From 6bc4b3ae442f3643caae828e130423af3f995600 Mon Sep 17 00:00:00 2001
From: prr <unknown>
Date: Fri, 3 Feb 2012 09:57:45 -0800
Subject: [PATCH] 7141914: Draw glyph cause JVM crash Reviewed-by: bae, igor

---
 src/share/classes/sun/font/FileFont.java            | 4 +++-
 src/share/classes/sun/font/StandardGlyphVector.java | 5 +++--
 src/share/classes/sun/font/SunFontManager.java      | 3 +++
 src/share/classes/sun/font/TrueTypeFont.java        | 3 +++
 4 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/src/share/classes/sun/font/FileFont.java b/src/share/classes/sun/font/FileFont.java
index adce6d94e..9c72251df 100644
--- a/src/share/classes/sun/font/FileFont.java
+++ b/src/share/classes/sun/font/FileFont.java
@@ -163,7 +163,9 @@ public abstract class FileFont extends PhysicalFont {
                 }
             }
         }
-        scaler.dispose();
+        if (scaler != null) {
+            scaler.dispose();
+        }
         scaler = FontScaler.getNullScaler();
     }
 
diff --git a/src/share/classes/sun/font/StandardGlyphVector.java b/src/share/classes/sun/font/StandardGlyphVector.java
index c452dd97c..66001682d 100644
--- a/src/share/classes/sun/font/StandardGlyphVector.java
+++ b/src/share/classes/sun/font/StandardGlyphVector.java
@@ -1740,8 +1740,9 @@ public class StandardGlyphVector extends GlyphVector {
                                                      tx,
                                                      sgv.font.getStyle(),
                                                      aa, fm);
-
-            FontStrike strike = sgv.font2D.getStrike(desc);  // !!! getStrike(desc, false)
+            // Get the strike via the handle. Shouldn't matter
+            // if we've invalidated the font but its an extra precaution.
+            FontStrike strike = sgv.font2D.handle.font2D.getStrike(desc);  // !!! getStrike(desc, false)
 
             return new GlyphStrike(sgv, strike, dx, dy);
         }
diff --git a/src/share/classes/sun/font/SunFontManager.java b/src/share/classes/sun/font/SunFontManager.java
index bd55f8bbd..bb069a3a0 100644
--- a/src/share/classes/sun/font/SunFontManager.java
+++ b/src/share/classes/sun/font/SunFontManager.java
@@ -2619,6 +2619,9 @@ public abstract class SunFontManager implements FontSupport, FontManagerForSGE {
         physicalFonts.remove(oldFont.fullName);
         fullNameToFont.remove(oldFont.fullName.toLowerCase(Locale.ENGLISH));
         FontFamily.remove(oldFont);
+        if (oldFont instanceof FileFont) {
+            ((FileFont)oldFont).deregisterFontAndClearStrikeCache();
+        }
 
         if (localeFullNamesToFont != null) {
             Map.Entry[] mapEntries =
diff --git a/src/share/classes/sun/font/TrueTypeFont.java b/src/share/classes/sun/font/TrueTypeFont.java
index e60a74b7b..5a3180e15 100644
--- a/src/share/classes/sun/font/TrueTypeFont.java
+++ b/src/share/classes/sun/font/TrueTypeFont.java
@@ -1037,6 +1037,9 @@ public class TrueTypeFont extends FileFont {
             if (head_Table != null && head_Table.capacity() >= 18) {
                 ShortBuffer sb = head_Table.asShortBuffer();
                 upem = sb.get(9) & 0xffff;
+                if (upem < 16 || upem > 16384) {
+                    upem = 2048;
+                }
             }
 
             ByteBuffer os2_Table = getTableBuffer(os_2Tag);
-- 
GitLab