Still getting AV with 5.1.9, attached is a demo

Bill E

I am getting an AV when embedding fonts. I am using the new realease 5.1.9 for XE7.

Attached is a demo.

Please fix quickly. I have a project that I would like to utilize the Threading Library in XE7 but I have not been able to upgrade my project to XE7 because of this bug. I do not want to wait another whole month for an update. Please fix quicker if possible.

Bill E

Just tried 5.1.10 and still has the error.

Bill E

rhodesv wrote: »

Has anyone found anything here as a work around yet?

They just released (11/27) 5.1.11 but it still has the bug. From talking with support it seems to occur in XE7 but works in XE6. I have not verified that.

I purchased the source a couple days ago in order to try and fix this problem. Wish me luck. If it does work in XE6 then I can run 2 virtual machines (one XE6 and the other XE7) and step through code side by side (2 monitors) to see where the point of failure is. If it is a XE7 bug then I will try to find a workaround.

Bill E

rhodesv wrote: »

Has anyone found anything here as a work around yet?

Today is thanksgiving and I need to stop working, but I do see something suspicious and a possible fix:

Below is the code that is blowing up with an AV

function CmapTableClass.LoadSignedCmapSegment(segment_ptr: Pointer; segment_count: Integer ): TSmallintArray;
var
  i: Integer;
  p : TWordArray;
begin
    SetLength(Result, segment_count);
    p := segment_ptr;
    i := 0;
    while ((i < segment_count)) do
    begin
        Result[i] := TTF_Helpers.SwapInt16(p[i]);
        inc(i)
    end;
end;

Here is another peice of code that works I think:

function CmapTableClass.LoadCmapSegment(segment_ptr: Pointer; segment_count: Integer): TWordArray;
var
  i: Integer;
  ptr: ^Word;
begin
    ptr := segment_ptr;
    SetLength(Result, segment_count);
    i := 0;
    while ((i < segment_count)) do
    begin
        Result[i] := TTF_Helpers.SwapUInt16(ptr^);
        Inc(i);
        Inc(ptr);
    end;
end;

See the difference, they are using a dynamic array in one (TWordArray) and then regular old style ^Word in the other. I am suspicious of the pointer assignment to the dynamic array because the compiler does reference counting to them. I have to leave for the day but I wonder if getting rid of the dynamic array cast and using old style pointers with Inc would fix the problem.

Bill E

I fixed it in my source, if you have the source change the source in unit frxCmapTableClass line 193 to the below:

The solution was to get rid of casting a pointer to a dynamic array.

    function CmapTableClass.LoadSignedCmapSegment(segment_ptr: Pointer; segment_count: Integer ): TSmallintArray;
    var
      i: Integer;
      WordPtr : ^Word;
    begin
        SetLength(Result, segment_count);
        WordPtr := segment_ptr;
        i := 0;
        while ((i < segment_count)) do
        begin
            Result[i] := TTF_Helpers.SwapInt16(WordPtr^);
            inc(i);
            Inc(WordPtr);
        end;
    end;

Udo Treichel

Thank you, Bill E,

your fix saved my a.. today. I hope FR will use it or something similiar in their stable realease and publish it for XE 7 asap...

Bill E

I see there is a new 5.1.12 version. Does this version have this fix in it?