7141914: Draw glyph cause JVM crash

Reviewed-by: bae, igor

src/share/classes/sun/font/FileFont.java

@@ -163,7 +163,9 @@ public abstract class FileFont extends PhysicalFont {
                 }
             }
         }
-        scaler.dispose();
+        if (scaler != null) {
+            scaler.dispose();
+        }
         scaler = FontScaler.getNullScaler();
     }
 

src/share/classes/sun/font/StandardGlyphVector.java

@@ -1740,8 +1740,9 @@ public class StandardGlyphVector extends GlyphVector {
                                                      tx,
                                                      sgv.font.getStyle(),
                                                      aa, fm);
-
-            FontStrike strike = sgv.font2D.getStrike(desc);  // !!! getStrike(desc, false)
+            // Get the strike via the handle. Shouldn't matter
+            // if we've invalidated the font but its an extra precaution.
+            FontStrike strike = sgv.font2D.handle.font2D.getStrike(desc);  // !!! getStrike(desc, false)
 
             return new GlyphStrike(sgv, strike, dx, dy);
         }

src/share/classes/sun/font/SunFontManager.java

@@ -2619,6 +2619,9 @@ public abstract class SunFontManager implements FontSupport, FontManagerForSGE {
         physicalFonts.remove(oldFont.fullName);
         fullNameToFont.remove(oldFont.fullName.toLowerCase(Locale.ENGLISH));
         FontFamily.remove(oldFont);
+        if (oldFont instanceof FileFont) {
+            ((FileFont)oldFont).deregisterFontAndClearStrikeCache();
+        }
 
         if (localeFullNamesToFont != null) {
             Map.Entry[] mapEntries =

src/share/classes/sun/font/TrueTypeFont.java

@@ -1037,6 +1037,9 @@ public class TrueTypeFont extends FileFont {
             if (head_Table != null && head_Table.capacity() >= 18) {
                 ShortBuffer sb = head_Table.asShortBuffer();
                 upem = sb.get(9) & 0xffff;
+                if (upem < 16 || upem > 16384) {
+                    upem = 2048;
+                }
             }
 
             ByteBuffer os2_Table = getTableBuffer(os_2Tag);