Fix infinite recursion crash in HarfBuzz' CoreText backend

third_party/harfbuzz-ng/src/hb-coretext.cc

 /*
  * Copyright © 2012,2013  Mozilla Foundation.
  * Copyright © 2012,2013  Google, Inc.
  *
  *  This is part of HarfBuzz, a text shaping library.
  *
  * Permission is hereby granted, without written agreement and without
  * license or royalty fees, to use, copy, modify, and distribute this
  * software and its documentation for any purpose, provided that the
  * above copyright notice and the following two paragraphs appear in
@@ skipping 127 matching lines @@
 }
 
 static CTFontRef
 create_ct_font (CGFontRef cg_font, CGFloat font_size)
 {
   CTFontRef ct_font = CTFontCreateWithGraphicsFont (cg_font, font_size, NULL, NULL);
   if (unlikely (!ct_font)) {
     DEBUG_MSG (CORETEXT, cg_font, "Font CTFontCreateWithGraphicsFont() failed");
     return NULL;
   }
+
+  /* crbug.com/576941 and crbug.com/625902 and the investigation in the latter
+   * bug indicate that the cascade list reconfiguration occasionally causes
+   * crashes in CoreText on OS X 10.9, thus let's skip this step on older
+   * operating system versions. */
+  if (&CTGetCoreTextVersion != NULL && CTGetCoreTextVersion() <= kCTVersionNumber10_9)

[Robert Sesek, 2016/07/22 15:56:11]

This still crashes for me, so I added some logging:

printf("CTGetCoreTextVersion = %p ==> %d <= %d\n", &CTGetCoreTextVersion,
CTGetCoreTextVersion(), kCTVersionNumber10_9);

That prints:
CTGetCoreTextVersion = 0x7fff8d6258b8 ==> 393217 <= 393216

hex(393217) = '0x60001'
hex(393216) = '0x60000'

I don't know where/if 0x60001 is defined--definitely not in CoreText.h.

+    return ct_font;
+
   CFURLRef original_url = (CFURLRef)CTFontCopyAttribute(ct_font, kCTFontURLAttribute);
 
   /* Create font copy with cascade list that has LastResort first; this speeds up CoreText
    * font fallback which we don't need anyway. */
   {
     CTFontDescriptorRef last_resort_font_desc = get_last_resort_font_desc ();
     CTFontRef new_ct_font = CTFontCreateCopyWithAttributes (ct_font, 0.0, NULL, last_resort_font_desc);
     CFRelease (last_resort_font_desc);
     if (new_ct_font)
     {
@@ skipping 1123 matching lines @@
 
 hb_bool_t
 _hb_coretext_aat_shape (hb_shape_plan_t    *shape_plan,
                         hb_font_t          *font,
                         hb_buffer_t        *buffer,
                         const hb_feature_t *features,
                         unsigned int        num_features)
 {
   return _hb_coretext_shape (shape_plan, font, buffer, features, num_features);
 }