Hello,
please review the attached patch. It should fix a fontconfig crash triggered
by a Qt patch that should improve font loading performance
(FcFontSort->FcFontMatch, but that should be actually irrelevant). A Valgrind
log for the crash is attached, it's a double free.
Now, I actually don't have any simple testcase or a good understanding of
those strange things done in fontconfig, but I have the patch :). As the
patch seems to be rather simple and obvious, I hope we can skip this
complicated step.
If I'm getting it right, FcConfigEvaluate() always allocates its result,
which should be somewhen later freed. It itself does so e.g. in the
FcOpOr..FcOpDivide cases, where it recursively calls itself. In the FcOpField
case it calls FcPatternGet(), which however doesn't seem to create a copy of
the value, it only calls FcValueCanonicalize() and assigns the value. This
specific crash seems to happen only for type FcTypeMatrix.
If the patch is ok, please apply it. Otherwise I'll try to elaborate more on
the problem or try to create a testcase.
--
Lubos Lunak
KDE developer
---------------------------------------------------------------------
SuSE CR, s.r.o. e-mail: l.lunak@xxxxxxx , l.lunak@xxxxxxx
Drahobejlova 27 tel: +420 2 9654 2373
190 00 Praha 9 fax: +420 2 9654 2374
Czech Republic http://www.suse.cz/
--- src/fccfg.c.sav 2006-01-02 16:44:39.000000000 +0100
+++ src/fccfg.c 2006-01-02 16:45:28.000000000 +0100
@@ -823,6 +823,7 @@ FcConfigEvaluate (FcPattern *p, FcExpr *
r = FcPatternGet (p, e->u.field, 0, &v);
if (r != FcResultMatch)
v.type = FcTypeVoid;
+ v = FcValueSave (v);
break;
case FcOpConst:
if (FcNameConstant (e->u.constant, &v.u.i))
==19365== Invalid free() / delete / delete[]
==19365== at 0x1B9003C3: free (in /usr/lib/valgrind/vgpreload_memcheck.so)
==19365== by 0x1B92070A: FcMatrixFree (fcmatrix.c:52)
==19365== by 0x1B922642: FcValueListDestroy (fcpat.c:160)
==19365== by 0x1B911923: FcConfigDel (fccfg.c:1216)
==19365== by 0x1B911A00: FcConfigPatternDel (fccfg.c:1249)
==19365== by 0x1B911F3E: FcConfigSubstituteWithPat (fccfg.c:1423)
==19365== by 0x1B91F7D4: FcFontRenderPrepare (fcmatch.c:501)
==19365== by 0x1B91FD7A: FcFontSetMatch (fcmatch.c:696)
==19365== by 0x1B91FE15: FcFontMatch (fcmatch.c:718)
==19365== by 0x42E158AD: XftFontMatch (in /usr/X11R6/lib/libXft.so.2.1.2)
==19365== by 0x1BEC6D8D: loadFontConfigFont(QFontPrivate const*, QFontDef const&, QFont::Script) (qfontdatabase_x11.cpp:1895)
==19365== by 0x1BEC753B: QFontDatabase::findFont(QFont::Script, QFontPrivate const*, QFontDef const&, int) (qfontdatabase.cpp:981)
==19365== Address 0x1C3F32D0 is 0 bytes inside a block of size 32 free'd
==19365== at 0x1B9003C3: free (in /usr/lib/valgrind/vgpreload_memcheck.so)
==19365== by 0x1B92070A: FcMatrixFree (fcmatrix.c:52)
==19365== by 0x1B922328: FcValueDestroy (fcpat.c:78)
==19365== by 0x1B910B8E: FcConfigEvaluate (fccfg.c:962)
==19365== by 0x1B911509: FcConfigValues (fccfg.c:1113)
==19365== by 0x1B911D83: FcConfigSubstituteWithPat (fccfg.c:1362)
==19365== by 0x1B91F7D4: FcFontRenderPrepare (fcmatch.c:501)
==19365== by 0x1B91FD7A: FcFontSetMatch (fcmatch.c:696)
==19365== by 0x1B91FE15: FcFontMatch (fcmatch.c:718)
==19365== by 0x42E158AD: XftFontMatch (in /usr/X11R6/lib/libXft.so.2.1.2)
==19365== by 0x1BEC6D8D: loadFontConfigFont(QFontPrivate const*, QFontDef const&, QFont::Script) (qfontdatabase_x11.cpp:1895)
==19365== by 0x1BEC753B: QFontDatabase::findFont(QFont::Script, QFontPrivate const*, QFontDef const&, int) (qfontdatabase.cpp:981)
_______________________________________________
Fontconfig mailing list
Fontconfig@xxxxxxxxxxxxxxxxxxxxx
http://lists.freedesktop.org/mailman/listinfo/fontconfig
