Fix crasher during multi-thread shaper data creation

Sample crash:

0  _hb_graphite2_shaper_face_data_destroy (data=0xffffffffffffffff)
    at ../../src/hb-graphite2.cc:129
1  0x00007ffff4271d7d in hb_graphite2_shaper_face_data_ensure (
    face=<optimized out>) at ../../src/hb-shaper-list.hh:35
2  hb_shape_plan_plan (shaper_list=<optimized out>, num_user_features=0,
    user_features=0x0, shape_plan=0xf7b490) at ../../src/hb-shaper-list.hh:35
3  hb_shape_plan_create (face=<optimized out>, props=<optimized out>,
    user_features=0x0, num_user_features=0, shaper_list=<optimized out>)
    at ../../src/hb-shape-plan.cc:108
4  0x00007ffff4272c93 in hb_shape_plan_create_cached (face=0x10cf2b0,
    props=0x11980d8, user_features=0x0, num_user_features=<optimized out>,
    shaper_list=0x0) at ../../src/hb-shape-plan.cc:283

diff --git a/src/hb-shaper-private.hh b/src/hb-shaper-private.hh
index 9d30c1e..29c4493 100644 (file)
--- a/src/hb-shaper-private.hh
+++ b/src/hb-shaper-private.hh
@@ -95,7 +95,10 @@ hb_##shaper##_shaper_##object##_data_ensure (hb_##object##_t *object) \
     if (unlikely (!data)) \
       data = (HB_SHAPER_DATA_TYPE (shaper, object) *) HB_SHAPER_DATA_INVALID; \
     if (!hb_atomic_ptr_cmpexch (&HB_SHAPER_DATA (shaper, object), NULL, data)) { \
-      HB_SHAPER_DATA_DESTROY_FUNC (shaper, object) (data); \
+      if (data && \
+         data != HB_SHAPER_DATA_INVALID && \
+         data != HB_SHAPER_DATA_SUCCEEDED) \
+       HB_SHAPER_DATA_DESTROY_FUNC (shaper, object) (data); \
       goto retry; \
     } \
   } \