[Devel] off-by-one-digit bug in ttinterp.c?

[david mosberger]

[I sent this mail from my home machine already but it was incorrectly rejected:

  <address@hidden>: host mail.freetype.org[212.43.237.66] said: 554 Service
    unavailable; [66.127.195.58] blocked using dul.dnsbl.sorbs.net, reason:
    Dynamic IP Address See:
    http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=66.127.195.58 (in reply to
    RCPT TO command)

 The black-list is wrong: IP address 66.127.195.58 is a FIXED IP address and the
 mail shouldn't have been rejected...]

Hi,

I have been experiencing long stalls on certain web-pages (such as
slashdot.org) when using mozilla on a Debian/ia64 box running
"testing".  During the stalls, the CPU was 100% busy in a loop inside
the TrueType's ttinterp.c:Normalize() routine.  If I understand that
code correctly, it's trying to normalize the vector length to 1.0
(scaled by 16384).  However, there appears to be an off-by-one-digit
error in the error-correction code that follows the main scaling.  In
particular, the code there says:

    /* Now, we want that Sqrt( W ) = 0x4000 */
    /* Or 0x1000000 <= W < 0x1004000        */

However, 0x4000 * 0x4000 = 0x10000000, so I think the condition should
be:

    /* Or 0x10000000 <= W < 0x10004000        */

Indeed, if I apply the attached patch, the hangs in mozilla do disappear.

I should say that I have seen this problem only one one machine (which
happens to have lots of TrueType fonts installed).  The particular
case in which it hangs is when the parameters are set to:

        Vx = 19648      Vy = 93824

I'm not quite sure why an off-by-a-digit error wouldn't cause problems
more often or why it doesn't (appear) to result in visible artifacts.
I observed the original problem with freetype-2.1.7 but it appears the
code in question hasn't changed in the CVS tree.

Am I missing something?

Thanks,

        --david

PS: Is there a particular reason not to use IEEE extended precision
    (80-bit) arithmetic on platforms that have this available?
    Particularly on ia64, that would be a lot faster than using
    fixed-point arithmetic, since (general) 64-bit multiplication has
    to be done in the floating-point unit anyhow.

fix.diff
Description: Text document