if users attempt to twice destroy or re-reference a destroyed object. The condition for detecting this case is a ref_count of 0.

Reviewed by: otaylor Fixes bug #4198

4 files changed, 20 insertions, 0 deletions

diff --git a/src/cairo-font.c b/src/cairo-font.c
index 686230e9..5e649ec4 100644
--- a/src/cairo-font.c
+++ b/src/cairo-font.c
@@ -85,6 +85,8 @@ cairo_font_face_reference (cairo_font_face_t *font_face)
     if (font_face->ref_count == (unsigned int)-1)
 	return font_face;
 
+    assert (font_face->ref_count > 0);
+
     font_face->ref_count++;
 
     return font_face;
@@ -107,6 +109,8 @@ cairo_font_face_destroy (cairo_font_face_t *font_face)
     if (font_face->ref_count == (unsigned int)-1)
 	return;
 
+    assert (font_face->ref_count > 0);
+
     if (--(font_face->ref_count) > 0)
 	return;
 
@@ -760,6 +764,8 @@ cairo_scaled_font_reference (cairo_scaled_font_t *scaled_font)
     if (scaled_font->ref_count == (unsigned int)-1)
 	return scaled_font;
 
+    assert (scaled_font->ref_count > 0);
+
     /* If the original reference count is 0, then this font must have
      * been found in font_map->holdovers, (which means this caching is
      * actually working). So now we remove it from the holdovers
@@ -807,6 +813,8 @@ cairo_scaled_font_destroy (cairo_scaled_font_t *scaled_font)
     if (scaled_font->ref_count == (unsigned int)-1)
 	return;
 
+    assert (scaled_font->ref_count > 0);
+
     if (--(scaled_font->ref_count) > 0)
 	return;
 
diff --git a/src/cairo-pattern.c b/src/cairo-pattern.c
index 5f3c9180..f4d76f05 100644
--- a/src/cairo-pattern.c
+++ b/src/cairo-pattern.c
@@ -532,6 +532,8 @@ cairo_pattern_reference (cairo_pattern_t *pattern)
     if (pattern->ref_count == (unsigned int)-1)
 	return pattern;
 
+    assert (pattern->ref_count > 0);
+
     pattern->ref_count++;
 
     return pattern;
@@ -570,6 +572,8 @@ cairo_pattern_destroy (cairo_pattern_t *pattern)
     if (pattern->ref_count == (unsigned int)-1)
 	return;
 
+    assert (pattern->ref_count > 0);
+
     pattern->ref_count--;
     if (pattern->ref_count)
 	return;
diff --git a/src/cairo-surface.c b/src/cairo-surface.c
index 48ab2c79..1e119f7b 100644
--- a/src/cairo-surface.c
+++ b/src/cairo-surface.c
@@ -268,6 +268,8 @@ cairo_surface_reference (cairo_surface_t *surface)
     if (surface->ref_count == (unsigned int)-1)
 	return surface;
 
+    assert (surface->ref_count > 0);
+
     surface->ref_count++;
 
     return surface;
@@ -290,6 +292,8 @@ cairo_surface_destroy (cairo_surface_t *surface)
     if (surface->ref_count == (unsigned int)-1)
 	return;
 
+    assert (surface->ref_count > 0);
+
     surface->ref_count--;
     if (surface->ref_count)
 	return;
diff --git a/src/cairo.c b/src/cairo.c
index 9dc03041..a070e6ad 100644
--- a/src/cairo.c
+++ b/src/cairo.c
@@ -222,6 +222,8 @@ cairo_reference (cairo_t *cr)
 {
     if (cr->ref_count == (unsigned int)-1)
 	return cr;
+
+    assert (cr->ref_count > 0);
     
     cr->ref_count++;
 
@@ -241,6 +243,8 @@ cairo_destroy (cairo_t *cr)
 {
     if (cr->ref_count == (unsigned int)-1)
 	return;
+
+    assert (cr->ref_count > 0);
     
     cr->ref_count--;
     if (cr->ref_count)