Cherry pick CoreText Helvetica collision fix into HarfBuzz

third_party/harfbuzz-ng/src/hb-coretext.cc

 /*
  * Copyright © 2012,2013  Mozilla Foundation.
  * Copyright © 2012,2013  Google, Inc.
  *
  *  This is part of HarfBuzz, a text shaping library.
  *
  * Permission is hereby granted, without written agreement and without
  * license or royalty fees, to use, copy, modify, and distribute this
  * software and its documentation for any purpose, provided that the
  * above copyright notice and the following two paragraphs appear in
@@ skipping 127 matching lines @@
 }
 
 static CTFontRef
 create_ct_font (CGFontRef cg_font, CGFloat font_size)
 {
   CTFontRef ct_font = CTFontCreateWithGraphicsFont (cg_font, font_size, NULL, NULL);
   if (unlikely (!ct_font)) {
     DEBUG_MSG (CORETEXT, cg_font, "Font CTFontCreateWithGraphicsFont() failed");
     return NULL;
   }
+  CFURLRef original_url = (CFURLRef)CTFontCopyAttribute(ct_font, kCTFontURLAttribute);
 
   /* Create font copy with cascade list that has LastResort first; this speeds up CoreText
    * font fallback which we don't need anyway. */
   {
     CTFontDescriptorRef last_resort_font_desc = get_last_resort_font_desc ();
     CTFontRef new_ct_font = CTFontCreateCopyWithAttributes (ct_font, 0.0, NULL, last_resort_font_desc);
     CFRelease (last_resort_font_desc);
     if (new_ct_font)
     {
-      CFRelease (ct_font);
-      ct_font = new_ct_font;
+      // The CTFontCreateCopyWithAttributes call fails to stay on the same font
+      // when reconfiguring the cascade list and may switch to a different font
+      // when there are fonts that go by the same name, since the descriptor is
+      // just name and size.
+
+      // Avoid reconfiguring the cascade lists if the new font is outside the
+      // system locations that we cannot access from the sandboxed renderer
+      // process in Blink. This can be detected by the new file URL location
+      // that the newly found font points to.
+      CFURLRef new_url = (CFURLRef)CTFontCopyAttribute(new_ct_font, kCTFontURLAttribute);
+      if (CFEqual(original_url, new_url)) {
+        CFRelease (ct_font);
+        ct_font = new_ct_font;
+      } else {
+        CFRelease(new_ct_font);
+        DEBUG_MSG (CORETEXT, ct_font, "Discarding reconfigured CTFont, location changed.");
+      }
+      CFRelease(new_url);
     }
     else
       DEBUG_MSG (CORETEXT, ct_font, "Font copy with empty cascade list failed");
   }
 
- return ct_font;
+  CFRelease(original_url);
+  return ct_font;
 }
 
 struct hb_coretext_shaper_face_data_t {
   CGFontRef cg_font;
   CTFontRef ct_font;
 };
 
 hb_coretext_shaper_face_data_t *
 _hb_coretext_shaper_face_data_create (hb_face_t *face)
 {
@@ skipping 1084 matching lines @@
 
 hb_bool_t
 _hb_coretext_aat_shape (hb_shape_plan_t    *shape_plan,
                         hb_font_t          *font,
                         hb_buffer_t        *buffer,
                         const hb_feature_t *features,
                         unsigned int        num_features)
 {
   return _hb_coretext_shape (shape_plan, font, buffer, features, num_features);
 }