| Summary: | Double free of cairo_simple_font_face_t | ||
|---|---|---|---|
| Product: | cairo | Reporter: | Carl Worth <cworth> |
| Component: | freetype font backend | Assignee: | Owen Taylor <otaylor> |
| Status: | VERIFIED FIXED | QA Contact: | cairo-bugs mailing list <cairo-bugs> |
| Severity: | normal | ||
| Priority: | high | CC: | jwatt |
| Version: | 0.9.3 | ||
| Hardware: | x86 (IA32) | ||
| OS: | Linux (All) | ||
| Whiteboard: | |||
| i915 platform: | i915 features: | ||
Actually, it was something really trivial ... I just forgot to update cairo_simple_font_face_t when I moved freeing the structure from the backend to the wrapper code. The reason this test case excercises it is that the font doesn't get added to any caches so it is freed immediately. 2005-04-14 Owen Taylor <otaylor@redhat.com> * src/cairo-font.c (_cairo_simple_font_face_destroy): Remove a stray free() (#3029, Carl Worth) * test/select-font-no-show-text.c: Note that the bug is fixed. Ah, OK. All the talk of mutual referencing and resurrection left me to unsure to see the easy fix. Thanks for the quick fix. Move bugs against "cvs" version to "0.9.3" so we can remove the "cvs" version. |
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.
If a cairo_simple_font_face_t has been created, but never been used, (so unreferenced by any cairo_ft_unscaled_font_t), then cairo attempts to free the cairo_simple_font_face_t twice. The two free calls appear in the code as: cairo_font_face_destroy: font_face->backend->destroy (font_face); _cairo_simple_font_face_destroy: free (simple_face); cairo_font_face_destroy: free (font_face); I won't pretend to understand the mutual reference problem, (or solution), well enough to attempt a fix here. See cairo/test/select-font-no-show-text.c for a simple test case that exercises the bug.