Comment 8 for bug 83744

(In reply to comment #0)
> (gdb) p *cr
> $1 = {ref_count = 1, status = CAIRO_STATUS_INVALID_RESTORE, path = {op_buf_head
> = 0x886f9f0, op_buf_tail = 0x886f9f0,
> arg_buf_head = 0x888e598, arg_buf_tail = 0x888e598, last_move_point = {x =
> 31928960, y = 52340096}, current_point = {
> x = 31928960, y = 52340096}, has_current_point = 1, has_curve_to = 0},
> gstate = 0x0}

This part is very interesting. If you've hit an INVALID_RESTORE case then cairo_t should shut down and you shouldn't be able to get it to do anything after that anymore, (and especially not crash).

Could you break on _cairo_error which should show you where the INVALID_RESTORE is first happening, and then step through to see how you're getting from there to the crash?

Thanks,

-Carl