Created an attachment (id=30180)
xtrace of a typical crash
Note that cairo calls RenderFreePicture (4ebda) immediately upon the cairo_surface_finish() [which presumably is actually trigged by the final cairo_surface_destroy() and is not being manually called], but the drawable was destroyed much earlier (the DestroyNotify arrives at 47608) and note that the drawable is never explicitly destroyed but is reaped along with its parent (475f7).
Created an attachment (id=30180)
xtrace of a typical crash
Note that cairo calls RenderFreePicture (4ebda) immediately upon the cairo_surface_ finish( ) [which presumably is actually trigged by the final cairo_surface_ destroy( ) and is not being manually called], but the drawable was destroyed much earlier (the DestroyNotify arrives at 47608) and note that the drawable is never explicitly destroyed but is reaped along with its parent (475f7).
The full trace is available at http:// people. freedesktop. org/~ickle/ ff.crash. log