Discard reconfigured CTFont if URL changes

Fixes https://github.com/behdad/harfbuzz/issues/267

diff --git a/src/hb-coretext.cc b/src/hb-coretext.cc
index e64d265..98592af 100644 (file)
--- a/src/hb-coretext.cc
+++ b/src/hb-coretext.cc
@@ -145,6 +145,7 @@ create_ct_font (CGFontRef cg_font, CGFloat font_size)
     DEBUG_MSG (CORETEXT, cg_font, "Font CTFontCreateWithGraphicsFont() failed");
     return NULL;
   }
+  CFURLRef original_url = (CFURLRef)CTFontCopyAttribute(ct_font, kCTFontURLAttribute);
 
   /* Create font copy with cascade list that has LastResort first; this speeds up CoreText
    * font fallback which we don't need anyway. */
@@ -154,14 +155,31 @@ create_ct_font (CGFontRef cg_font, CGFloat font_size)
     CFRelease (last_resort_font_desc);
     if (new_ct_font)
     {
-      CFRelease (ct_font);
-      ct_font = new_ct_font;
+      // The CTFontCreateCopyWithAttributes call fails to stay on the same font
+      // when reconfiguring the cascade list and may switch to a different font
+      // when there are fonts that go by the same name, since the descriptor is
+      // just name and size.
+
+      // Avoid reconfiguring the cascade lists if the new font is outside the
+      // system locations that we cannot access from the sandboxed renderer
+      // process in Blink. This can be detected by the new file URL location
+      // that the newly found font points to.
+      CFURLRef new_url = (CFURLRef)CTFontCopyAttribute(new_ct_font, kCTFontURLAttribute);
+      if (CFEqual(original_url, new_url)) {
+        CFRelease (ct_font);
+        ct_font = new_ct_font;
+      } else {
+        CFRelease(new_ct_font);
+        DEBUG_MSG (CORETEXT, ct_font, "Discarding reconfigured CTFont, location changed.");
+      }
+      CFRelease(new_url);
     }
     else
       DEBUG_MSG (CORETEXT, ct_font, "Font copy with empty cascade list failed");
   }
 
- return ct_font;
+  CFRelease(original_url);
+  return ct_font;
 }
 
 struct hb_coretext_shaper_face_data_t {