Bug 1377328 - part 2 - Annotate raw pointers used for refcounted objects in font-related code. r=milan

gfx/src/nsFontMetrics.h

@@ -250,7 +250,9 @@ private:
     nsFont mFont;
     RefPtr<gfxFontGroup> mFontGroup;
     nsCOMPtr<nsIAtom> mLanguage;
-    nsDeviceContext* mDeviceContext;
+    // Pointer to the device context for which this fontMetrics object was
+    // created.
+    nsDeviceContext* MOZ_NON_OWNING_REF mDeviceContext;
     int32_t mP2A;
 
     // The font orientation (horizontal or vertical) for which these metrics

gfx/thebes/gfxFont.h

@@ -367,7 +367,11 @@ protected:
         }
         enum { ALLOW_MEMMOVE = true };
 
-        gfxFont* mFont;
+        // The cache tracks gfxFont objects whose refcount has dropped to zero,
+        // so they are not immediately deleted but may be "resurrected" if they
+        // have not yet expired from the tracker when they are needed again.
+        // See the custom AddRef/Release methods in gfxFont.
+        gfxFont* MOZ_UNSAFE_REF("tracking for deferred deletion") mFont;
     };
 
     nsTHashtable<HashEntry> mFonts;

gfx/thebes/gfxGraphiteShaper.h

@@ -45,8 +45,12 @@ protected:
     gr_font *mGrFont; // owned by the shaper itself
 
     struct CallbackData {
-        gfxFont* mFont;
-        mozilla::gfx::DrawTarget* mDrawTarget;
+        // mFont is a pointer to the font that owns this shaper, so it will
+        // remain valid throughout our lifetime
+        gfxFont* MOZ_NON_OWNING_REF mFont;
+        // initialized to a DrawTarget owned by our caller on every call to
+        // ShapeText
+        mozilla::gfx::DrawTarget* MOZ_NON_OWNING_REF mDrawTarget;
     };
 
     CallbackData mCallbackData;

gfx/thebes/gfxHarfBuzzShaper.h

@@ -23,7 +23,9 @@ public:
      */
     struct FontCallbackData {
         gfxHarfBuzzShaper* mShaper;
-        mozilla::gfx::DrawTarget* mDrawTarget;
+        // initialized to a DrawTarget owned by our caller on every call to
+        // ShapeText
+        mozilla::gfx::DrawTarget* MOZ_NON_OWNING_REF mDrawTarget;
     };
 
     bool Initialize();

gfx/thebes/gfxPlatformFontList.h

@@ -67,7 +67,9 @@ public:
     enum { ALLOW_MEMMOVE = true };
 
 protected:
-    gfxCharacterMap *mCharMap;
+    // charMaps are not owned by the shared cmap cache, but it will be notified
+    // by gfxCharacterMap::Release() when an entry is about to be deleted
+    gfxCharacterMap* MOZ_NON_OWNING_REF mCharMap;
 };
 
 // gfxPlatformFontList is an abstract class for the global font list on the system;

gfx/thebes/gfxSVGGlyphs.h

@@ -140,7 +140,9 @@ private:
     nsBaseHashtable<nsUint32HashKey, Element*, Element*> mGlyphIdMap;
 
     hb_blob_t *mSVGData;
-    gfxFontEntry *mFontEntry;
+
+    // pointer to the font entry that owns this gfxSVGGlyphs object
+    gfxFontEntry* MOZ_NON_OWNING_REF mFontEntry;
 
     const struct Header {
         mozilla::AutoSwap_PRUint16 mVersion;

gfx/thebes/gfxTextRun.h

@@ -813,8 +813,12 @@ private:
     }
 
     void             *mUserData;
-    gfxFontGroup     *mFontGroup; // addrefed on creation, but our reference
-                                  // may be released by ReleaseFontGroup()
+
+    // mFontGroup is usually a strong reference, but refcounting is managed
+    // manually because it may be explicitly released by ReleaseFontGroup()
+    // in the case where the font group actually owns the textrun.
+    gfxFontGroup* MOZ_OWNING_REF mFontGroup;
+
     gfxSkipChars      mSkipChars;
 
     nsTextFrameUtils::Flags mFlags2; // additional flags (see also gfxShapedText::mFlags)
@@ -1129,8 +1133,10 @@ protected:
         RefPtr<gfxFontFamily> mFamily;
         // either a font or a font entry exists
         union {
-            gfxFont*            mFont;
-            gfxFontEntry*       mFontEntry;
+            // Whichever of these fields is actually present will be a strong
+            // reference, with refcounting handled manually.
+            gfxFont* MOZ_OWNING_REF      mFont;
+            gfxFontEntry* MOZ_OWNING_REF mFontEntry;
         };
         bool                    mNeedsBold   : 1;
         bool                    mFontCreated : 1;

gfx/thebes/gfxUserFontSet.h

@@ -746,7 +746,7 @@ protected:
     // This field is managed by the nsFontFaceLoader. In the destructor and Cancel()
     // methods of nsFontFaceLoader this reference is nulled out.
     nsFontFaceLoader* MOZ_NON_OWNING_REF mLoader; // current loader for this entry, if any
-    gfxUserFontSet*          mFontSet; // font-set which owns this userfont entry
+    gfxUserFontSet*   MOZ_NON_OWNING_REF mFontSet; // font-set which owns this userfont entry
     RefPtr<gfxFontSrcPrincipal> mPrincipal;
 };