I've started working on this, and I've learned a few things. But I've discovered something very puzzling, which I thought I should mention. The crashes happen [here](https://hg.mozilla.org/mozilla-central/file/15c1262d6e8f4524fa63dcc9cc2572038ffb3a92/gfx/cairo/cairo/src/cairo-quartz-surface.c#l875). `image_surface` (of type `cairo_image_surface_t`) has been "acquired" [above](https://hg.mozilla.org/mozilla-central/file/15c1262d6e8f4524fa63dcc9cc2572038ffb3a92/gfx/cairo/cairo/src/cairo-quartz-surface.c#l847). Now the code [has allocated `image_data`](https://hg.mozilla.org/mozilla-central/file/15c1262d6e8f4524fa63dcc9cc2572038ffb3a92/gfx/cairo/cairo/src/cairo-quartz-surface.c#l864) and is trying to copy the contents of `image_surface->data` to it. The allocation doesn't fail, and is the correct size. I haven't yet determined whether the amount of data being copied is correct -- whether `image_surface->data` might contain less data than expected. Since the crash address is the value in the `rsi` register (i.e. `image_surface->data`), this seems likely. But along the way I've discovered that, when a `cairo_image_surface_t` is being initialized (by [`_cairo_image_surface_init()`](https://hg.mozilla.org/mozilla-central/file/15c1262d6e8f4524fa63dcc9cc2572038ffb3a92/gfx/cairo/cairo/src/cairo-image-surface.c#l158)), all its fields are filled with the value (`kAllocPoison` == `0xe5`) jemalloc uses to poison freed memory. Since this object is newly allocated, it *should* have been filled with the value (`kAllocJunk` == `0xe4`) that jemalloc uses to poison newly allocate memory. Does anyone know what's going on?
Bug 1719215 Comment 11 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
I've started working on this, and I've learned a few things. But I've discovered something very puzzling, which I thought I should mention. The crashes happen [here](https://hg.mozilla.org/mozilla-central/file/15c1262d6e8f4524fa63dcc9cc2572038ffb3a92/gfx/cairo/cairo/src/cairo-quartz-surface.c#l875). `image_surface` (of type `cairo_image_surface_t`) has been "acquired" [above](https://hg.mozilla.org/mozilla-central/file/15c1262d6e8f4524fa63dcc9cc2572038ffb3a92/gfx/cairo/cairo/src/cairo-quartz-surface.c#l847). Now the code [has allocated `image_data`](https://hg.mozilla.org/mozilla-central/file/15c1262d6e8f4524fa63dcc9cc2572038ffb3a92/gfx/cairo/cairo/src/cairo-quartz-surface.c#l864) and is trying to copy the contents of `image_surface->data` to it. The allocation doesn't fail, and is the correct size. I haven't yet determined whether the amount of data being copied is correct -- whether `image_surface->data` might contain less data than expected. Since the crash address is the value in the `rsi` register (i.e. `image_surface->data`), this seems likely. But along the way I've discovered that, when a `cairo_image_surface_t` is being initialized (by [`_cairo_image_surface_init()`](https://hg.mozilla.org/mozilla-central/file/15c1262d6e8f4524fa63dcc9cc2572038ffb3a92/gfx/cairo/cairo/src/cairo-image-surface.c#l158)), all its fields are filled with the value (`kAllocPoison` == `0xe5`) jemalloc uses to poison freed memory. Since this object is newly allocated, it *should* have been filled with the value (`kAllocJunk` == `0xe4`) that jemalloc uses to poison newly allocated memory. Does anyone know what's going on?
I've started working on this, and I've learned a few things. But I've discovered something very puzzling, which I thought I should mention. The crashes happen [here](https://hg.mozilla.org/mozilla-central/file/15c1262d6e8f4524fa63dcc9cc2572038ffb3a92/gfx/cairo/cairo/src/cairo-quartz-surface.c#l875). `image_surface` (of type `cairo_image_surface_t`) has been "acquired" [above](https://hg.mozilla.org/mozilla-central/file/15c1262d6e8f4524fa63dcc9cc2572038ffb3a92/gfx/cairo/cairo/src/cairo-quartz-surface.c#l847). Now the code [has allocated `image_data`](https://hg.mozilla.org/mozilla-central/file/15c1262d6e8f4524fa63dcc9cc2572038ffb3a92/gfx/cairo/cairo/src/cairo-quartz-surface.c#l864) and is trying to copy the contents of `image_surface->data` to it. The allocation doesn't fail, and is the correct size. I haven't yet determined whether the amount of data being copied is correct -- whether `image_surface->data` might contain less data than expected. Since the crash address is the value in the `rsi` register (i.e. `image_surface->data`), this seems likely. But along the way I've discovered that, when a `cairo_image_surface_t` object is being initialized (by [`_cairo_image_surface_init()`](https://hg.mozilla.org/mozilla-central/file/15c1262d6e8f4524fa63dcc9cc2572038ffb3a92/gfx/cairo/cairo/src/cairo-image-surface.c#l158)), all its fields are filled with the value (`kAllocPoison` == `0xe5`) jemalloc uses to poison freed memory. Since this object is newly allocated, it *should* have been filled with the value (`kAllocJunk` == `0xe4`) that jemalloc uses to poison newly allocated memory. Does anyone know what's going on?
I've started working on this, and I've learned a few things. But I've discovered something very puzzling, which I thought I should mention. The crashes happen [here](https://hg.mozilla.org/mozilla-central/file/15c1262d6e8f4524fa63dcc9cc2572038ffb3a92/gfx/cairo/cairo/src/cairo-quartz-surface.c#l875). `image_surface` (of type `cairo_image_surface_t`) has been "acquired" [above](https://hg.mozilla.org/mozilla-central/file/15c1262d6e8f4524fa63dcc9cc2572038ffb3a92/gfx/cairo/cairo/src/cairo-quartz-surface.c#l847). Now the code [has allocated `image_data`](https://hg.mozilla.org/mozilla-central/file/15c1262d6e8f4524fa63dcc9cc2572038ffb3a92/gfx/cairo/cairo/src/cairo-quartz-surface.c#l864) and is trying to copy the contents of `image_surface->data` to it. The allocation doesn't fail, and is the correct size. I haven't yet determined whether the amount of data being copied is correct -- whether `image_surface->data` might contain less data than expected. Since the crash address is the value in the `rsi` register (i.e. `image_surface->data`), this seems likely. But along the way I've discovered that, when a `cairo_image_surface_t` object is being initialized (by [`_cairo_image_surface_init()`](https://hg.mozilla.org/mozilla-central/file/15c1262d6e8f4524fa63dcc9cc2572038ffb3a92/gfx/cairo/cairo/src/cairo-image-surface.c#l158)), all its fields are filled with the value (`kAllocPoison` == `0xe5`) jemalloc uses to poison freed memory. Since this object is newly allocated ([here](https://hg.mozilla.org/mozilla-central/file/15c1262d6e8f4524fa63dcc9cc2572038ffb3a92/gfx/cairo/cairo/src/cairo-image-surface.c#l189)), it *should* have been filled with the value (`kAllocJunk` == `0xe4`) that jemalloc uses to poison newly allocated memory. Does anyone know what's going on?