[HarfBuzz] harfbuzz: Branch 'master'

[Behdad Esfahbod]

 src/hb-ot-layout-private.hh                |    3 +--
 src/hb-ot-layout.cc                        |    4 ++--
 src/hb-ot-shape-complex-arabic-fallback.hh |    2 +-
 3 files changed, 4 insertions(+), 5 deletions(-)

New commits:
commit 395b35903e052aecc97d0807e4f813c64c0d2b0b
Author: Behdad Esfahbod <behdad at behdad.org>
Date:   Sun Dec 28 16:03:26 2014 -0800

    Avoid accessing layout tables at face destruction
    
    "Fixes" https://bugs.freedesktop.org/show_bug.cgi?id=86300
    
    Based on discussion someone else who had a similar issue, most probably
    the user is releasing FT_Face before destructing hb_face_t / hb_font_t.
    While that's a client bug, and while we can (and should) use FreeType
    refcounting to help avoid that, it happens that we were accessing
    the table when we didn't really have to.  Avoid that.

diff --git a/src/hb-ot-layout-private.hh b/src/hb-ot-layout-private.hh
index ae7daa6..3f7c858 100644
--- a/src/hb-ot-layout-private.hh
+++ b/src/hb-ot-layout-private.hh
@@ -126,8 +126,7 @@ struct hb_ot_layout_lookup_accelerator_t
     lookup.add_coverage (&digest);
   }
 
-  template <typename TLookup>
-  inline void fini (const TLookup &lookup HB_UNUSED)
+  inline void fini (void)
   {
   }
 
diff --git a/src/hb-ot-layout.cc b/src/hb-ot-layout.cc
index 661d90e..602b94e 100644
--- a/src/hb-ot-layout.cc
+++ b/src/hb-ot-layout.cc
@@ -84,9 +84,9 @@ void
 _hb_ot_layout_destroy (hb_ot_layout_t *layout)
 {
   for (unsigned int i = 0; i < layout->gsub_lookup_count; i++)
-    layout->gsub_accels[i].fini (layout->gsub->get_lookup (i));
+    layout->gsub_accels[i].fini ();
   for (unsigned int i = 0; i < layout->gpos_lookup_count; i++)
-    layout->gpos_accels[i].fini (layout->gpos->get_lookup (i));
+    layout->gpos_accels[i].fini ();
 
   free (layout->gsub_accels);
   free (layout->gpos_accels);
diff --git a/src/hb-ot-shape-complex-arabic-fallback.hh b/src/hb-ot-shape-complex-arabic-fallback.hh
index dc659e0..a77f24e 100644
--- a/src/hb-ot-shape-complex-arabic-fallback.hh
+++ b/src/hb-ot-shape-complex-arabic-fallback.hh
@@ -327,7 +327,7 @@ arabic_fallback_plan_destroy (arabic_fallback_plan_t *fallback_plan)
   for (unsigned int i = 0; i < fallback_plan->num_lookups; i++)
     if (fallback_plan->lookup_array[i])
     {
-      fallback_plan->accel_array[i].fini (fallback_plan->lookup_array[i]);
+      fallback_plan->accel_array[i].fini ();
       if (fallback_plan->free_lookups)
 	free (fallback_plan->lookup_array[i]);
     }