7141914: Draw glyph cause JVM crash
Reviewed-by: bae, igor
diff --git a/jdk/src/share/classes/sun/font/FileFont.java b/jdk/src/share/classes/sun/font/FileFont.java
index adce6d9..9c72251 100644
--- a/jdk/src/share/classes/sun/font/FileFont.java
+++ b/jdk/src/share/classes/sun/font/FileFont.java
@@ -163,7 +163,9 @@
}
}
}
- scaler.dispose();
+ if (scaler != null) {
+ scaler.dispose();
+ }
scaler = FontScaler.getNullScaler();
}
diff --git a/jdk/src/share/classes/sun/font/StandardGlyphVector.java b/jdk/src/share/classes/sun/font/StandardGlyphVector.java
index c452dd9..6600168 100644
--- a/jdk/src/share/classes/sun/font/StandardGlyphVector.java
+++ b/jdk/src/share/classes/sun/font/StandardGlyphVector.java
@@ -1740,8 +1740,9 @@
tx,
sgv.font.getStyle(),
aa, fm);
-
- FontStrike strike = sgv.font2D.getStrike(desc); // !!! getStrike(desc, false)
+ // Get the strike via the handle. Shouldn't matter
+ // if we've invalidated the font but its an extra precaution.
+ FontStrike strike = sgv.font2D.handle.font2D.getStrike(desc); // !!! getStrike(desc, false)
return new GlyphStrike(sgv, strike, dx, dy);
}
diff --git a/jdk/src/share/classes/sun/font/SunFontManager.java b/jdk/src/share/classes/sun/font/SunFontManager.java
index bd55f8b..bb069a3 100644
--- a/jdk/src/share/classes/sun/font/SunFontManager.java
+++ b/jdk/src/share/classes/sun/font/SunFontManager.java
@@ -2619,6 +2619,9 @@
physicalFonts.remove(oldFont.fullName);
fullNameToFont.remove(oldFont.fullName.toLowerCase(Locale.ENGLISH));
FontFamily.remove(oldFont);
+ if (oldFont instanceof FileFont) {
+ ((FileFont)oldFont).deregisterFontAndClearStrikeCache();
+ }
if (localeFullNamesToFont != null) {
Map.Entry[] mapEntries =
diff --git a/jdk/src/share/classes/sun/font/TrueTypeFont.java b/jdk/src/share/classes/sun/font/TrueTypeFont.java
index e60a74b..5a3180e 100644
--- a/jdk/src/share/classes/sun/font/TrueTypeFont.java
+++ b/jdk/src/share/classes/sun/font/TrueTypeFont.java
@@ -1037,6 +1037,9 @@
if (head_Table != null && head_Table.capacity() >= 18) {
ShortBuffer sb = head_Table.asShortBuffer();
upem = sb.get(9) & 0xffff;
+ if (upem < 16 || upem > 16384) {
+ upem = 2048;
+ }
}
ByteBuffer os2_Table = getTableBuffer(os_2Tag);
