Bug 380451. Store hashcode in textrun to avoid accessing deleted text. r=vlad

gfx/thebes/public/gfxFont.h

@@ -789,6 +789,8 @@ public:
     { return (mFlags & gfxTextRunFactory::TEXT_IS_8BIT) ? mText.mSingle : nsnull; }
     const PRUnichar *GetTextUnicode() const
     { return (mFlags & gfxTextRunFactory::TEXT_IS_8BIT) ? nsnull : mText.mDouble; }
+    PRUint32 GetHashCode() const { return mHashCode; }
+    void SetHashCode(PRUint32 aHash) { mHashCode = aHash; }
 
     // The caller is responsible for initializing our glyphs after construction.
     // Initially all glyphs are such that GetCharacterGlyphs()[i].IsMissing() is true.
@@ -1100,6 +1102,7 @@ private:
     PRUint32          mAppUnitsPerDevUnit;
     PRUint32          mFlags;
     PRUint32          mCharacterCount;
+    PRUint32          mHashCode;
 };
 
 class THEBES_API gfxFontGroup : public gfxTextRunFactory {

gfx/thebes/src/gfxFont.cpp

@@ -619,7 +619,7 @@ gfxTextRun::gfxTextRun(const gfxTextRunFactory::Parameters *aParams, const void
   : mUserData(aParams->mUserData),
     mFontGroup(aFontGroup),
     mAppUnitsPerDevUnit(aParams->mAppUnitsPerDevUnit),
-    mFlags(aFlags), mCharacterCount(aLength)
+    mFlags(aFlags), mCharacterCount(aLength), mHashCode(0)
 {
     NS_ADDREF(mFontGroup);
     if (aParams->mSkipChars) {

gfx/thebes/src/gfxTextRunCache.cpp

@@ -165,6 +165,7 @@ gfxTextRunCache::GetOrMakeTextRun(const PRUnichar *aText, PRUint32 aLength,
         gfxTextRun *newRun =
             textRun->Clone(aParams, aText, aLength, aFontGroup, aFlags);
         if (newRun) {
+            newRun->SetHashCode(hashCode);
             entry->mTextRun = newRun;
             NotifyRemovedFromCache(textRun);
             text.forget();
@@ -178,6 +179,7 @@ gfxTextRunCache::GetOrMakeTextRun(const PRUnichar *aText, PRUint32 aLength,
     gfxTextRun *newRun =
         aFontGroup->MakeTextRun(aText, aLength, aParams, aFlags);
     if (newRun) {
+        newRun->SetHashCode(hashCode);
         key.mFontOrGroup = GetCacheKeyFontOrGroup(newRun);
         entry = mCache.PutEntry(key);
         if (entry) {
@@ -232,6 +234,7 @@ gfxTextRunCache::GetOrMakeTextRun(const PRUint8 *aText, PRUint32 aLength,
             textRun->Clone(aParams, aText, aLength,
                            aFontGroup, aFlags);
         if (newRun) {
+            newRun->SetHashCode(hashCode);
             entry->mTextRun = newRun;
             NotifyRemovedFromCache(textRun);
             text.forget();
@@ -245,6 +248,7 @@ gfxTextRunCache::GetOrMakeTextRun(const PRUint8 *aText, PRUint32 aLength,
     gfxTextRun *newRun =
         aFontGroup->MakeTextRun(aText, aLength, aParams, aFlags);
     if (newRun) {
+        newRun->SetHashCode(hashCode);
         key.mFontOrGroup = GetCacheKeyFontOrGroup(newRun);
         entry = mCache.PutEntry(key);
         if (entry) {
@@ -260,21 +264,16 @@ gfxTextRunCache::GetOrMakeTextRun(const PRUint8 *aText, PRUint32 aLength,
 gfxTextRunCache::CacheHashKey
 gfxTextRunCache::GetKeyForTextRun(gfxTextRun *aTextRun)
 {
-    PRUint32 hashCode;
     const void *text;
     PRUint32 length = aTextRun->GetLength();
     if (aTextRun->GetFlags() & gfxFontGroup::TEXT_IS_8BIT) {
-        PRUint32 flags;
         text = aTextRun->GetText8Bit();
-        hashCode = HashString(aTextRun->GetText8Bit(), length, &flags);
     } else {
-        PRUint32 flags;
         text = aTextRun->GetTextUnicode();
-        hashCode = HashString(aTextRun->GetTextUnicode(), length, &flags);
     }
     void *fontOrGroup = GetCacheKeyFontOrGroup(aTextRun);
     return CacheHashKey(fontOrGroup, text, length, aTextRun->GetAppUnitsPerDevUnit(),
-                        aTextRun->GetFlags(), hashCode);
+                        aTextRun->GetFlags(), aTextRun->GetHashCode());
 }
 
 void