| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "content/common/mac/font_loader.h" | 5 #include "content/common/mac/font_loader.h" |
| 6 | 6 |
| 7 #import <Cocoa/Cocoa.h> | 7 #import <Cocoa/Cocoa.h> |
| 8 | 8 |
| 9 #include <limits> | 9 #include <limits> |
| 10 | 10 |
| 11 #include "base/files/file_path.h" | 11 #include "base/files/file_path.h" |
| 12 #include "base/files/file_util.h" | 12 #include "base/files/file_util.h" |
| 13 #include "base/logging.h" | 13 #include "base/logging.h" |
| 14 #include "base/mac/foundation_util.h" | 14 #include "base/mac/foundation_util.h" |
| 15 #include "base/mac/scoped_cftyperef.h" | 15 #include "base/mac/scoped_cftyperef.h" |
| 16 #include "base/mac/scoped_nsobject.h" | 16 #include "base/mac/scoped_nsobject.h" |
| 17 #include "base/strings/sys_string_conversions.h" | 17 #include "base/strings/sys_string_conversions.h" |
| 18 #include "base/threading/thread_restrictions.h" | 18 #include "base/threading/thread_restrictions.h" |
| 19 #include "content/common/mac/font_descriptor.h" | 19 #include "content/common/mac/font_descriptor.h" |
| 20 | 20 |
| 21 #include <map> | 21 #include <map> |
| 22 | 22 |
| 23 extern "C" { | |
| 24 | |
| 25 // Work around http://crbug.com/93191, a really nasty memory smasher bug. | |
| 26 // On Mac OS X 10.7 ("Lion"), ATS writes to memory it doesn't own. | |
| 27 // SendDeactivateFontsInContainerMessage, called by ATSFontDeactivate, | |
| 28 // may trash memory whenever dlsym(RTLD_DEFAULT, | |
| 29 // "_CTFontManagerUnregisterFontForData") returns NULL. In that case, it tries | |
| 30 // to locate that symbol in the CoreText framework, doing some extremely | |
| 31 // sloppy string handling resulting in a likelihood that the string | |
| 32 // "Text.framework/Versions/A/CoreText" will be written over memory that it | |
| 33 // doesn't own. The kicker here is that Apple dlsym always inserts its own | |
| 34 // leading underscore, so ATS actually winds up looking up a | |
| 35 // __CTFontManagerUnregisterFontForData symbol, which doesn't even exist in | |
| 36 // CoreText. It's only got the single-underscore variant corresponding to an | |
| 37 // underscoreless extern "C" name. | |
| 38 // | |
| 39 // Providing a single-underscored extern "C" function by this name results in | |
| 40 // a __CTFontManagerUnregisterFontForData symbol that, as long as it's public | |
| 41 // (not private extern) and unstripped, ATS will find. If it finds it, it | |
| 42 // avoids making amateur string mistakes that ruin everyone else's good time. | |
| 43 // | |
| 44 // Since ATS wouldn't normally be able to call this function anyway, it's just | |
| 45 // left as a no-op here. | |
| 46 // | |
| 47 // This file seems as good as any other to place this function. It was chosen | |
| 48 // because it already interfaces with ATS for other reasons. | |
| 49 // | |
| 50 // SendDeactivateFontsInContainerMessage on 10.6 ("Snow Leopard") appears to | |
| 51 // share this bug but this sort of memory corruption wasn't detected until | |
| 52 // 10.7. The implementation in 10.5 ("Leopard") does not have this problem. | |
| 53 __attribute__((visibility("default"))) | |
| 54 void _CTFontManagerUnregisterFontForData(NSUInteger, int) { | |
| 55 } | |
| 56 | |
| 57 } // extern "C" | |
| 58 | |
| 59 namespace { | 23 namespace { |
| 60 | 24 |
| 61 uint32_t GetFontIDForFont(const base::FilePath& font_path) { | 25 uint32_t GetFontIDForFont(const base::FilePath& font_path) { |
| 62 // content/common can't depend on content/browser, so this cannot call | 26 // content/common can't depend on content/browser, so this cannot call |
| 63 // BrowserThread::CurrentlyOn(). Check this is always called on the same | 27 // BrowserThread::CurrentlyOn(). Check this is always called on the same |
| 64 // thread. | 28 // thread. |
| 65 static pthread_t thread_id = pthread_self(); | 29 static pthread_t thread_id = pthread_self(); |
| 66 DCHECK_EQ(pthread_self(), thread_id); | 30 DCHECK_EQ(pthread_self(), thread_id); |
| 67 | 31 |
| 68 // Font loading used to call ATSFontGetContainer() | 32 // Font loading used to call ATSFontGetContainer() |
| (...skipping 103 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 172 if (!provider) | 136 if (!provider) |
| 173 return false; | 137 return false; |
| 174 | 138 |
| 175 *out = CGFontCreateWithDataProvider(provider.get()); | 139 *out = CGFontCreateWithDataProvider(provider.get()); |
| 176 | 140 |
| 177 if (*out == NULL) | 141 if (*out == NULL) |
| 178 return false; | 142 return false; |
| 179 | 143 |
| 180 return true; | 144 return true; |
| 181 } | 145 } |
| OLD | NEW |