Bug 91431

Created attachment 117300 [details]
AddressSanitizer report

Running few times (in a bash loop)

> (cd test; CAIRO_TEST_TARGET_FORMAT=rgba CAIRO_TEST_TARGET=recording ./cairo-test-suite -f pthread-same-source )

on a multi core machine AddressSanitizer once in a while reports:

> ERROR: AddressSanitizer: heap-use-after-free on address 0x61500000fa98 at pc 0x7f638c08d2ef bp 0x7ffeeba49f70 sp 0x7ffeeba49f60

The problem is that when multiple threads attach concurrently a snapshot
to the same surface as test/pthread-same-source.c does, the list of
snapshots attached to the surface possibly becomes corrupt and when
the surface is destroyed not all snapshots are notified to copy on write
their snapshot, one of them keeps a pointer to the surface destroyed,
when later that snapshot is used it accesses the freed data.

Basically cairo_list_t is not thread safe.

Building without optimizations 

export CFLAGS=-g
./autogen.sh ...

running the same test sometimes instead triggers the assertion: 

> lt-cairo-test-suite: cairo-surface.c:371: _cairo_surface_attach_snapshot: Assertion `_cairo_surface_has_snapshot (surface, snapshot->backend) == snapshot' failed.