diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2013-09-17 16:28:19 +0100 |
|---|---|---|
| committer | Chris Wilson <chris@chris-wilson.co.uk> | 2013-09-17 16:37:47 +0100 |
| commit | 337ab1f8d9e29086bfb4001508b28835b41c6390 (patch) | |
| tree | 7187ccfda4d59b754b1919e97be7811db9f07eb8 /src/cairo-quartz-font.c | |
| parent | 0ac81988c199df1a6652dc0ea72627122bf95c6c (diff) | |
| download | cairo-337ab1f8d9e29086bfb4001508b28835b41c6390.tar.gz | |
font: Push the last reference dec into the backend->destroy() callback
In order to close a race between locking the backend and resurrecting a
font via the cache, we need to keep the font face alive until after we
take the backend lock. Once we have that lock, we can drop our reference
and test if that was the last. Otherwise we must abort the destroy().
This fixes the double-free exposed by multithreaded applications trying
to create and destroy the same font concurrently.
Reported-by: Weeble <clockworksaint@gmail.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=69470
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Diffstat (limited to 'src/cairo-quartz-font.c')
| -rw-r--r-- | src/cairo-quartz-font.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/cairo-quartz-font.c b/src/cairo-quartz-font.c index a9bbbdc7a..e6a379ad4 100644 --- a/src/cairo-quartz-font.c +++ b/src/cairo-quartz-font.c @@ -241,12 +241,13 @@ _cairo_quartz_font_face_create_for_toy (cairo_toy_font_face_t *toy_face, return CAIRO_STATUS_SUCCESS; } -static void +static cairo_bool_t _cairo_quartz_font_face_destroy (void *abstract_face) { cairo_quartz_font_face_t *font_face = (cairo_quartz_font_face_t*) abstract_face; CGFontRelease (font_face->cgFont); + return TRUE; } static const cairo_scaled_font_backend_t _cairo_quartz_scaled_font_backend; |