segfault when creating a PNG (bit not SVG) with Gadfly

backtrace

cmundi@space$ git describe
v0.2.0-2243-gf684174

cmundi@space$ gdb --ex run --args julia test_gadfly.jl
GNU gdb (GDB) 7.6.1 (Debian 7.6.1-1)
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /home/cmundi/julia/usr/bin/julia-debug...done.
Starting program: /home/cmundi/julia/julia test_gadfly.jl
warning: Could not load shared library symbols for linux-vdso.so.1.
Do you need "set solib-search-path" or "set sysroot"?
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7ffff2df9700 (LWP 20296)]
INFO: Updating METADATA...
[Thread 0x7ffff2df9700 (LWP 20296) exited]
INFO: Computing changes...
INFO: No packages to install, update or remove
[New Thread 0x7ffff2df9700 (LWP 26800)]
[Thread 0x7ffff2df9700 (LWP 26800) exited]
[New Thread 0x7ffff2df9700 (LWP 26851)]

Program received signal SIGSEGV, Segmentation fault.
0x00007fffe731d000 in julia_write_to_ios_callback18077 ()
(gdb) bt
#0  0x00007fffe731d000 in julia_write_to_ios_callback18077 ()
#1  0x00007fffedfea59e in ?? () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
#2  0x00007ffff110fe19 in ?? () from /lib/x86_64-linux-gnu/libpng12.so.0
#3  0x00007ffff1115fa5 in png_write_info_before_PLTE () from /lib/x86_64-linux-gnu/libpng12.so.0
#4  0x00007ffff111620d in png_write_info () from /lib/x86_64-linux-gnu/libpng12.so.0
#5  0x00007fffedfea86b in ?? () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
#6  0x00007fffedfeb169 in cairo_surface_write_to_png_stream () from /usr/lib/x86_64-linux-gnu/libcairo.so.2
#7  0x00007fffe731e091 in julia_write_to_png18076 () at /home/cmundi/.julia/v0.3/Cairo/src/Cairo.jl:279
#8  0x00007fffe731e0f7 in jlcall_julia_write_to_png18076 ()
#9  0x00007ffff6d09335 in jl_apply (f=0x11a54c50, args=0x7fffffffd0d0, nargs=2) at julia.h:961
#10 0x00007ffff6d0c886 in jl_trampoline (F=0x11a54c50, args=0x7fffffffd0d0, nargs=2) at builtins.c:784
#11 0x00007ffff6d001b3 in jl_apply (f=0x11a54c50, args=0x7fffffffd0d0, nargs=2) at julia.h:961
#12 0x00007ffff6d04799 in jl_apply_generic (F=0x19644570, args=0x7fffffffd0d0, nargs=2) at gf.c:1375
#13 0x00007fffe73541fc in julia_finish18021 () at /home/cmundi/.julia/v0.3/Compose/src/cairo_backends.jl:185
#14 0x00007fffe7354095 in julia_draw18013 () at /home/cmundi/.julia/v0.3/Compose/src/canvas.jl:266
#15 0x00007ffff6d09335 in jl_apply (f=0x26122760, args=0x7fffffffd2c8, nargs=2) at julia.h:961
#16 0x00007ffff6d0c886 in jl_trampoline (F=0x26122760, args=0x7fffffffd2c8, nargs=2) at builtins.c:784
#17 0x00007ffff6d001b3 in jl_apply (f=0x26122760, args=0x7fffffffd2c8, nargs=2) at julia.h:961
#18 0x00007ffff6d04799 in jl_apply_generic (F=0x1031b150, args=0x7fffffffd2c8, nargs=2) at gf.c:1375
#19 0x00007fffe7355084 in julia_draw18012 () at /home/cmundi/.julia/v0.3/Gadfly/src/Gadfly.jl:728
#20 0x00007ffff6d09335 in jl_apply (f=0x10396740, args=0x7fffffffd498, nargs=2) at julia.h:961
#21 0x00007ffff6d0c886 in jl_trampoline (F=0x10396740, args=0x7fffffffd498, nargs=2) at builtins.c:784
#22 0x00007ffff6d001b3 in jl_apply (f=0x10396740, args=0x7fffffffd498, nargs=2) at julia.h:961
#23 0x00007ffff6d04799 in jl_apply_generic (F=0x1031b150, args=0x7fffffffd498, nargs=2) at gf.c:1375
#24 0x00007ffff6d7ff47 in jl_apply (f=0x1031b150, args=0x7fffffffd498, nargs=2) at julia.h:961
#25 0x00007ffff6d803f1 in do_call (f=0x1031b150, args=0x1bc75248, nargs=2, locals=0x0, nl=0) at interpreter.c:61
#26 0x00007ffff6d80f81 in eval (e=0x27a33f50, locals=0x0, nl=0) at interpreter.c:203
#27 0x00007ffff6d80044 in jl_interpret_toplevel_expr (e=0x27a33f50) at interpreter.c:21
#28 0x00007ffff6d96351 in jl_toplevel_eval_flex (e=0x27a33ed0, fast=1) at toplevel.c:470
---Type <return> to continue, or q <return> to quit---
#29 0x00007ffff6d9664e in jl_parse_eval_all (fname=0x1aa7d80 "/home/cmundi/julia/test_gadfly.jl") at toplevel.c:518
#30 0x00007ffff6d96872 in jl_load (fname=0x1aa7d80 "/home/cmundi/julia/test_gadfly.jl") at toplevel.c:549
#31 0x00007ffff6d9691e in jl_load_ (str=0x1ce3ef0) at toplevel.c:560
#32 0x00007ffff4bf75a0 in julia_include1801 () at boot.jl:244
#33 0x00007ffff6d001b3 in jl_apply (f=0x1a86b40, args=0x7fffffffdce8, nargs=1) at julia.h:961
#34 0x00007ffff6d04799 in jl_apply_generic (F=0x1a86a40, args=0x7fffffffdce8, nargs=1) at gf.c:1375
#35 0x00007ffff433c218 in julia_include_from_node115401 () at loading.jl:120
#36 0x00007ffff6d09335 in jl_apply (f=0x1e57f70, args=0x7fffffffe0b0, nargs=1) at julia.h:961
#37 0x00007ffff6d0c886 in jl_trampoline (F=0x1e57f70, args=0x7fffffffe0b0, nargs=1) at builtins.c:784
#38 0x00007ffff6d001b3 in jl_apply (f=0x1e57f70, args=0x7fffffffe0b0, nargs=1) at julia.h:961
#39 0x00007ffff6d04799 in jl_apply_generic (F=0x168a720, args=0x7fffffffe0b0, nargs=1) at gf.c:1375
#40 0x00007ffff4d281cb in julia_process_options14251 () at client.jl:261
#41 0x00007ffff4d25248 in julia__start14178 () at client.jl:326
#42 0x00007ffff4d258d9 in jlcall_julia__start14178 () from /home/cmundi/julia/usr/bin/../lib/julia/sys.so
#43 0x00007ffff6d09335 in jl_apply (f=0xf48950, args=0x0, nargs=0) at julia.h:961
#44 0x00007ffff6d0c886 in jl_trampoline (F=0xf48950, args=0x0, nargs=0) at builtins.c:784
#45 0x00007ffff6d001b3 in jl_apply (f=0xf48950, args=0x0, nargs=0) at julia.h:961
#46 0x00007ffff6d04799 in jl_apply_generic (F=0xf488d0, args=0x0, nargs=0) at gf.c:1375
#47 0x0000000000401a97 in jl_apply (f=0xf488d0, args=0x0, nargs=0) at /home/cmundi/julia/src/julia.h:961
#48 0x0000000000402767 in true_main (argc=1, argv=0x7fffffffe7c0) at repl.c:277
#49 0x00007ffff6d89f6b in julia_trampoline (argc=1, argv=0x7fffffffe7c0, pmain=0x4025bf <true_main>) at init.c:869
#50 0x0000000000402947 in main (argc=1, argv=0x7fffffffe7c0) at repl.c:316
(gdb) 

test_gadfly.jl

Pkg.update()
using Gadfly

myplot = plot(x=randn(10), y=randn(10))
draw(SVG("test.svg", 3inch, 3inch), myplot)  # ok
draw(PNG("test.png", 3inch, 3inch), myplot)  # segfault

Here's the relevant bit of code in Cairo.jl:

function write_to_png(surface::CairoSurface, stream::IOStream)
    callback = cfunction(write_to_ios_callback, Int32, (Ptr{Void},Ptr{Uint8},Uint32))
    ccall((:cairo_surface_write_to_png_stream,_jl_libcairo), Void,
          (Ptr{Uint8},Ptr{Void},Ptr{Void}), surface.ptr, callback, stream)
end