414092 - crash at _moz_pixman_image_fill_rectangles

Status: RESOLVED FIXED

(Core :: Graphics, defect, P1)

Description

[Karl Tomlinson (:karlt)]

boxes = pixman_region_rectangles (&fill_region, &n_boxes);
(gdb) fin
Run till exit from #0  _moz_pixman_region_rectangles (region=0x7fffb3134d10, 
    n_rects=0x7fffb3134d0c)
    at /home/karl/moz/mozilla/gfx/cairo/libpixman/src/pixman-region.c:361
0x00002aaaab8b4aac in _moz_pixman_image_fill_rectangles (op=PIXMAN_OP_SRC, 
    dest=0x1280e90, color=0x7fffb3134d30, n_rects=1, rects=0x7fffb3134db0)
    at /home/karl/moz/mozilla/gfx/cairo/libpixman/src/pixman-image.c:688
Value returned is $17 = (pixman_box16_t *) 0x7fffb3134d10
(gdb) n
(gdb) p boxes
$18 = (pixman_box16_t *) 0xffffffffb3134d10

obj/gfx/cairo/libpixman/src% make pixman-image.o
Updating dependencies file, .deps/.all.pp
pixman-image.c
gcc -o pixman-image.o -c  -DMOZILLA_INTERNAL_API -DOSTYPE=\"Linux2.6\" -DOSARCH=Linux -I/home/karl/moz/mozilla/gfx/cairo/libpixman/src -I/home/karl/moz/mozilla/gfx/cairo/libpixman/src/../../cairo/src -I/home/karl/moz/mozilla/gfx/cairo/libpixman/src -I.  -I../../../../dist/include   -I../../../../dist/include/libpixman -I../../../../dist/include/nspr -I/usr/include  -I/usr/include  -I../../../../dist/sdk/include    -fPIC  -Wall -W -Wno-unused -Wpointer-arith -Wcast-align -Wno-long-long -pedantic -pthread -pipe  -DDEBUG -D_DEBUG -DDEBUG_karl -DTRACING -g -fno-inline -DPACKAGE="mozpixman" -D_USE_MATH_DEFINES   -include ../../../../mozilla-config.h -DMOZILLA_CLIENT -Wp,-MD,.deps/pixman-image.pp /home/karl/moz/mozilla/gfx/cairo/libpixman/src/pixman-image.c
In file included from /home/karl/moz/mozilla/gfx/cairo/libpixman/src/pixman-image.c:31:
/home/karl/moz/mozilla/gfx/cairo/libpixman/src/pixman.h:496: warning: comma at end of enumerator list
In file included from /home/karl/moz/mozilla/gfx/cairo/libpixman/src/pixman-image.c:32:
/home/karl/moz/mozilla/gfx/cairo/libpixman/src/pixman-private.h:32:1: warning: "DEBUG" redefined
<command line>:1:1: warning: this is the location of the previous definition
/home/karl/moz/mozilla/gfx/cairo/libpixman/src/pixman-image.c: In function 'allocate_image':
/home/karl/moz/mozilla/gfx/cairo/libpixman/src/pixman-image.c:83: warning: implicit declaration of function '_moz_pixman_region_init'
/home/karl/moz/mozilla/gfx/cairo/libpixman/src/pixman-image.c: In function '_moz_pixman_image_unref':
/home/karl/moz/mozilla/gfx/cairo/libpixman/src/pixman-image.c:121: warning: implicit declaration of function '_moz_pixman_region_fini'
/home/karl/moz/mozilla/gfx/cairo/libpixman/src/pixman-image.c: In function 'reset_clip_region':
/home/karl/moz/mozilla/gfx/cairo/libpixman/src/pixman-image.c:329: warning: implicit declaration of function '_moz_pixman_region_init_rect'
/home/karl/moz/mozilla/gfx/cairo/libpixman/src/pixman-image.c: In function '_moz_pixman_image_set_clip_region':
/home/karl/moz/mozilla/gfx/cairo/libpixman/src/pixman-image.c:396: warning: implicit declaration of function '_moz_pixman_region_copy'
/home/karl/moz/mozilla/gfx/cairo/libpixman/src/pixman-image.c: In function '_moz_pixman_image_fill_rectangles':
/home/karl/moz/mozilla/gfx/cairo/libpixman/src/pixman-image.c:686: warning: implicit declaration of function '_moz_pixman_region_intersect'
/home/karl/moz/mozilla/gfx/cairo/libpixman/src/pixman-image.c:688: warning: implicit declaration of function '_moz_pixman_region_rectangles'
/home/karl/moz/mozilla/gfx/cairo/libpixman/src/pixman-image.c:688: warning: assignment makes pointer from integer without a cast
/home/karl/moz/mozilla/gfx/cairo/libpixman/src/pixman-image.c:692: warning: implicit declaration of function '_moz_pixman_fill'
/home/karl/moz/mozilla/gfx/cairo/libpixman/src/pixman-image.c:711: warning: implicit declaration of function '_moz_pixman_image_composite'

Comment 1

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Er, can you give me steps to reproduce or something?

Comment 3

[Caio Tiago Oliveira (asrail)]

The steps, for me, are:
 1 - start a 64 bits debug build on Linux.
 2 - nothing else.

Both FX and SM crash for me.

There is a stack on the duplicate.

Comment 4

[Karl Tomlinson (:karlt)]

Looks like pixmap-remap.h is being included too late (when building pixman-image.c at least) so (pixman_region_* at least) functions have no declarations.

Comment 5

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Ah, ok; pixman-remap is new, since I noticed we weren't remapping those functions before... looks like bad stuff is happening, but 64-bit only.  

Comment 6

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Attachment: test patch

Can you give this patch a try and see if it fixes it?  It fixes the include file ordering to make sure pixman-remap is included early enough.

Comment 7

[Karl Tomlinson (:karlt)]

Comment on attachment 299388 [details] [diff] [review]
test patch

The serious-looking warnings are gone, and the crash is fixed, thank you.

Looks good.
pixman-remap.h doesn't seem to be included anywhere (in cairo), but I guess that's intentional?

Comment 8

[John Kloosterman]

The patch worked for me. Thanks.

Comment 10

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Checked in and upstreamed.