ubuntu-x-swat team mailing list archive

[David Beswick <756237@xxxxxxxxxxxxxxxxxx>]

** Description changed:

+ Edited: I corrected the repro steps, thanks Marvin
+ 
  This is a strange one, I'm not sure exactly where the fault lies.
  Basically, performing almost any operation in a wxRuby app causes a
  crash in pixman_image_composite32. This crash doesn't occur when running
  regular wxWidgets apps or wxPython apps. The problem occurs on both ruby
  1.8 and 1.9.1. It also occurs across all versions of wxRuby. The bug
  doesn't show up on all linux distos (success has been reported with Arch
  linux) but I think that's determined by the version of pixman that the
  distro is using.
  
  To repro:
  
  1. Install ruby 1.9.1: sudo apt-get install ruby1.9.1
- 2. Install the wxWidgets gem: sudo gem1.9.1 install wxruby
- 3. Run the wxRuby bigdemo sample: ruby1.9.1 /var/lib/gems/1.9.1/gems/wxruby-2.0.0-x86_64-linux/samples/bigdemo/bigdemo.rb
+ 2. Install the wxWidgets gem: sudo gem1.9.1 install wxruby-ruby19
+ 3. Run the wxRuby bigdemo sample: ruby1.9.1 /var/lib/gems/1.9.1/gems/wxruby-ruby19-2.0.0-x86_64-linux/samples/bigdemo/bigdemo.rb
  4. A segmentation fault occurs.
- 
  
  I've got wxRuby working by disabling some code in pixman. In the file pixman/pixman.c, function "lookup_composite_function", I
  ifdef-ed out the following code:
  
-  for (i = 0; i < N_CACHED_FAST_PATHS; ++i)
-  {
-     const pixman_fast_path_t *info = &(cache->cache[i].fast_path);
+  for (i = 0; i < N_CACHED_FAST_PATHS; ++i)
+  {
+     const pixman_fast_path_t *info = &(cache->cache[i].fast_path);
  
-     /* Note that we check for equality here, not whether
-      * the cached fast path matches. This is to prevent
-      * us from selecting an overly general fast path
-      * when a more specific one would work.
-      */
-     if (info->op == op            &&
-         info->src_format == src_format    &&
-         info->mask_format == mask_format    &&
-         info->dest_format == dest_format    &&
-         info->src_flags == src_flags    &&
-         info->mask_flags == mask_flags    &&
-         info->dest_flags == dest_flags    &&
-         info->func)
-     {
-         *out_imp = cache->cache[i].imp;
-         *out_func = cache->cache[i].fast_path.func;
+     /* Note that we check for equality here, not whether
+      * the cached fast path matches. This is to prevent
+      * us from selecting an overly general fast path
+      * when a more specific one would work.
+      */
+     if (info->op == op            &&
+         info->src_format == src_format    &&
+         info->mask_format == mask_format    &&
+         info->dest_format == dest_format    &&
+         info->src_flags == src_flags    &&
+         info->mask_flags == mask_flags    &&
+         info->dest_flags == dest_flags    &&
+         info->func)
+     {
+         *out_imp = cache->cache[i].imp;
+         *out_func = cache->cache[i].fast_path.func;
  
-         goto update_cache;
-     }
+         goto update_cache;
+     }
  }
  
  The bug doesn't occur after this modified version of pixman has been
  installed. As far as I can see, the cache->cache[i].fast_path.func
  pointer is pointing to an invalid location. I think the usual target of
  these pointers is the following variable in pixman.c:
  
  PIXMAN_DEFINE_THREAD_LOCAL (cache_t, fast_path_cache);
  
  This thread local variable seems to be uninitialized or filled with
  garbage when the crash occurs.
- 
  
  Here's a backtrace from ruby 1.9.1 illustrating the crash:
  
  -- C level backtrace information -------------------------------------------
  /usr/lib/libruby-1.9.1.so.1.9(rb_vm_bugreport+0x5f) [0x7fdd5531be8f]
  /usr/lib/libruby-1.9.1.so.1.9(+0x58a56) [0x7fdd55226a56]
  /usr/lib/libruby-1.9.1.so.1.9(rb_bug+0xb3) [0x7fdd55226bc3]
  /usr/lib/libruby-1.9.1.so.1.9(+0xedde5) [0x7fdd552bbde5]
  /lib/libpthread.so.0(+0xfb40) [0x7fdd54fc0b40]
  /usr/local/lib/libpixman-1.so.0(pixman_image_composite32+0x300) [0x7fdd4a296700]
  /usr/lib/libcairo.so.2(+0x29463) [0x7fdd4b3b9463]
  /usr/lib/libcairo.so.2(+0x2a61c) [0x7fdd4b3ba61c]
  /usr/lib/libcairo.so.2(+0x2c31d) [0x7fdd4b3bc31d]
  /usr/lib/libcairo.so.2(+0x2c55e) [0x7fdd4b3bc55e]
  /usr/lib/libcairo.so.2(+0x49f56) [0x7fdd4b3d9f56]
  /usr/lib/libcairo.so.2(+0x2243e) [0x7fdd4b3b243e]
  /usr/lib/libcairo.so.2(cairo_fill_preserve+0x1d) [0x7fdd4b3a943d]
  /usr/lib/libcairo.so.2(cairo_fill+0x9) [0x7fdd4b3a9469]
  /usr/lib/librsvg-2.so.2(+0x2a1b0) [0x7fdd43bc91b0]
  /usr/lib/librsvg-2.so.2(+0x248a0) [0x7fdd43bc38a0]
  /usr/lib/librsvg-2.so.2(+0x1eb53) [0x7fdd43bbdb53]
  /usr/lib/librsvg-2.so.2(+0x1f093) [0x7fdd43bbe093]
  /usr/lib/librsvg-2.so.2(+0x1eb53) [0x7fdd43bbdb53]
  /usr/lib/librsvg-2.so.2(+0x1f093) [0x7fdd43bbe093]
  /usr/lib/librsvg-2.so.2(+0x1eb53) [0x7fdd43bbdb53]
  /usr/lib/librsvg-2.so.2(+0x1ef64) [0x7fdd43bbdf64]
  /usr/lib/librsvg-2.so.2(+0x1eb53) [0x7fdd43bbdb53]
  /usr/lib/librsvg-2.so.2(rsvg_handle_render_cairo_sub+0xca) [0x7fdd43bc9b1a]
  /usr/lib/librsvg-2.so.2(rsvg_handle_get_pixbuf_sub+0x105) [0x7fdd43bca065]
  /usr/lib/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-svg.so(+0xd6b) [0x7fdd43dfdd6b]
  /usr/lib/libgdk_pixbuf-2.0.so.0(gdk_pixbuf_loader_close+0xf9) [0x7fdd4ffce889]
  /usr/lib/libgdk_pixbuf-2.0.so.0(+0x89a6) [0x7fdd4ffcc9a6]
  /usr/lib/libgdk_pixbuf-2.0.so.0(gdk_pixbuf_new_from_stream_at_scale+0x81) [0x7fdd4ffccb01]
  /usr/lib/libgtk-x11-2.0.so.0(+0x104eec) [0x7fdd507b3eec]
  /usr/lib/libgtk-x11-2.0.so.0(gtk_icon_info_load_icon+0x72) [0x7fdd507b4612]
  /usr/lib/libgtk-x11-2.0.so.0(gtk_icon_theme_load_icon+0x13f) [0x7fdd507b685f]
  /usr/lib/libgtk-x11-2.0.so.0(gtk_icon_set_render_icon+0x5ea) [0x7fdd507b0faa]
  /usr/lib/libgtk-x11-2.0.so.0(gtk_widget_render_icon+0xea) [0x7fdd5090834a]
  /usr/lib/libgtk-x11-2.0.so.0(+0x1185d4) [0x7fdd507c75d4]
  /usr/lib/libgtk-x11-2.0.so.0(+0x1185f9) [0x7fdd507c75f9]
  /usr/lib/libgobject-2.0.so.0(g_closure_invoke+0xa9) [0x7fdd4f7299b9]
  /usr/lib/libgobject-2.0.so.0(+0x246b1) [0x7fdd4f73f6b1]
  /usr/lib/libgobject-2.0.so.0(g_signal_emit_valist+0x7e6) [0x7fdd4f7412a6]
  /usr/lib/libgobject-2.0.so.0(g_signal_emit_by_name+0x208) [0x7fdd4f7415f8]
  /usr/lib/libgtk-x11-2.0.so.0(+0x1a5138) [0x7fdd50854138]
  /usr/lib/libgtk-x11-2.0.so.0(+0x85967) [0x7fdd50734967]
  /usr/lib/libgobject-2.0.so.0(g_closure_invoke+0xa9) [0x7fdd4f7299b9]
  /usr/lib/libgobject-2.0.so.0(+0x246b1) [0x7fdd4f73f6b1]
  /usr/lib/libgobject-2.0.so.0(g_signal_emit_valist+0x7e6) [0x7fdd4f7412a6]
  /usr/lib/libgobject-2.0.so.0(g_signal_emit_by_name+0x208) [0x7fdd4f7415f8]
  /usr/lib/libgtk-x11-2.0.so.0(+0x1a5138) [0x7fdd50854138]
  /usr/lib/libgtk-x11-2.0.so.0(+0x85967) [0x7fdd50734967]
  /usr/lib/libgobject-2.0.so.0(g_closure_invoke+0xa9) [0x7fdd4f7299b9]
  /usr/lib/libgobject-2.0.so.0(+0x246b1) [0x7fdd4f73f6b1]
  /usr/lib/libgobject-2.0.so.0(g_signal_emit_valist+0x7e6) [0x7fdd4f7412a6]
  /usr/lib/libgobject-2.0.so.0(g_signal_emit_by_name+0x208) [0x7fdd4f7415f8]
  /usr/lib/libgtk-x11-2.0.so.0(+0x1a5138) [0x7fdd50854138]
  /usr/lib/libgtk-x11-2.0.so.0(+0x26156c) [0x7fdd5091056c]
  /usr/lib/libgobject-2.0.so.0(g_closure_invoke+0x15e) [0x7fdd4f729a6e]
  /usr/lib/libgobject-2.0.so.0(+0x246b1) [0x7fdd4f73f6b1]
  /usr/lib/libgobject-2.0.so.0(g_signal_emit_valist+0x7e6) [0x7fdd4f7412a6]
  /usr/lib/libgobject-2.0.so.0(g_signal_emit_by_name+0x208) [0x7fdd4f7415f8]
  /usr/lib/libgtk-x11-2.0.so.0(+0x1a5138) [0x7fdd50854138]
  /usr/lib/libgtk-x11-2.0.so.0(+0x2618c1) [0x7fdd509108c1]
  /usr/lib/libgtk-x11-2.0.so.0(+0x26b4b9) [0x7fdd5091a4b9]
  /usr/lib/libgobject-2.0.so.0(g_closure_invoke+0x15e) [0x7fdd4f729a6e]
  /usr/lib/libgobject-2.0.so.0(+0x246b1) [0x7fdd4f73f6b1]
  /usr/lib/libgobject-2.0.so.0(g_signal_emit_valist+0x7e6) [0x7fdd4f7412a6]
  /usr/lib/libgobject-2.0.so.0(g_signal_emit+0x83) [0x7fdd4f741863]
  /usr/lib/libgtk-x11-2.0.so.0(gtk_widget_show+0x8b) [0x7fdd50909e8b]
  /usr/lib/libgtk-x11-2.0.so.0(gtk_dialog_run+0x218) [0x7fdd50768718]
  /usr/local/lib/libwx_gtk2u_core-2.8.so.0(_ZN15wxMessageDialog9ShowModalEv+0x4a) [0x7fdd516a8e8a]
  /usr/local/lib/libwx_gtk2u_core-2.8.so.0(_Z12wxMessageBoxRK8wxStringS1_lP8wxWindowii+0x52) [0x7fdd516244c2]
  /usr/local/lib/libwx_gtk2u_core-2.8.so.0(_ZN8wxLogGui5FlushEv+0x279) [0x7fdd517666a9]
  /usr/local/lib/libwx_baseu-2.8.so.0(_ZN5wxLog15SetActiveTargetEPS_+0x27) [0x7fdd50d6e967]
  /usr/local/lib/site_ruby/1.9.1/x86_64-linux/wxruby2.so(+0x40f6ec) [0x7fdd5335c6ec]
  /usr/lib/libruby-1.9.1.so.1.9(+0x147258) [0x7fdd55315258]
  /usr/lib/libruby-1.9.1.so.1.9(+0x13f410) [0x7fdd5530d410]
  /usr/lib/libruby-1.9.1.so.1.9(+0x143e31) [0x7fdd55311e31]
  /usr/lib/libruby-1.9.1.so.1.9(+0x14611f) [0x7fdd5531411f]
  /usr/lib/libruby-1.9.1.so.1.9(rb_class_new_instance+0x30) [0x7fdd55267e20]
  /usr/lib/libruby-1.9.1.so.1.9(+0x147258) [0x7fdd55315258]
  /usr/lib/libruby-1.9.1.so.1.9(+0x13f410) [0x7fdd5530d410]
  /usr/lib/libruby-1.9.1.so.1.9(+0x143e31) [0x7fdd55311e31]
  /usr/lib/libruby-1.9.1.so.1.9(+0x14611f) [0x7fdd5531411f]
  /usr/lib/libruby-1.9.1.so.1.9(rb_funcall+0x207) [0x7fdd55309fa7]
  /usr/local/lib/site_ruby/1.9.1/x86_64-linux/wxruby2.so(_ZN9wxRubyApp6OnInitEv+0x52) [0x7fdd53155592]
  /usr/local/lib/libwx_baseu-2.8.so.0(_Z7wxEntryRiPPw+0x64) [0x7fdd50d62ab4]
  /usr/local/lib/site_ruby/1.9.1/x86_64-linux/wxruby2.so(+0x206970) [0x7fdd53153970]
  /usr/lib/libruby-1.9.1.so.1.9(+0x147258) [0x7fdd55315258]
  /usr/lib/libruby-1.9.1.so.1.9(+0x13f410) [0x7fdd5530d410]
  /usr/lib/libruby-1.9.1.so.1.9(+0x143e31) [0x7fdd55311e31]
  /usr/lib/libruby-1.9.1.so.1.9(rb_iseq_eval_main+0xb2) [0x7fdd55312082]
  /usr/lib/libruby-1.9.1.so.1.9(+0x5bd52) [0x7fdd55229d52]
  /usr/lib/libruby-1.9.1.so.1.9(ruby_exec_node+0x1d) [0x7fdd55229d7d]
  /usr/lib/libruby-1.9.1.so.1.9(ruby_run_node+0x1e) [0x7fdd5522b63e]
  ruby1.9.1(main+0x4b) [0x40092b]
  /lib/libc.so.6(__libc_start_main+0xfe) [0x7fdd54384d8e]
  ruby1.9.1() [0x400819]
  
- 
  $ lsb_release -rd
  Description:	Ubuntu 10.10
  Release:	10.10

-- 
You received this bug notification because you are a member of Ubuntu-X,
which is subscribed to pixman in Ubuntu.
https://bugs.launchpad.net/bugs/756237

Title:
  wxRuby crashes with segmentation fault in pixman_image_composite32