bug 618592 - fix harfbuzz hang on lookup with empty rule. r=behdad a=blocking-beta8 for landing on a CLOSED TREE
authorJonathan Kew <jfkthame@gmail.com>
Mon, 13 Dec 2010 18:46:07 -0800
changeset 59180 66036625795f9052b761d9f7f2b1ce1fe69c521b
parent 59179 43a54dd56ccd5ef4dad36a69f8f8b7e6465edd46
child 59181 20c11e13d9293046802523429c94f5a9c7fd2fdc
push id17565
push userjkew@mozilla.com
push dateTue, 14 Dec 2010 02:48:18 +0000
treeherdermozilla-central@66036625795f [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbehdad, blocking-beta8
bugs618592
milestone2.0b8pre
first release with
nightly linux32
66036625795f / 4.0b8pre / 20101214030322 / files
nightly linux64
66036625795f / 4.0b8pre / 20101214030322 / files
nightly mac
66036625795f / 4.0b8pre / 20101214030322 / files
nightly win32
66036625795f / 4.0b8pre / 20101214030322 / files
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
releases
nightly linux32
nightly linux64
nightly mac
nightly win32
bug 618592 - fix harfbuzz hang on lookup with empty rule. r=behdad a=blocking-beta8 for landing on a CLOSED TREE
gfx/harfbuzz/src/hb-ot-layout-gsubgpos-private.hh
--- a/gfx/harfbuzz/src/hb-ot-layout-gsubgpos-private.hh
+++ b/gfx/harfbuzz/src/hb-ot-layout-gsubgpos-private.hh
@@ -225,17 +225,17 @@ HB_BEGIN_DECLS
 
 static inline bool apply_lookup (hb_apply_context_t *c,
 				 unsigned int count, /* Including the first glyph */
 				 unsigned int lookupCount,
 				 const LookupRecord lookupRecord[], /* Array of LookupRecords--in design order */
 				 apply_lookup_func_t apply_func)
 {
   unsigned int end = MIN (c->buffer->len, c->buffer->i + c->context_length);
-  if (unlikely (c->buffer->i + count > end))
+  if (unlikely (count == 0 || c->buffer->i + count > end))
     return false;
 
   /* TODO We don't support lookupRecord arrays that are not increasing:
    *      Should be easy for in_place ones at least. */
 
   /* Note: If sublookup is reverse, i will underflow after the first loop
    * and we jump out of it.  Not entirely disastrous.  So we don't check
    * for reverse lookup here.