With the fix from bug 1176718, there is a second similar bug that can cause a crash in the font handling code.


#5  <signal handler called>
#6  resolve_non_null (env=0x7f5b11efc9d8, obj=0x0, fieldID=0xc2) at /usr/src/debug/java-1.7.0-openjdk/openjdk/hotspot/src/share/vm/runtime/jniHandles.hpp:202
#7  jni_GetObjectField (env=0x7f5b11efc9d8, obj=0x0, fieldID=0xc2) at /usr/src/debug/java-1.7.0-openjdk/openjdk/hotspot/src/share/vm/prims/jni.cpp:2640
#8  0x00007f5af6671e31 in CloseTTFontFileFunc (stream=<value optimized out>) at ../../../src/share/native/sun/font/freetypeScaler.c:161
#9  0x000000364b010f17 in FT_Stream_Free (stream=0x7f5a84007bc0, external=1) at /usr/src/debug/freetype-2.3.11/src/base/ftobjs.c:196
#10 0x000000364b0119d4 in destroy_face (memory=0x7f5a84001580, face=0x7f5a84007c20, driver=0x7f5a84001370) at /usr/src/debug/freetype-2.3.11/src/base/ftobjs.c:874
#11 0x000000364b011a92 in FT_Done_Face (face=0x7f5a84007c20) at /usr/src/debug/freetype-2.3.11/src/base/ftobjs.c:2260
#12 0x00007f5af6673072 in freeNativeResources (env=0x7f5b11efc9d8, scaler=<value optimized out>, font2D=<value optimized out>, pScaler=140026738382000)
    at ../../../src/share/native/sun/font/freetypeScaler.c:124
#13 Java_sun_font_FreetypeFontScaler_disposeNativeScaler (env=0x7f5b11efc9d8, scaler=<value optimized out>, font2D=<value optimized out>, pScaler=140026738382000)
    at ../../../src/share/native/sun/font/freetypeScaler.c:1052
#14 0x00007f5b071817f8 in ?? ()

  jfieldID platNameField =
       (*env)->GetFieldID(env, tmpClass, "platName", "Ljava/lang/String;");
  jstring platName = (*env)->GetObjectField(env,
                                            scalerInfo->font2D,
                                            platNameField);
  const char *name = JNU_GetStringPlatformChars(env, platName, NULL);



Previously font2D was the wrong kind of object, but now it is
occasionally null. All the places in FreetypeFontScaler which pass in
the font, other than initialisation, get it by calling
WeakReference.get().

It would seem to me that any code using the result of that should expect
that it may be null, but the native code assumes it is not.


There are comments in FontScaler which say:
   - scalers are disposed when associated Font2D object (e.g. TruetypeFont)
     is garbage collected. That's why this object implements DisposerRecord
     interface directly (as it is not used as indicator when it is safe
     to release native state) and that's why we have to use WeakReference
     to Font internally.

However it isn't particular clear that the (Freetype)FontScaler is
guaranteed to have dispose() called before it's WeakReference to the
Font2D is cleared. If there is not that guarantee, then it should
probably be guarded by a null check.


Rather than add a null check, CloseTTFontFileFunc could probably do nothing or be removed, since OpenJDK's 2d-dev list did not report a reason for it doing anything.