Re: [ft-devel] avoiding a longjmp crash in ftgrays.c

[Tom Bishop, Wenlin Institute]

On Jan 1, 2011, at 11:31 PM, Werner LEMBERG wrote:

...
> Which font is it?  Maybe I already have it.  Otherwise, please send me
> the font privately for further investigation.

I've reproduced the crash with a different font: mssong.ttf, glyph number 1006. 
This font is available for free from Microsoft.

>> The difference between -fomit-frame-pointer and
>> -fno-omit-frame-pointer seems to be important, but maybe not.  With
>> GCC 4.5, it is currently making the difference between crashing or
>> not.
> 
> Can you try a different compiler like MSVC?

I don't have MSVC; maybe I'll try it eventually. In the meantime I won't use 
-fomit-frame-pointer with GCC.

A web search for "-fomit-frame-pointer MinGW longjmp" turns up a number of 
reports that the combination is error-prone.

There is still a chance the bug is in FreeType. I wrote a short test program 
that combines MinGW, -fomit-frame-pointer, setjmp and longjmp, without FreeType 
(or anything font-related), and it didn't crash.

Here is the program that crashes with mssong.ttf, glyph number 1006:

#include <stdio.h>
#include <string.h>
#include <ft2build.h>
#include FT_FREETYPE_H

static char *DebugFreeType(char *fontname, int glyphnumber)
{
        FT_Library ttEngine;
        if (FT_Init_FreeType(&ttEngine) != 0) {
                return "FT_Init_FreeType error";
        }
        FT_Face face;
        if (FT_New_Face(ttEngine, fontname, 0, &face) != 0) {
                return "FT_New_Face error";
        }
        FT_Set_Pixel_Sizes(face, 0, 162);
        FT_Load_Glyph(face, glyphnumber, FT_LOAD_RENDER | FT_LOAD_NO_BITMAP);
        return "OK";
} // DebugFreeType

int main(int argc, char **argv)
{
        if (argc < 3) {
                printf("Usage: freetype_debug_gray fontname glyphnumber\n");
                return 0;
        }
        char *fontname = argv[1];
        int glyphnumber = atoi(argv[2]);
        char *s = DebugFreeType(fontname, glyphnumber);
        printf("%s\n", s);
        if (strcmp(s, "OK") != 0) {
                return -1;
        }
        return 0;
} // main

-----------------------

Here's the makefile:

CC = mingw32-gcc
CXX = mingw32-g++

vpath %.c ../c \
        ../freetype/src/autohint ../freetype/src/bdf ../freetype/src/cff 
../freetype/src/cache ../freetype/src/gzip \
        ../freetype/src/base ../freetype/src/pcf ../freetype/src/pfr 
../freetype/src/psaux ../freetype/src/pshinter \
        ../freetype/src/psnames ../freetype/src/raster ../freetype/src/sfnt 
../freetype/src/smooth ../freetype/src/truetype \
        ../freetype/src/type1 ../freetype/src/cid ../freetype/src/type42 
../freetype/src/winfonts ../freetype/src/lzw \
        ../freetype/src/autofit

INCLUDE =-I../freetype/include -I../freetype/include/freetype

OPT_FLAGS = -Os -ggdb -fomit-frame-pointer
# OPT_FLAGS = -Os -ggdb -fno-omit-frame-pointer

CFLAGS = $(OPT_FLAGS) -mwindows -DUNICODE=1 -Wall $(INCLUDE) 
-DFT_DEBUG_LEVEL_TRACE -DFT_DEBUG_MEMORY -DFT_AVOID_LONGJMP=0

# to set environment variable FT2_DEBUG:
# set FT2_DEBUG=any:5

OBJS = \
        freetype_debug_gray.o \
        bdf.o cff.o ftbase.o ftcache.o ftglyph.o ftgzip.o ftinit.o \
        ftsystem.o pcf.o pfr.o psaux.o pshinter.o psnames.o raster.o \
        sfnt.o smooth.o truetype.o type1.o type1cid.o type42.o winfnt.o 
fttype1.o \
        ftbitmap.o ftlzw.o autofit.o \
        ftdebug.o

freetype_debug_gray.exe: $(OBJS) $(RESOURCES)
        $(CC) -static $(CFLAGS) $(OBJS) $(RESOURCES) -o $@

# Automatically generate dependencies, save them in .d files
%.d: %.c
        $(CC) -MM $(CFLAGS) $< > $@
depends = $(OBJS:.o=.d)
include $(depends)

clean:
        del *.o *.d *.exe

--------------------

I built it and ran it as follows:

freetype_debug_gray mssong.ttf 1006 > test_mssong.txt 2>&1

The output is shown below. The stuff at the end about "# of contours: -1" and 
"Glyph 22971" is mysterious.

Best wishes,

Tom

Init_Context: new object at 0x003D77B8
FT_Stream_Open: opened `mssong.ttf' (2569116 bytes) successfully
sfnt_open_font: synthesize TTC
sfnt_init_face: 003D9350, 0
tt_face_load_font_dir: 003D9350
-- Number of tables:         16
-- Format version:   0x00010000

  tag    offset    length   checksum
  ----------------------------------
  EBDT  001e0368  0008807b  b079e788
  EBLC  002683e4  0000afb8  3044215a
  OS/2  0000010c  00000056  59eb64de
  cmap  00000164  000005aa  37177270
  cvt   00000710  000002be  072903f0
  fpgm  000009d0  0000000d  4aa192e8
  gasp  000009e0  00000010  001f0009
  glyf  000009f0  001b8b72  32695904
  head  001b9564  00000036  12c21a71
  hhea  001b959c  00000024  02010141
  hmtx  001b95c0  0000ce46  b4da7bd8
  loca  001c6408  00019b04  e88fad52
  maxp  001dff0c  00000020  689c0487
  name  001dff2c  00000365  18395d95
  post  001e0294  00000020  ffed000d
  prep  001e02b4  000000b2  05dc4fcc
table directory loaded

sfnt_load_face: 003D9350

tt_face_lookup_table: 003D9350, `glyf' -- found table.
`head' -->
tt_face_lookup_table: 003D9350, `head' -- found table.
Units per EM:  256
IndexToLoc:      1
loaded

`maxp' -->
tt_face_lookup_table: 003D9350, `maxp' -- found table.
numGlyphs: 26304
loaded

`cmap' -->
tt_face_lookup_table: 003D9350, `cmap' -- found table.
loaded

`name' -->
tt_face_lookup_table: 003D9350, `name' -- found table.
loaded

`post' -->
tt_face_lookup_table: 003D9350, `post' -- found table.
FormatType:   0x30000
isFixedPitch:     yes
loaded

`hhea' -->
tt_face_lookup_table: 003D9350, `hhea' -- found table.
Ascender:            220
Descender:           -35
number_Of_Metrics:    99
loaded

`hmtx' -->
tt_face_lookup_table: 003D9350, `hmtx' -- found table.
loaded

`vertical hhea' -->
tt_face_lookup_table: 003D9350, `vhea' -- could not find table
missing

`os2' -->
tt_face_lookup_table: 003D9350, `OS/2' -- found table.
sTypoAscender:   220
sTypoDescender:  -36
usWinAscent:     220
usWinDescent:     35
fsSelection:    0x40
loaded

`eblc' -->
tt_face_lookup_table: 003D9350, `EBLC' -- found table.
loaded

`pclt' -->
tt_face_lookup_table: 003D9350, `PCLT' -- could not find table
missing

`gasp' -->
tt_face_lookup_table: 003D9350, `gasp' -- found table.
numRanges: 3
gaspRange 0: rangeMaxPPEM     8, rangeGaspBehavior 0x2
gaspRange 1: rangeMaxPPEM    24, rangeGaspBehavior 0x1
gaspRange 2: rangeMaxPPEM 65535, rangeGaspBehavior 0x3
loaded

`kern' -->
tt_face_lookup_table: 003D9350, `kern' -- could not find table
missing

tt_face_lookup_table: 003D9350, `glyf' -- found table.
tt_face_lookup_table: 003D9350, `fvar' -- could not find table
sfnt_load_face: done
tt_face_lookup_table: 003D9350, `hdmx' -- could not find table
tt_face_lookup_table: 003D9350, `glyf' -- found table.
Locations tt_face_lookup_table: 003D9350, `loca' -- found table.
glyph count mismatch!  loca: 26305, maxp: 26304
loaded
CVT tt_face_lookup_table: 003D9350, `cvt ' -- found table.
loaded
Font program tt_face_lookup_table: 003D9350, `fpgm' -- found table.
loaded,           13 bytes
Prep program tt_face_lookup_table: 003D9350, `prep' -- found table.
loaded,          178 bytes
FT_Open_Face: New face object, adding to list
FT_Open_Face: Creating glyph slot
FT_New_GlyphSlot: Creating new slot object
FT_New_GlyphSlot: Return 0
FT_Open_Face: Creating size object
FT_Open_Face: Return 0
Executing `fpgm' table.
Executing `prep' table.
tt_loader_init: grayscale change, re-executing `prep' table
Executing `prep' table.
tt_face_lookup_table: 003D9350, `glyf' -- found table.
  advance width (font units): 256
  left side bearing (font units): 11
  advance height (font units): 256
  top side bearing (font units): 0
Glyph 1006
  # of contours: -1
  xMin:   11  xMax:  241
  yMin:  -21  yMax:  194
  advance width (font units): 256
  left side bearing (font units): 4
  advance height (font units): 256
  top side bearing (font units): 0
Glyph 22971
  # of contours: 1
  xMin:    4  xMax:  234
  yMin:    0  yMax:  215
  Instructions size: 0
  x advance: 10368
  y advance: 0
  linear x advance: 10616832
  linear y advance: 10616832
FT_Outline_Decompose: Out

文林 Wenlin Institute, Inc.        Software for Learning Chinese
E-mail: address@hidden     Web: http://www.wenlin.com
Telephone: 1-877-4-WENLIN (1-877-493-6546)
☯