[cairo-paginated-surface] Clean up reference counting mess

Previously the paginated constructor didn't reference the target surface, but
simply assume ownership of the reference, and then unref it when shutting
down.  The callers to paginated constructor then, where just give away their
reference to paginated and not unref the reference they were holding.  While
this works correctly, it's against the usual idioms that everyone is
responsible for the reference they are holding, and should get their own
reference if they need to keep an object alive.  Fix it all.

6 files changed, 29 insertions, 10 deletions

diff --git a/src/cairo-paginated-surface.c b/src/cairo-paginated-surface.c
index e490b450f..4c47749c8 100644
--- a/src/cairo-paginated-surface.c
+++ b/src/cairo-paginated-surface.c
@@ -89,7 +89,7 @@ _cairo_paginated_surface_create (cairo_surface_t				*target,
      * evidence of the paginated wrapper out to the user. */
     surface->base.type = cairo_surface_get_type (target);
 
-    surface->target = target;
+    surface->target = cairo_surface_reference (target);
 
     surface->content = content;
     surface->width = width;
diff --git a/src/cairo-pdf-surface.c b/src/cairo-pdf-surface.c
index bb39e0351..3573b55d4 100644
--- a/src/cairo-pdf-surface.c
+++ b/src/cairo-pdf-surface.c
@@ -301,9 +301,13 @@ _cairo_pdf_surface_create_for_stream_internal (cairo_output_stream_t	*output,
 					  CAIRO_CONTENT_COLOR_ALPHA,
 					  width, height,
 					  &cairo_pdf_surface_paginated_backend);
+
     status = surface->paginated_surface->status;
-    if (status == CAIRO_STATUS_SUCCESS)
+    if (status == CAIRO_STATUS_SUCCESS) {
+	/* paginated keeps the only reference to surface now, drop ours */
+	cairo_surface_destroy (&surface->base);
 	return surface->paginated_surface;
+    }
 
 BAIL1:
     _cairo_scaled_font_subsets_destroy (surface->font_subsets);
diff --git a/src/cairo-ps-surface.c b/src/cairo-ps-surface.c
index 59f07edda..2c07b4763 100644
--- a/src/cairo-ps-surface.c
+++ b/src/cairo-ps-surface.c
@@ -747,8 +747,11 @@ _cairo_ps_surface_create_for_stream_internal (cairo_output_stream_t *stream,
 					   width, height,
 					   &cairo_ps_surface_paginated_backend);
     status = surface->paginated_surface->status;
-    if (status == CAIRO_STATUS_SUCCESS)
+    if (status == CAIRO_STATUS_SUCCESS) {
+	/* paginated keeps the only reference to surface now, drop ours */
+	cairo_surface_destroy (&surface->base);
 	return surface->paginated_surface;
+    }
 
     _cairo_scaled_font_subsets_destroy (surface->font_subsets);
  CLEANUP_OUTPUT_STREAM:
diff --git a/src/cairo-svg-surface.c b/src/cairo-svg-surface.c
index df5253df3..6a0678354 100644
--- a/src/cairo-svg-surface.c
+++ b/src/cairo-svg-surface.c
@@ -384,8 +384,11 @@ _cairo_svg_surface_create_for_document (cairo_svg_document_t	*document,
 						 surface->height,
 						 &cairo_svg_surface_paginated_backend);
     status = paginated->status;
-    if (status == CAIRO_STATUS_SUCCESS)
+    if (status == CAIRO_STATUS_SUCCESS) {
+	/* paginated keeps the only reference to surface now, drop ours */
+	cairo_surface_destroy (&surface->base);
 	return paginated;
+    }
 
     /* ignore status as we are on the error path */
 CLEANUP:
diff --git a/src/cairo-win32-printing-surface.c b/src/cairo-win32-printing-surface.c
index 791eb913e..8fe5bc7fb 100644
--- a/src/cairo-win32-printing-surface.c
+++ b/src/cairo-win32-printing-surface.c
@@ -1500,6 +1500,7 @@ cairo_surface_t *
 cairo_win32_printing_surface_create (HDC hdc)
 {
     cairo_win32_surface_t *surface;
+    cairo_surface_t *paginated;
     RECT rect;
 
     surface = malloc (sizeof (cairo_win32_surface_t));
@@ -1535,11 +1536,16 @@ cairo_win32_printing_surface_create (HDC hdc)
     _cairo_surface_init (&surface->base, &cairo_win32_printing_surface_backend,
                          CAIRO_CONTENT_COLOR_ALPHA);
 
-    return _cairo_paginated_surface_create (&surface->base,
-                                            CAIRO_CONTENT_COLOR_ALPHA,
-					    surface->extents.width,
-					    surface->extents.height,
-                                            &cairo_win32_surface_paginated_backend);
+    paginated = _cairo_paginated_surface_create (&surface->base,
+						 CAIRO_CONTENT_COLOR_ALPHA,
+						 surface->extents.width,
+						 surface->extents.height,
+						 &cairo_win32_surface_paginated_backend);
+
+    /* paginated keeps the only reference to surface now, drop ours */
+    cairo_surface_destroy (&surface->base);
+
+    return paginated;
 }
 
 cairo_bool_t
diff --git a/src/test-paginated-surface.c b/src/test-paginated-surface.c
index f640b6068..f7cc4db6d 100644
--- a/src/test-paginated-surface.c
+++ b/src/test-paginated-surface.c
@@ -93,9 +93,12 @@ _cairo_test_paginated_surface_create_for_data (unsigned char		*data,
     paginated =  _cairo_paginated_surface_create (&surface->base,
 	                                          content, width, height,
 						  &test_paginated_surface_paginated_backend);
+
+    /* paginated keeps the only reference to surface now, drop ours */
+    cairo_surface_destroy (&surface->base);
+
     if (paginated->status) {
 	cairo_surface_destroy (target);
-	free (surface);
     }
     return paginated;
 }