[cairo-bugs] [Bug 34912] [Piketon bisected]System hangs when run firefox-talos-gfx.trace

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=34912

--- Comment #4 from Uli Schlachter <psychon at znc.in> 2011-03-02 14:27:26 PST ---
Turns out the problem lies deeper than this. Thanks to Andrea, I dug a little
deeper and found a cyclic reference:

- _cairo_xcb_surface_picture() is called for a XCB surface
- This calls _copy_to_picture(source, FALSE) to make use of the existing
Picture
- Let's assume the source owns its pixmap, then this calls
_cairo_xcb_picture_copy()
- This creates a surface with: surface->owner = cairo_surface_reference
(&target->base); 
  (-> The _cairo_xcb_picture_t has a reference to the "source" surface)
-  _cairo_xcb_surface_picture() now calls _cairo_surface_attach_snapshot()
which causes the reference count for "source" to be increased.

So the result is:
"source" has the _cairo_xcb_picture_t as a snapshot and owns a reference for
it.
At the same time, _cairo_xcb_picture_t owns a reference for the "source" since
it co-uses its Picture.

(valgrind won't detect this because cairo_device_finish for the xcb device
"cleans up" by finishing all surfaces which are still alive)

Easiest fix would be to remove _cairo_xcb_picture_copy.

-- 
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.