From 0238fe2cafea2e1ed19bb222117bd73ee6898d4d Mon Sep 17 00:00:00 2001 From: Karl Tomlinson <karlt+@karlt.net> Date: Thu, 14 May 2009 10:46:29 +0000 Subject: [ft] Resolve mutual referencing problems with zombie faces Bug 21706 -- zombie ft_font_face / ft_unscaled_font mutual referencing problems [http://bugs.freedesktop.org/show_bug.cgi?id=21706] There can be more than one zombie font_face belonging to an unscaled_font, but only the first is destroyed. This leaks the client's FT_Face (and associated font data) as release of the FT_Face depends on release of the font_face. (The reason why Firefox ends up with two different font_faces for one unscaled_font is that load_flags for faces with artificial oblique have FT_LOAD_NO_BITMAP set. https://bugzilla.mozilla.org/show_bug.cgi?id=486974) Also it's possible for _cairo_ft_font_face_create to pull out a zombie font_face from the unscaled_font, which would crash _cairo_ft_font_face_scaled_font_create, as that expects non-null font_face->unscaled (if !font-face->pattern). --- diff --git a/AUTHORS b/AUTHORS index 289fecb..8c06174 100644 --- a/AUTHORS +++ b/AUTHORS @@ -86,7 +86,7 @@ Travis Spencer <tspencer@cs.pdx.edu> XCB backend fix Bill Spitzak <spitzak@d2.com> Build fix to find Xrender.h without xrender.pc Zhe Su <james.su@gmail.com> Add support for fontconfig's embeddedbitmap option Owen Taylor <otaylor@redhat.com> Font rewrite, documentation, win32 backend -Karl Tomlinson <karlt+@karlt.net> +Karl Tomlinson <karlt+@karlt.net> Optimisation and obscure bug fixes (mozilla) Alp Toker <alp@atoker.com> Fix several code/comment typos Malcolm Tredinnick <malcolm@commsecure.com.au> Documentation fixes David Turner <david@freetype.org> Optimize gradient calculations diff --git a/src/cairo-ft-font.c b/src/cairo-ft-font.c index 1e2a18e..f9ff0b1 100644 --- a/src/cairo-ft-font.c +++ b/src/cairo-ft-font.c @@ -543,8 +543,10 @@ _cairo_ft_unscaled_font_destroy (void *abstract_font) /* See comments in _ft_font_face_destroy about the "zombie" state * for a _ft_font_face. */ - if (unscaled->faces && !unscaled->faces->unscaled) + if (unscaled->faces && unscaled->faces->unscaled == NULL) { + assert (unscaled->faces->next == NULL); cairo_font_face_destroy (&unscaled->faces->base); + } } else { _font_map_release_face_lock_held (font_map, unscaled); } @@ -2233,9 +2235,10 @@ _cairo_ft_font_face_destroy (void *abstract_face) if (font_face == NULL) return; - /* When destroying the face created by cairo_ft_font_face_create_for_ft_face, + /* When destroying a face created by cairo_ft_font_face_create_for_ft_face, * we have a special "zombie" state for the face when the unscaled font - * is still alive but there are no public references to the font face. + * is still alive but there are no other references to a font face with + * the same FT_Face. * * We go from: * @@ -2249,6 +2252,8 @@ _cairo_ft_font_face_destroy (void *abstract_face) if (font_face->unscaled && font_face->unscaled->from_face && + font_face->next == NULL && + font_face->unscaled->faces == font_face && CAIRO_REFERENCE_COUNT_GET_VALUE (&font_face->unscaled->base.ref_count) > 1) { cairo_font_face_reference (&font_face->base); @@ -2394,12 +2399,21 @@ _cairo_ft_font_face_create (cairo_ft_unscaled_font_t *unscaled, font_face->ft_options.extra_flags == ft_options->extra_flags && cairo_font_options_equal (&font_face->ft_options.base, &ft_options->base)) { - if (font_face->base.status == CAIRO_STATUS_SUCCESS) - return cairo_font_face_reference (&font_face->base); + if (font_face->base.status) { + /* The font_face has been left in an error state, abandon it. */ + *prev_font_face = font_face->next; + break; + } - /* The font_face has been left in an error state, abandon it. */ - *prev_font_face = font_face->next; - break; + if (font_face->unscaled == NULL) { + /* Resurrect this "zombie" font_face (from + * _cairo_ft_font_face_destroy), switching its unscaled_font + * from owner to ownee. */ + font_face->unscaled = unscaled; + _cairo_unscaled_font_reference (&unscaled->base); + return &font_face->base; + } else + return cairo_font_face_reference (&font_face->base); } } @@ -2415,6 +2429,14 @@ _cairo_ft_font_face_create (cairo_ft_unscaled_font_t *unscaled, font_face->ft_options = *ft_options; + if (unscaled->faces && unscaled->faces->unscaled == NULL) { + /* This "zombie" font_face (from _cairo_ft_font_face_destroy) + * is no longer needed. */ + assert (unscaled->from_face && unscaled->faces->next == NULL); + cairo_font_face_destroy (&unscaled->faces->base); + unscaled->faces = NULL; + } + font_face->next = unscaled->faces; unscaled->faces = font_face; -- cgit v0.8.2