Re: [ft-devel] More crashes on ARM

[Frank Meerkoetter]

Quoting david turner <address@hidden>:

Hello,

> the "cmap->clazz" value is definitely wrong, and there is no way the
> charmap was built
> with it. In other words, the field has been rewritten after creation of
> the charmap !!
>
> Can you re-run the program but set a watch on the fields's memory
> address ? This would
> help us spot the problem.

My guess is that there is a problem with a cast.

The FT_Face structure looks like this:

typedef struct  FT_FaceRec_ {
  ....
  FT_Size           size;
  FT_CharMap        charmap;

  /address@hidden begin */

  FT_Driver         driver;
  ....
}

An FT_Face argument is passed to FT_Get_Next_Char(FT_Face face,
                    FT_ULong  charcode,
                    FT_UInt  *agindex ).
When examining face it looks OK.

(gdb) p *face
$22 = {num_faces = 1, face_index = 0, face_flags = 537, style_flags = 3,
  num_glyphs = 786, family_name = 0x4deb8 "FreeMono",
  style_name = 0x4e2a8 "BoldOblique", num_fixed_sizes = 0,
  available_sizes = 0x0, num_charmaps = 3, charmaps = 0x4e2b8, generic = {
    data = 0x0, finalizer = 0}, bbox = {xMin = -514, yMin = -278, xMax = 840,
    yMax = 1111}, units_per_EM = 1000, ascender = 1111, descender = -278,
  height = 1479, max_advance_width = 600, max_advance_height = 1479,
  underline_position = -100, underline_thickness = 50, glyph = 0x4fb40,
  size = 0x4fc40, charmap = 0x4fa90, driver = 0x505b8, memory = 0x4efb8,
  stream = 0x4fa60, sizes_list = {head = 0x4fcb8, tail = 0x4fcb8}, 
autohint = {
    data = 0x0, finalizer = 0}, extensions = 0x0, internal = 0x4c1d8}
(gdb) p *face->charmap
$23 = {face = 0x4bb90, encoding = FT_ENCODING_UNICODE, platform_id = 0,
  encoding_id = 3}
(gdb) p *face->driver
$24 = {root = {clazz = 0x4078db9c, library = 0x4c0b8, memory = 0x4efb8,
    generic = {data = 0x0, finalizer = 0}}, clazz = 0x4078db9c, faces_list = {
    head = 0x4f1c8, tail = 0x4f1c8}, extensions = 0x0, glyph_loader = 0x4d768}

FT_CMAP is than used to cast a part of the FT_Face structure
into a FT_CMAP structure (1).

FT_Get_Next_Char( FT_Face   face,
                    FT_ULong  charcode,
                    FT_UInt  *agindex )
  {
    FT_ULong  result = 0;
    FT_UInt   gindex = 0;


    if ( face && face->charmap )
    {
      FT_UInt32  code = (FT_UInt32)charcode;
      FT_CMap    cmap = FT_CMAP( face->charmap );  // (1)


      gindex = cmap->clazz->char_next( cmap, &code );
      result = ( gindex == 0 ) ? 0 : code;
    }

    if ( agindex )
      *agindex = gindex;

    return result;
  }

(gdb) p *cmap
$32 = {charmap = {face = 0x4bb90, encoding = FT_ENCODING_UNICODE,
    platform_id = 0, encoding_id = 3}, clazz = 0x30000}

My guess is that clazz should point to 0x505b8 (aka. driver).
Is this correct?

Regards,
  Frank