[PATCH 21.5] fc_config object with NULL pointer

PATCH 21.5

On Thu, May 8, 2014 at 6:41 PM, Stephen J. Turnbull <[email protected]> wrote:
> This is the bug.  I don't understand how this would happen.  All
> objects passed to Ffc_* function should be created with one of the
> four functions calling fc_config_create_using in font-mgr.c.  Perhaps
> fontconfig can return NULL in some cases, but it shouldn't unless
> maybe there's an ENOMEM in there?
>
> More than that I can't say for a few hours.  I'll take a look at the
> backtrace and see if I can figure out how such a thing occurred.

Here is what happened.  In fc_config_create_using, we wrap the
fc_config object as a Lisp object *twice*.  One reference goes onto a
weak list and the other is returned.  The next time we garbage
collect, the weak reference is collected, and the finalizer
(finalize_fc_config) is called, which sets fccfgPtr to NULL.
Meanwhile, the strong reference is still live....

The fix is to wrap the fc_config object once and use the same
reference everywhere, like so:

diff -r 2d20d57d4e7b src/ChangeLog
--- a/src/ChangeLog Wed May 07 13:33:50 2014 -0600
+++ b/src/ChangeLog Wed May 14 10:53:21 2014 -0600
@@ -1,3 +1,9 @@
+2014-05-14  Jerry James  <[email protected]>
+
+ * src/font-mgr.c (fc_config_create_using): wrap the fc_config
+ object as a Lisp object only once, so the strong and weak
+ references refer to the same object.
+
 2014-01-27  Michael Sperber  <[email protected]>

  * symbols.c (Fdefine_function): Allow optional `docstring'
diff -r 2d20d57d4e7b src/font-mgr.c
--- a/src/font-mgr.c Wed May 07 13:33:50 2014 -0600
+++ b/src/font-mgr.c Wed May 14 10:53:21 2014 -0600
@@ -526,11 +526,13 @@
   }

   {
+    Lisp_Object cfg;
     fc_config *fccfg = XFC_CONFIG (ALLOC_NORMAL_LISP_OBJECT (fc_config));
     fccfg->fccfgPtr = fc;
-    configs = Fcons (wrap_fc_config (fccfg), configs);
+    cfg = wrap_fc_config (fccfg);
+    configs = Fcons (cfg, configs);
     XWEAK_LIST_LIST (Vfc_config_weak_list) = configs;
-    return wrap_fc_config (fccfg);
+    return cfg;
   }
 }


Regards,
-- 
Jerry James
http://www.jamezone.org/