ubuntu-x-swat team mailing list archive

[David Beswick <756237@xxxxxxxxxxxxxxxxxx>]

Public bug reported:

This is a strange one, I'm not sure exactly where the fault lies.
Basically, performing almost any operation in a wxRuby app causes a
crash in pixman_image_composite32. This crash doesn't occur when running
regular wxWidgets apps or wxPython apps. The problem occurs on both ruby
1.8 and 1.9.1. It also occurs across all versions of wxRuby. The bug
doesn't show up on all linux distos (success has been reported with Arch
linux) but I think that's determined by the version of pixman that the
distro is using.

To repro:

1. Install ruby 1.9.1: sudo apt-get install ruby1.9.1
2. Install the wxWidgets gem: sudo gem1.9.1 install wxruby
3. Run the wxRuby bigdemo sample: ruby1.9.1 /var/lib/gems/1.9.1/gems/wxruby-2.0.0-x86_64-linux/samples/bigdemo/bigdemo.rb
4. A segmentation fault occurs.


I've got wxRuby working by disabling some code in pixman. In the file pixman/pixman.c, function "lookup_composite_function", I
ifdef-ed out the following code:

 for (i = 0; i < N_CACHED_FAST_PATHS; ++i)
 {
    const pixman_fast_path_t *info = &(cache->cache[i].fast_path);

    /* Note that we check for equality here, not whether
     * the cached fast path matches. This is to prevent
     * us from selecting an overly general fast path
     * when a more specific one would work.
     */
    if (info->op == op            &&
        info->src_format == src_format    &&
        info->mask_format == mask_format    &&
        info->dest_format == dest_format    &&
        info->src_flags == src_flags    &&
        info->mask_flags == mask_flags    &&
        info->dest_flags == dest_flags    &&
        info->func)
    {
        *out_imp = cache->cache[i].imp;
        *out_func = cache->cache[i].fast_path.func;

        goto update_cache;
    }
}

The bug doesn't occur after this modified version of pixman has been
installed. As far as I can see, the cache->cache[i].fast_path.func
pointer is pointing to an invalid location. I think the usual target of
these pointers is the following variable in pixman.c:

PIXMAN_DEFINE_THREAD_LOCAL (cache_t, fast_path_cache);

This thread local variable seems to be uninitialized or filled with
garbage when the crash occurs.


Here's a backtrace from ruby 1.9.1 illustrating the crash:

-- C level backtrace information -------------------------------------------
/usr/lib/libruby-1.9.1.so.1.9(rb_vm_bugreport+0x5f) [0x7fdd5531be8f]
/usr/lib/libruby-1.9.1.so.1.9(+0x58a56) [0x7fdd55226a56]
/usr/lib/libruby-1.9.1.so.1.9(rb_bug+0xb3) [0x7fdd55226bc3]
/usr/lib/libruby-1.9.1.so.1.9(+0xedde5) [0x7fdd552bbde5]
/lib/libpthread.so.0(+0xfb40) [0x7fdd54fc0b40]
/usr/local/lib/libpixman-1.so.0(pixman_image_composite32+0x300) [0x7fdd4a296700]
/usr/lib/libcairo.so.2(+0x29463) [0x7fdd4b3b9463]
/usr/lib/libcairo.so.2(+0x2a61c) [0x7fdd4b3ba61c]
/usr/lib/libcairo.so.2(+0x2c31d) [0x7fdd4b3bc31d]
/usr/lib/libcairo.so.2(+0x2c55e) [0x7fdd4b3bc55e]
/usr/lib/libcairo.so.2(+0x49f56) [0x7fdd4b3d9f56]
/usr/lib/libcairo.so.2(+0x2243e) [0x7fdd4b3b243e]
/usr/lib/libcairo.so.2(cairo_fill_preserve+0x1d) [0x7fdd4b3a943d]
/usr/lib/libcairo.so.2(cairo_fill+0x9) [0x7fdd4b3a9469]
/usr/lib/librsvg-2.so.2(+0x2a1b0) [0x7fdd43bc91b0]
/usr/lib/librsvg-2.so.2(+0x248a0) [0x7fdd43bc38a0]
/usr/lib/librsvg-2.so.2(+0x1eb53) [0x7fdd43bbdb53]
/usr/lib/librsvg-2.so.2(+0x1f093) [0x7fdd43bbe093]
/usr/lib/librsvg-2.so.2(+0x1eb53) [0x7fdd43bbdb53]
/usr/lib/librsvg-2.so.2(+0x1f093) [0x7fdd43bbe093]
/usr/lib/librsvg-2.so.2(+0x1eb53) [0x7fdd43bbdb53]
/usr/lib/librsvg-2.so.2(+0x1ef64) [0x7fdd43bbdf64]
/usr/lib/librsvg-2.so.2(+0x1eb53) [0x7fdd43bbdb53]
/usr/lib/librsvg-2.so.2(rsvg_handle_render_cairo_sub+0xca) [0x7fdd43bc9b1a]
/usr/lib/librsvg-2.so.2(rsvg_handle_get_pixbuf_sub+0x105) [0x7fdd43bca065]
/usr/lib/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-svg.so(+0xd6b) [0x7fdd43dfdd6b]
/usr/lib/libgdk_pixbuf-2.0.so.0(gdk_pixbuf_loader_close+0xf9) [0x7fdd4ffce889]
/usr/lib/libgdk_pixbuf-2.0.so.0(+0x89a6) [0x7fdd4ffcc9a6]
/usr/lib/libgdk_pixbuf-2.0.so.0(gdk_pixbuf_new_from_stream_at_scale+0x81) [0x7fdd4ffccb01]
/usr/lib/libgtk-x11-2.0.so.0(+0x104eec) [0x7fdd507b3eec]
/usr/lib/libgtk-x11-2.0.so.0(gtk_icon_info_load_icon+0x72) [0x7fdd507b4612]
/usr/lib/libgtk-x11-2.0.so.0(gtk_icon_theme_load_icon+0x13f) [0x7fdd507b685f]
/usr/lib/libgtk-x11-2.0.so.0(gtk_icon_set_render_icon+0x5ea) [0x7fdd507b0faa]
/usr/lib/libgtk-x11-2.0.so.0(gtk_widget_render_icon+0xea) [0x7fdd5090834a]
/usr/lib/libgtk-x11-2.0.so.0(+0x1185d4) [0x7fdd507c75d4]
/usr/lib/libgtk-x11-2.0.so.0(+0x1185f9) [0x7fdd507c75f9]
/usr/lib/libgobject-2.0.so.0(g_closure_invoke+0xa9) [0x7fdd4f7299b9]
/usr/lib/libgobject-2.0.so.0(+0x246b1) [0x7fdd4f73f6b1]
/usr/lib/libgobject-2.0.so.0(g_signal_emit_valist+0x7e6) [0x7fdd4f7412a6]
/usr/lib/libgobject-2.0.so.0(g_signal_emit_by_name+0x208) [0x7fdd4f7415f8]
/usr/lib/libgtk-x11-2.0.so.0(+0x1a5138) [0x7fdd50854138]
/usr/lib/libgtk-x11-2.0.so.0(+0x85967) [0x7fdd50734967]
/usr/lib/libgobject-2.0.so.0(g_closure_invoke+0xa9) [0x7fdd4f7299b9]
/usr/lib/libgobject-2.0.so.0(+0x246b1) [0x7fdd4f73f6b1]
/usr/lib/libgobject-2.0.so.0(g_signal_emit_valist+0x7e6) [0x7fdd4f7412a6]
/usr/lib/libgobject-2.0.so.0(g_signal_emit_by_name+0x208) [0x7fdd4f7415f8]
/usr/lib/libgtk-x11-2.0.so.0(+0x1a5138) [0x7fdd50854138]
/usr/lib/libgtk-x11-2.0.so.0(+0x85967) [0x7fdd50734967]
/usr/lib/libgobject-2.0.so.0(g_closure_invoke+0xa9) [0x7fdd4f7299b9]
/usr/lib/libgobject-2.0.so.0(+0x246b1) [0x7fdd4f73f6b1]
/usr/lib/libgobject-2.0.so.0(g_signal_emit_valist+0x7e6) [0x7fdd4f7412a6]
/usr/lib/libgobject-2.0.so.0(g_signal_emit_by_name+0x208) [0x7fdd4f7415f8]
/usr/lib/libgtk-x11-2.0.so.0(+0x1a5138) [0x7fdd50854138]
/usr/lib/libgtk-x11-2.0.so.0(+0x26156c) [0x7fdd5091056c]
/usr/lib/libgobject-2.0.so.0(g_closure_invoke+0x15e) [0x7fdd4f729a6e]
/usr/lib/libgobject-2.0.so.0(+0x246b1) [0x7fdd4f73f6b1]
/usr/lib/libgobject-2.0.so.0(g_signal_emit_valist+0x7e6) [0x7fdd4f7412a6]
/usr/lib/libgobject-2.0.so.0(g_signal_emit_by_name+0x208) [0x7fdd4f7415f8]
/usr/lib/libgtk-x11-2.0.so.0(+0x1a5138) [0x7fdd50854138]
/usr/lib/libgtk-x11-2.0.so.0(+0x2618c1) [0x7fdd509108c1]
/usr/lib/libgtk-x11-2.0.so.0(+0x26b4b9) [0x7fdd5091a4b9]
/usr/lib/libgobject-2.0.so.0(g_closure_invoke+0x15e) [0x7fdd4f729a6e]
/usr/lib/libgobject-2.0.so.0(+0x246b1) [0x7fdd4f73f6b1]
/usr/lib/libgobject-2.0.so.0(g_signal_emit_valist+0x7e6) [0x7fdd4f7412a6]
/usr/lib/libgobject-2.0.so.0(g_signal_emit+0x83) [0x7fdd4f741863]
/usr/lib/libgtk-x11-2.0.so.0(gtk_widget_show+0x8b) [0x7fdd50909e8b]
/usr/lib/libgtk-x11-2.0.so.0(gtk_dialog_run+0x218) [0x7fdd50768718]
/usr/local/lib/libwx_gtk2u_core-2.8.so.0(_ZN15wxMessageDialog9ShowModalEv+0x4a) [0x7fdd516a8e8a]
/usr/local/lib/libwx_gtk2u_core-2.8.so.0(_Z12wxMessageBoxRK8wxStringS1_lP8wxWindowii+0x52) [0x7fdd516244c2]
/usr/local/lib/libwx_gtk2u_core-2.8.so.0(_ZN8wxLogGui5FlushEv+0x279) [0x7fdd517666a9]
/usr/local/lib/libwx_baseu-2.8.so.0(_ZN5wxLog15SetActiveTargetEPS_+0x27) [0x7fdd50d6e967]
/usr/local/lib/site_ruby/1.9.1/x86_64-linux/wxruby2.so(+0x40f6ec) [0x7fdd5335c6ec]
/usr/lib/libruby-1.9.1.so.1.9(+0x147258) [0x7fdd55315258]
/usr/lib/libruby-1.9.1.so.1.9(+0x13f410) [0x7fdd5530d410]
/usr/lib/libruby-1.9.1.so.1.9(+0x143e31) [0x7fdd55311e31]
/usr/lib/libruby-1.9.1.so.1.9(+0x14611f) [0x7fdd5531411f]
/usr/lib/libruby-1.9.1.so.1.9(rb_class_new_instance+0x30) [0x7fdd55267e20]
/usr/lib/libruby-1.9.1.so.1.9(+0x147258) [0x7fdd55315258]
/usr/lib/libruby-1.9.1.so.1.9(+0x13f410) [0x7fdd5530d410]
/usr/lib/libruby-1.9.1.so.1.9(+0x143e31) [0x7fdd55311e31]
/usr/lib/libruby-1.9.1.so.1.9(+0x14611f) [0x7fdd5531411f]
/usr/lib/libruby-1.9.1.so.1.9(rb_funcall+0x207) [0x7fdd55309fa7]
/usr/local/lib/site_ruby/1.9.1/x86_64-linux/wxruby2.so(_ZN9wxRubyApp6OnInitEv+0x52) [0x7fdd53155592]
/usr/local/lib/libwx_baseu-2.8.so.0(_Z7wxEntryRiPPw+0x64) [0x7fdd50d62ab4]
/usr/local/lib/site_ruby/1.9.1/x86_64-linux/wxruby2.so(+0x206970) [0x7fdd53153970]
/usr/lib/libruby-1.9.1.so.1.9(+0x147258) [0x7fdd55315258]
/usr/lib/libruby-1.9.1.so.1.9(+0x13f410) [0x7fdd5530d410]
/usr/lib/libruby-1.9.1.so.1.9(+0x143e31) [0x7fdd55311e31]
/usr/lib/libruby-1.9.1.so.1.9(rb_iseq_eval_main+0xb2) [0x7fdd55312082]
/usr/lib/libruby-1.9.1.so.1.9(+0x5bd52) [0x7fdd55229d52]
/usr/lib/libruby-1.9.1.so.1.9(ruby_exec_node+0x1d) [0x7fdd55229d7d]
/usr/lib/libruby-1.9.1.so.1.9(ruby_run_node+0x1e) [0x7fdd5522b63e]
ruby1.9.1(main+0x4b) [0x40092b]
/lib/libc.so.6(__libc_start_main+0xfe) [0x7fdd54384d8e]
ruby1.9.1() [0x400819]


$ lsb_release -rd
Description:	Ubuntu 10.10
Release:	10.10

** Affects: pixman (Ubuntu)
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Ubuntu-X,
which is subscribed to pixman in Ubuntu.
https://bugs.launchpad.net/bugs/756237

Title:
  wxRuby crashes with segmentation fault in pixman_image_composite32