32850 2009-12-21 20:48:54 -0800 Allocate RemoteFontStream on the heap 2009-12-22 10:51:13 -0800 1 1 1 Unclassified WebKit Layout and Rendering 528+ (Nightly build) PC Linux RESOLVED FIXED P2 Normal --- 0 skyul webkit-unassigned agl commit-queue eric evan webkit.review.bot oldest_to_newest 174165 0 skyul 2009-12-21 20:48:54 -0800 In the chromium port of FontCustomPlatformData, an instance of RemoteFontStream is allocated on the stack, so its memory is freed immediately when FontCustomPlatformData::createFontCustomPlatformData returns. SkTypeface::CreateFromStream increments the reference count, but it keeps the pointer to the memory allocated on the stack which is not valid anymore. RemoteFontStream is a descendant of SkRefCount and SkRefCount::unref invokes SkDELETE(this) internally once the reference count reaches zero. This means that SkRefCount-ed instances must be allocated on the heap. It causes a crash in the acid3 test which loads web fonts. 174166 1 45363 skyul 2009-12-21 20:55:29 -0800 Created attachment 45363 Allocate RemoteFontStream on the heap RemoteFontStream must be allocated on the heap. 174167 2 webkit.review.bot 2009-12-21 20:57:47 -0800 style-queue ran check-webkit-style on attachment 45363 without any errors. 174172 3 eric 2009-12-21 21:35:24 -0800 This would need review from one of the Chrome linux guys. Once they OK it, I'm happy to r+. 174303 4 agl 2009-12-22 10:48:03 -0800 LGTM 174306 5 45363 commit-queue 2009-12-22 10:51:08 -0800 Comment on attachment 45363 Allocate RemoteFontStream on the heap Clearing flags on attachment: 45363 Committed r52492: <http://trac.webkit.org/changeset/52492> 174307 6 commit-queue 2009-12-22 10:51:13 -0800 All reviewed patches have been landed. Closing bug. 45363 2009-12-21 20:55:29 -0800 2009-12-22 10:51:08 -0800 Allocate RemoteFontStream on the heap RemoteFontStream.patch text/plain 1982 skyul SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiA1MjQ3OCkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMjUgQEAKKzIwMDktMTItMjEgIEt3YW5nIFl1bCBTZW8gIDxza3l1bEBjb21wYW55 MTAwLm5ldD4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAg ICBBbGxvY2F0ZSBSZW1vdGVGb250U3RyZWFtIG9uIHRoZSBoZWFwCisgICAgICAgIGh0dHBzOi8v YnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0zMjg1MAorCisgICAgICAgIFJlbW90ZUZv bnRTdHJlYW0gaXMgYWxsb2NhdGVkIG9uIHRoZSBzdGFjaywgc28gaXRzIG1lbW9yeSBpcyBmcmVl ZAorICAgICAgICBpbW1lZGlhdGVseSB3aGVuIEZvbnRDdXN0b21QbGF0Zm9ybURhdGE6OmNyZWF0 ZUZvbnRDdXN0b21QbGF0Zm9ybURhdGEKKyAgICAgICAgcmV0dXJucy4gCisKKyAgICAgICAgU2tU eXBlZmFjZTo6Q3JlYXRlRnJvbVN0cmVhbSBpbmNyZW1lbnRzIHRoZSByZWZlcmVuY2UgY291bnQs IGJ1dCBpdCBrZWVwcworICAgICAgICB0aGUgcG9pbnRlciB0byB0aGUgbWVtb3J5IGFsbG9jYXRl ZCBvbiB0aGUgc3RhY2sgd2hpY2ggaXMgbm90IHZhbGlkCisgICAgICAgIGFueW1vcmUuCisKKyAg ICAgICAgUmVtb3RlRm9udFN0cmVhbSBpcyBhIGRlc2NlbmRhbnQgb2YgU2tSZWZDb3VudCBhbmQg U2tSZWZDb3VudDo6dW5yZWYKKyAgICAgICAgaW52b2tlcyBTa0RFTEVURSh0aGlzKSBpbnRlcm5h bGx5IG9uY2UgdGhlIHJlZmVyZW5jZSBjb3VudCByZWFjaGVzIHplcm8uCisgICAgICAgIFRoaXMg bWVhbnMgdGhhdCBTa1JlZkNvdW50LWVkIGluc3RhbmNlcyBtdXN0IGJlIGFsbG9jYXRlZCBvbiB0 aGUgaGVhcC4KKworICAgICAgICAqIHBsYXRmb3JtL2dyYXBoaWNzL2Nocm9taXVtL0ZvbnRDdXN0 b21QbGF0Zm9ybURhdGEuY3BwOgorICAgICAgICAoV2ViQ29yZTo6Y3JlYXRlRm9udEN1c3RvbVBs YXRmb3JtRGF0YSk6CisKIDIwMDktMTItMjEgIEZ1bWl0b3NoaSBVa2FpICA8dWthaUBjaHJvbWl1 bS5vcmc+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgQWxleGV5IFByb3NrdXJ5YWtvdi4KSW5kZXg6 IFdlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3MvY2hyb21pdW0vRm9udEN1c3RvbVBsYXRmb3JtRGF0 YS5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PQotLS0gV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy9jaHJvbWl1bS9G b250Q3VzdG9tUGxhdGZvcm1EYXRhLmNwcAkocmV2aXNpb24gNTI0NzEpCisrKyBXZWJDb3JlL3Bs YXRmb3JtL2dyYXBoaWNzL2Nocm9taXVtL0ZvbnRDdXN0b21QbGF0Zm9ybURhdGEuY3BwCSh3b3Jr aW5nIGNvcHkpCkBAIC0xOTAsOCArMTkwLDggQEAgRm9udEN1c3RvbVBsYXRmb3JtRGF0YSogY3Jl YXRlRm9udEN1c3RvbQogICAgICAgICByZXR1cm4gMDsKICAgICByZXR1cm4gbmV3IEZvbnRDdXN0 b21QbGF0Zm9ybURhdGEoZm9udFJlZmVyZW5jZSwgZm9udE5hbWUpOwogI2VsaWYgUExBVEZPUk0o TElOVVgpCi0gICAgUmVtb3RlRm9udFN0cmVhbSBzdHJlYW0oYnVmZmVyKTsKLSAgICBTa1R5cGVm YWNlKiB0eXBlZmFjZSA9IFNrVHlwZWZhY2U6OkNyZWF0ZUZyb21TdHJlYW0oJnN0cmVhbSk7Cisg ICAgUmVtb3RlRm9udFN0cmVhbSogc3RyZWFtID0gbmV3IFJlbW90ZUZvbnRTdHJlYW0oYnVmZmVy KTsKKyAgICBTa1R5cGVmYWNlKiB0eXBlZmFjZSA9IFNrVHlwZWZhY2U6OkNyZWF0ZUZyb21TdHJl YW0oc3RyZWFtKTsKICAgICBpZiAoIXR5cGVmYWNlKQogICAgICAgICByZXR1cm4gMDsKICAgICBy ZXR1cm4gbmV3IEZvbnRDdXN0b21QbGF0Zm9ybURhdGEodHlwZWZhY2UpOwo=