From e74fef3b55dc1b5daf40b3a6aea857582071560f Mon Sep 17 00:00:00 2001
From: Fabrice Di Meglio <fdimeglio@google.com>
Date: Sun, 18 Sep 2011 14:30:21 -0700
Subject: [PATCH] Fix potential leak in TextLayouCache

- need a copy constructor for the key as the GenerationCache we are using
is actually a KeyedVector<K, sp<Entry<K, V> > >
- use the getText() API to access the text in the cache key

Change-Id: I5b60ebc062b62308ed7ac1284cfe2a9f28e2b8b1
---
 core/jni/android/graphics/TextLayoutCache.cpp | 20 +++++++++++++++++--
 core/jni/android/graphics/TextLayoutCache.h   |  8 +++++++-
 2 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/core/jni/android/graphics/TextLayoutCache.cpp b/core/jni/android/graphics/TextLayoutCache.cpp
index d04e05977fb1e..de4b533f50bb9 100644
--- a/core/jni/android/graphics/TextLayoutCache.cpp
+++ b/core/jni/android/graphics/TextLayoutCache.cpp
@@ -242,6 +242,22 @@ TextLayoutCacheKey::TextLayoutCacheKey(const SkPaint* paint,
     hinting = paint->getHinting();
 }
 
+TextLayoutCacheKey::TextLayoutCacheKey(const TextLayoutCacheKey& other) :
+        text(NULL),
+        textCopy(other.textCopy),
+        contextCount(other.contextCount),
+        dirFlags(other.dirFlags),
+        typeface(other.typeface),
+        textSize(other.textSize),
+        textSkewX(other.textSkewX),
+        textScaleX(other.textScaleX),
+        flags(other.flags),
+        hinting(other.hinting) {
+    if (other.text) {
+        textCopy.setTo(other.text);
+    }
+}
+
 bool TextLayoutCacheKey::operator<(const TextLayoutCacheKey& rhs) const {
     LTE_INT(count) {
         LTE_INT(contextCount) {
@@ -253,7 +269,7 @@ bool TextLayoutCacheKey::operator<(const TextLayoutCacheKey& rhs) const {
                                 LTE_INT(flags) {
                                     LTE_INT(hinting) {
                                         LTE_INT(dirFlags) {
-                                            return strncmp16(text, rhs.text, contextCount) < 0;
+                                            return strncmp16(getText(), rhs.getText(), contextCount) < 0;
                                         }
                                     }
                                 }
@@ -269,7 +285,7 @@ bool TextLayoutCacheKey::operator<(const TextLayoutCacheKey& rhs) const {
 
 void TextLayoutCacheKey::internalTextCopy() {
     textCopy.setTo(text, contextCount);
-    text = textCopy.string();
+    text = NULL;
 }
 
 size_t TextLayoutCacheKey::getSize() {
diff --git a/core/jni/android/graphics/TextLayoutCache.h b/core/jni/android/graphics/TextLayoutCache.h
index 0d8d71fe7c26d..91439548dea9d 100644
--- a/core/jni/android/graphics/TextLayoutCache.h
+++ b/core/jni/android/graphics/TextLayoutCache.h
@@ -72,6 +72,8 @@ public:
             const UChar* text, size_t start, size_t count,
             size_t contextCount, int dirFlags);
 
+    TextLayoutCacheKey(const TextLayoutCacheKey& other);
+
     bool operator<(const TextLayoutCacheKey& rhs) const;
 
     /**
@@ -86,7 +88,7 @@ public:
     size_t getSize();
 
 private:
-    const UChar* text;
+    const UChar* text; // if text is NULL, use textCopy
     String16 textCopy;
     size_t start;
     size_t count;
@@ -98,6 +100,10 @@ private:
     SkScalar textScaleX;
     uint32_t flags;
     SkPaint::Hinting hinting;
+
+    inline const UChar* getText() const {
+        return text ? text : textCopy.string();
+    }
 }; // TextLayoutCacheKey
 
 /*