Changeset 93216 in webkit

Timestamp:

Aug 17, 2011, 10:23:24 AM (15 years ago)

Author:

bashi@chromium.org

Message:

[Chromium] Crash in HarfbuzzFace::~HarfbuzzFace
​https://bugs.webkit.org/show_bug.cgi?id=66211

Holds Skia's unique font ID instead of FontPlatformData to avoid accessing freed FontPlatformData.

Reviewed by Tony Chang.

No new tests; no functional change.

• platform/graphics/chromium/HarfbuzzSkia.cpp:

(WebCore::releaseCachedHarfbuzzFace): Changed the argument.
(WebCore::HarfbuzzFace::HarfbuzzFace): Changed to have Skia's font uniqueID instead of FontPlatformData.
(WebCore::HarfbuzzFace::~HarfbuzzFace): Uses m_uniqueID to call releaseCachedHarfbuzzFace.

• platform/graphics/chromium/HarfbuzzSkia.h:

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• platform/graphics/chromium/HarfbuzzSkia.cpp (modified) (2 diffs)
• platform/graphics/chromium/HarfbuzzSkia.h (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-08-17  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [Chromium] Crash in HarfbuzzFace::~HarfbuzzFace
+        https://bugs.webkit.org/show_bug.cgi?id=66211
+
+        Holds Skia's unique font ID instead of FontPlatformData to avoid accessing freed FontPlatformData.
+
+        Reviewed by Tony Chang.
+
+        No new tests; no functional change.
+
+        * platform/graphics/chromium/HarfbuzzSkia.cpp:
+        (WebCore::releaseCachedHarfbuzzFace): Changed the argument.
+        (WebCore::HarfbuzzFace::HarfbuzzFace): Changed to have Skia's font uniqueID instead of FontPlatformData.
+        (WebCore::HarfbuzzFace::~HarfbuzzFace): Uses m_uniqueID to call releaseCachedHarfbuzzFace.
+        * platform/graphics/chromium/HarfbuzzSkia.h:
+
 2011-08-17  Jeff Miller  <jeffm@apple.com>
 

trunk/Source/WebCore/platform/graphics/chromium/HarfbuzzSkia.cpp

@@ -247 +247 @@
 }
 
-static void releaseCachedHarfbuzzFace(FontPlatformData* platformData)
-{
-    SkFontID uniqueID = platformData->uniqueID();
+static void releaseCachedHarfbuzzFace(SkFontID uniqueID)
+{
     HarfbuzzFaceCache::iterator result = gHarfbuzzFaceCache->find(uniqueID);
     ASSERT(result != gHarfbuzzFaceCache->end());
@@ -261 +260 @@
 
 HarfbuzzFace::HarfbuzzFace(FontPlatformData* platformData)
-    : m_platformData(platformData)
-{
-    m_harfbuzzFace = getCachedHarfbuzzFace(m_platformData);
+    : m_uniqueID(platformData->uniqueID())
+{
+    m_harfbuzzFace = getCachedHarfbuzzFace(platformData);
 }
 
 HarfbuzzFace::~HarfbuzzFace()
 {
-    releaseCachedHarfbuzzFace(m_platformData);
+    releaseCachedHarfbuzzFace(m_uniqueID);
 }
 

trunk/Source/WebCore/platform/graphics/chromium/HarfbuzzSkia.h

@@ -56 +56 @@
     explicit HarfbuzzFace(FontPlatformData*);
 
-    FontPlatformData* m_platformData;
+    uint32_t m_uniqueID;
     HB_FaceRec_* m_harfbuzzFace;
 };