commit 874421203e0161db2cbfb27be6c039cba57f7c63
author Ebrahim Byagowi <ebrahim@gnu.org> Tue Jul 12 03:49:21 2016 +0430
committer Behdad Esfahbod <behdad@behdad.org> Mon Jul 11 16:19:21 2016 -0700
tree 29571dc4f36c286d9c12af5d21ec4bd0a1f86d54
parent 6bf9db4f1e1d51f9acb5e37b89caa8f4d275e7ce

[coretext] Speculative fix for CoreText nullptr access (#288)

src/hb-coretext.cc

diff --git a/src/hb-coretext.cc b/src/hb-coretext.cc
index db6d2aa..f4d9716 100644
--- a/src/hb-coretext.cc
+++ b/src/hb-coretext.cc
@@ -164,21 +164,25 @@
        * system locations that we cannot access from the sandboxed renderer
        * process in Blink. This can be detected by the new file URL location
        * that the newly found font points to. */
-      CFURLRef new_url = (CFURLRef)CTFontCopyAttribute(new_ct_font, kCTFontURLAttribute);
-      if (CFEqual(original_url, new_url)) {
+      CFURLRef new_url = (CFURLRef) CTFontCopyAttribute (new_ct_font, kCTFontURLAttribute);
+      // Keep reconfigured font if URL cannot be retrieved (seems to be the case
+      // on Mac OS 10.12 Sierra), speculative fix for crbug.com/625606
+      if (!original_url || !new_url || CFEqual (original_url, new_url)) {
         CFRelease (ct_font);
         ct_font = new_ct_font;
       } else {
-        CFRelease(new_ct_font);
+        CFRelease (new_ct_font);
         DEBUG_MSG (CORETEXT, ct_font, "Discarding reconfigured CTFont, location changed.");
       }
-      CFRelease(new_url);
+      if (new_url)
+        CFRelease (new_url);
     }
     else
       DEBUG_MSG (CORETEXT, ct_font, "Font copy with empty cascade list failed");
   }
 
-  CFRelease(original_url);
+  if (original_url)
+    CFRelease (original_url);
   return ct_font;
 }