me.
Comment 1 Yevgen Muntyan 2007-08-05 22:00:48 UTC 
Created attachment 11002 [details]
test case
Comment 2 Carl Worth 2007-08-06 08:42:17 UTC 
The bug is quite obvious. We're creating a copy of the pattern without
also copying the user_data array. I wonder if there aren't similar
problems stemming from the time user_data was added to most
user-visible objects, (though many of them might not have copy
functions).

There are definitely some additions needed to the test suite here.

(More after breakfast...)

-Carl
Comment 3 Behdad Esfahbod 2007-08-06 10:58:58 UTC 
If we are copying the pattern we probably should not copy the user-data array, right?
Comment 4 Carl Worth 2007-08-06 11:10:41 UTC 
(In reply to comment #3)
> If we are copying the pattern we probably should not copy the user-data array,
> right?

Indeed not. Here's a patch (that I just pushed). And no, I will not be bothered to make any bugzilla attachments. :-)

-Carl

commit 13cae8b5e6d3fc93c4eb1853b91ba356b572b551
Author: Carl Worth <cworth@cworth.org>
Date:   Mon Aug 6 11:06:47 2007 -0700

    Ensure that a copied pattern gets its own user_data array
    
    This fixes the bug reported here:
    
        Segfault with cairo_pattern_set_user_data
        https://bugs.freedesktop.org/show_bug.cgi?id=11855

diff --git a/src/cairo-pattern.c b/src/cairo-pattern.c
index 24efa34..2fd1c87 100644
--- a/src/cairo-pattern.c
+++ b/src/cairo-pattern.c
@@ -185,7 +185,9 @@ _cairo_pattern_init_copy (cairo_pattern_t   *pattern,
     } break;
     }
 
+    /* The reference count and user_data array are unique to the copy. */
     pattern->ref_count = 1;
+    _cairo_user_data_array_init (&pattern->user_data);
 
     return CAIRO_STATUS_SUCCESS;
 }

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.