[Devel] NT crash in psaux

[Blinn, Eric W]

Hi all,

I need some help with an intermittent platform specific crash that is
happening in the psaux module.  The problem occurs on NT compiled with VC++.
I am using the FreeType 2.0.1 source tree with Tom Kacvinsky's PFA-related
patches rolled in.  I found one bug in the code and I've attached a patch
(based upon today's freetype2-current snapshot), but it is not the cause of
the crash.

The crash happens when PS_Table_Add() calls MEM_Copy() with a "source"
argument (variable name object) pointing to memory that has already been
freed.  This results in a free memory read and a crash on NT/VC++.  I also
work on DEC OSF/1 with the native DEC compiler, but we don't crash there
presumably because the platform let's us get away with reading unallocated
memory.  

Because the bug is so intermittent and the code where the crash occurs is
hit so frequently, I have had a difficult time debugging it.  About all I
have been able to do is "postmortem" investigations when the crash occurs.
However, I have used the Rational Purify memory profiler to get some more
information and it looks like the problem is local to psaux (I believe I've
ruled our application out as a culprit).  I have attached a text file
containing the Purify output.  It shows a brief description and also free
memory read error location, allocation location, and free location (each
with stack/code context).  I'm hoping that getting it in front of some eyes
that know the FreeType code well enough might help.

Thanks,
Eric Blinn

Purify.txt
Description: Text document

psobjs.diff
Description: Binary data