The destruction of a scaled font could indirectly trigger the destruction
of a second scaled font, causing the global cache to be locked twice in
the same thread.
This is solved by unlinking the font's glyph pages while holding the global
lock, then releasing the lock before destruction takes place.
Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=93891
When doing a "complicated" mask operation, we draw the clip to a surface and use
this as a mask in later operations. The code assumes that this operation draws
to the whole target surface and thus a deferred clear may be skipped.
However, this requires that the extents of the trapezoids that will be drawn and
the extents of the surface are the same. This assumption is wrong, as can be
seen e.g. by the bug report that this commit fixes.
The fix is just not to skip the deferred clear.
Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=84330
Signed-off-by: Uli Schlachter <psychon@znc.in>
In this bug a Type 3 font contains a dash glyph. The dash glyph
consists of an 82x2 image. The image height, when scaled to user space,
is < 1 resuling in the drawing operation for the image being culled.
https://bugs.freedesktop.org/show_bug.cgi?id=94615
If the image operator does not read all the ASCII85 data, the PS
interpreter will try to execute the next byte of unread data.
Define our own image operator that calls flushfile (reads until end of
file) on the filter after drawing the image.
https://bugs.freedesktop.org/show_bug.cgi?id=84811
According to the Opentype spec, num_contours in a glyf table entry can
be > 0 (single glyph) or < 0 (composite glyph). num_contours == 0 is
undefined.
The embedded font in the test case for this bug contained a space
glyph with num_contours == 0. This was failing on some printers.
According to the spec, glyphs with no outlines such as space are
required to have a 0 size entry in the loca table.
https://bugs.freedesktop.org/show_bug.cgi?id=79897
_cairo_clip_init_copy() was removed with commit b132fae5e8,
but a few calls were still remaining.
Signed-off-by: Enrico Weigelt, metux IT consult <enrico.weigelt@gr13.net>
Signed-off-by: Uli Schlachter <psychon@znc.in>
We have two places where copying from box set to clip is
implemented in the same way. Just move that to one function.
Signed-off-by: Enrico Weigelt, metux IT consult <enrico.weigelt@gr13.net>
Signed-off-by: Uli Schlachter <psychon@znc.in>
When parameter force_allocation is false *and* the box set has
exactly one chunk, this chunk is returned directly - w/o copying it.
That mode is never used, and it's highly problematic as it's unclear
whether we have to free the returnd object or it's still owned
by somebody else.
Just dropping the useless parameter / corner case to make the function
simpler and more robust.
Signed-off-by: Enrico Weigelt, metux IT consult <enrico.weigelt@gr13.net>
Signed-off-by: Uli Schlachter <psychon@znc.in>
The code correct, but the compiler can't check that and thinks
there're uninitialized variables.
Perhaps we could rewrite it in a better way, so the compiler
can do better (even arch specific) optimizations.
Signed-off-by: Enrico Weigelt, metux IT consult <enrico.weigelt@gr13.net>
Signed-off-by: Uli Schlachter <psychon@znc.in>
If XShmGetImage() fails, the code tries to continue with its normal,
non-shared-memory path. However, the image variable, which was previously set to
NULL, now points to an already-destroyed surface, causing a double-free when the
function cleans up after itself (actually, its an assertion failure because the
reference count of the surface is zero, but technically this is still a double
free).
Fix this by setting image=NULL after destroying the surface that this refers to,
to make sure this surface will not be destroyed again.
While we are here (multiple changes in a single commit are bad...), also fix the
cleanup done in bail. In practice, &image->base should be safe when image==NULL,
because this just adds some offset to the pointer (the offset here is actually
zero, so this doesn't do anything at all). However, the C standard does not
require this to be safe, so let's handle this case specially.
Note that anything that is fixed by this change is still buggy, because the only
reason why XShmGetImage() could fail would be BadDrawable, meaning that the
target we draw to does not exist or was already destroyed. This patch will
likely just cause X11 errors elsewhere and drawing to (possible) invalid
drawables is not supported by cairo anyway. This means that if SHM fails, the
following fallback code has a high chance of failing, too.
Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=91967
Signed-off-by: Uli Schlachter <psychon@znc.in>
When an unbounded recording surface is used multiple times with
different extents for each operation we need the XObject containing
the recording surface to have the same origin for each operation. This
is not possible when the recording surface is converted to PDF
coordinates because each operation has different extents resulting in
a different origin when the Y-axis is flipped (since the flip matrix
depends on the recording surface height which for unbounded surfaces
depends on the extents of the operation that paints the recording
surface).
Switching to cairo coordinates by emitting a Y-axis flip matrix as the
first object of each page allows the recording surface to be emitted
in cairo coordinates. This results in the same origin for all
operations using the recording surface XObject.
Test case for bug 89232 - painting a recording surface to a
pdf/ps surface omits objects on the recording surface with negative
coordinates even though the pattern matrix has transformed the objects
to within the page extents.
The image surface also fails when the recording surface is bounded.
The surface_transform was already used surface_replay_with_clip, as the
matrix is obviously needed for the clip. But now, because of the
optimization done in commit 09b42c7, it's also needed by
replay_and_create_regions: get_target_extents clips the target surface
for performance issues, and therefore needs the surface_transform matrix
to get the right clipping surface.
Signed-off-by: Guillaume Ayoub <guillaume.ayoub@kozea.fr>
This adds _cairo_atomic_int_get_relaxed and _cairo_atomic_int_set_relaxed which
are meant to have a behaviour of relaxed read/writes in C11's memory model. This
patch also uses these new function to fix a data race with freed_pool_t's |top|
data member.
Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=90318
Signed-off-by: Wan-Teh Chang <wtc@google.com>
Signed-off-by: Uli Schlachter <psychon@znc.in>
We need to link against libdrm to use its functions.
Signed-off-by: Enrico Weigelt, metux IT consult <enrico.weigelt@gr13.net>
Reviewed-by: Bryce Harrington <bryce@osg.samsung.com>
