Bug 1331021

Summary:	Assertion "(_cairo_atomic_int_get (&(&surface->ref_count)->ref_count) > 0)
Product:	[Fedora] Fedora	Reporter:	Jaroslav Škarvada <jskarvad>
Component:	cairo	Assignee:	Benjamin Otte <otte>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	25	CC:	hicham.haouari, klember, mauricio.pronet, otte, raveit65.sun
Target Milestone:	---	Keywords:	Patch
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	cairo-1.14.6-2.fc24	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-08-01 16:25:00 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jaroslav Škarvada 2016-04-27 13:09:13 UTC

Description of problem:
cairo-surface.c:953: cairo_surface_destroy: assert „((*&(&surface->ref_count)->ref_count) > 0)“ not valid.

Version-Release number of selected component (if applicable):
emerald-0.8.8-14.fc23 

How reproducible:
Always

Steps to Reproduce:
1. Used xfce with emerald theme Crystal-ICE (legacy engine)
2. Interaction with sim messanger (e.g. send few jabber messages)

Actual results:
Segfault in less than 60 seconds of sim usage.
cairo-surface.c:953: cairo_surface_destroy: assert „((*&(&surface->ref_count)->ref_count) > 0)“ not valid.

Expected results:
No segfault

Additional info:
There may be more reproducers for this problem, but this one is really reliable. It seems it doesn't happen with emerald-0.8.8-14.fc23.x86_64

The backtrace is attached, but it doesn't help me much:
#0  0x00007f67f0e00a98 in raise () at /lib64/libc.so.6
#1  0x00007f67f0e0269a in abort () at /lib64/libc.so.6
#2  0x00007f67f0df9227 in __assert_fail_base () at /lib64/libc.so.6
#3  0x00007f67f0df92d2 in  () at /lib64/libc.so.6
#4  0x00007f67f191ee12 in cairo_surface_destroy () at /lib64/libcairo.so.2
#5  0x00007f67f194e000 in _get_image_surface () at /lib64/libcairo.so.2
#6  0x00007f67f194ec73 in _cairo_xlib_surface_acquire_source_image () at /lib64/libcairo.so.2
#7  0x00007f67f191f6d4 in _cairo_surface_acquire_source_image () at /lib64/libcairo.so.2
#8  0x00007f67f18e7e52 in _pixman_image_for_pattern () at /lib64/libcairo.so.2
#9  0x00007f67f18e893e in _cairo_image_source_create_for_pattern () at /lib64/libcairo.so.2
#10 0x00007f67f191c151 in clip_and_composite_boxes.part () at /lib64/libcairo.so.2
#11 0x00007f67f191c75e in clip_and_composite_boxes () at /lib64/libcairo.so.2
#12 0x00007f67f191ca79 in _cairo_spans_compositor_mask () at /lib64/libcairo.so.2
#13 0x00007f67f18d7429 in _cairo_compositor_paint () at /lib64/libcairo.so.2
#14 0x00007f67f191f8b1 in _cairo_surface_paint () at /lib64/libcairo.so.2
#15 0x00007f67f18df285 in _cairo_gstate_paint () at /lib64/libcairo.so.2
#16 0x00007f67f18d1ea5 in cairo_paint () at /lib64/libcairo.so.2
#17 0x00007f67f4308ad0 in try_pixmap_and_mask.part () at /lib64/libwnck-3.so.0
#18 0x00007f67f4309fa4 in _wnck_read_icons () at /lib64/libwnck-3.so.0
#19 0x00007f67f42ff90f in get_icons () at /lib64/libwnck-3.so.0
#20 0x00007f67f43004af in force_update_now () at /lib64/libwnck-3.so.0
#21 0x00007f67f430175a in update_idle () at /lib64/libwnck-3.so.0
#22 0x00007f67f1c22e3a in g_main_context_dispatch () at /lib64/libglib-2.0.so.0
#23 0x00007f67f1c231d0 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0
#24 0x00007f67f1c234f2 in g_main_loop_run () at /lib64/libglib-2.0.so.0
#25 0x00007f67f3bc4325 in gtk_main () at /lib64/libgtk-3.so.0
#26 0x00005618cfe959ef in main (argc=2, argv=0x7ffff2923ff8) at main.c:6027

Comment 1 Jaroslav Škarvada 2016-04-27 13:12:24 UTC

I will check with upstream git, and if it is still reproducible I will report this upstream.

Comment 2 Jaroslav Škarvada 2016-04-27 13:14:21 UTC

The core is generated by emerald process:
Core was generated by `emerald --replace'.
Program terminated with signal SIGABRT, Aborted.

Comment 3 Jaroslav Škarvada 2016-04-27 13:16:09 UTC

(In reply to Jaroslav Škarvada from comment #0)
> Version-Release number of selected component (if applicable):
> emerald-0.8.8-14.fc23 

I meant emerald-0.8.12.4-1.fc23.x86_64

Comment 4 Jaroslav Škarvada 2016-04-27 16:42:03 UTC

Cairo upstream bug:
https://bugs.freedesktop.org/show_bug.cgi?id=91967

Thanks to raveit65 and XRevan86 for investigation.

The proposed patch resolved the problem for me:
https://bugs.freedesktop.org/attachment.cgi?id=118325

Comment 6 Wolfgang Ulbrich 2016-06-19 10:08:05 UTC

Cairo upstream have applied the fix.
https://cgit.freedesktop.org/cairo/commit/?id=d69dd6b341594c338fa6c7b327fd7f201eb37bc1

Dear maintainer, can you please rebuild cairo with that fix for all branches?

Comment 7 Wolfgang Ulbrich 2016-07-24 14:20:02 UTC

Any news?

Comment 8 Kalev Lember 2016-07-25 07:39:10 UTC

Thanks, I've backported the patch as http://pkgs.fedoraproject.org/cgit/rpms/cairo.git/commit/?id=fd73152fd62eb9a58716ff2a7151354226305e09

Comment 9 Fedora Update System 2016-07-25 07:39:59 UTC

cairo-1.14.6-2.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-680189b17c

Comment 10 Jan Kurik 2016-07-26 04:52:51 UTC

This bug appears to have been reported against 'rawhide' during the Fedora 25 development cycle.
Changing version to '25'.

Comment 11 Fedora Update System 2016-07-28 06:01:26 UTC

cairo-1.14.6-2.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-680189b17c

Comment 12 Fedora Update System 2016-08-01 16:24:57 UTC

cairo-1.14.6-2.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

Comment 13 Wolfgang Ulbrich 2016-08-08 07:59:09 UTC

*** Bug 1364824 has been marked as a duplicate of this bug. ***

Comment 14 Wolfgang Ulbrich 2016-08-08 08:00:20 UTC

This fix needs to be applied to f23 too.