Lock reworking.

This is a significant change to the use of locks in MuPDF.

Previously, the user had the option of passing us lock/unlock
functions for a single mutex as part of the allocation struct.
Now we remove these entries from the allocation struct, and
make a separate 'locks' struct. This enables people to use
fz_alloc_default with locking.

If multithreaded operation is required, then the user is
required to create FZ_LOCK_MAX mutexes, which will be locked
or unlocked by MuPDF calling the lock/unlock functions within
the new fz_locks_context structure passed in at context creation.

These mutexes are not required to be recursive (they may be, but
MuPDF should never call them in this way). MuPDF avoids deadlocks
by imposing a locking ordering on itself; a thread will never take
lock n, if it already holds any lock i for which 0 <= i <= n.

Currently, there are 4 locks used within MuPDF.

Lock 0: The alloc lock; taken around all calls to user supplied
(or default) allocation functions. Also taken around all accesses
to the refs field of storable items.

Lock 1: The store lock; taken whenever the store data structures
(specifically the linked list pointers) are accessed.

Lock 2: The file lock; taken whenever a thread is accessing the raw
file. We use the debugging macros to insist that this is held
whenever we do a file based seek or read. We also insist that this
is never held when we resolve an indirect reference, as this can
have the effect of moving the file pointer.

Lock 3: The glyphcache lock; taken whenever a thread calls freetype,
or accesses the glyphcache data structures. This introduces some
complexities w.r.t type3 fonts.

Locking can be hugely problematic, so to ease our minds as to
the correctness of this code, we introduce some debugging macros.
These compile away to nothing unless FITZ_DEBUG_LOCKING is defined.

fz_assert_lock_held(ctx, lock) checks that we hold lock.

fz_assert_lock_not_held(ctx, lock) checks that we do not hold lock.

In addition fz_lock_debug_lock and fz_lock_debug_unlock are used
on every fz_lock/fz_unlock to check the validity of the operation
we are performing - in particular it checks that we do/do not already
hold the lock we are trying to take/drop, and that by taking this
lock we are not violating our defined locking order.

The RESOLVE macro (used throughout the code to check whether we need
to resolve an indirect reference) calls fz_assert_lock_not_held to
ensure that we aren't about to resolve an indirect reference (and
hence move the stream pointer) when the file is locked.

In order to implement the file locking properly, pdf_open_stream
(and friends) now lock the file as a side effect (because they
fz_seek to the start of the stream). The lock is automatically
dropped on an fz_close of such streams.

Previously, the glyph cache was created in a context when it was first
required; this presents problems as it can be shared between several
contexts or not, depending on whether it is created before the
contexts are cloned. We now always create it at startup, so it is
always shared.

This means that we need reference counting for the glyph caches.
Added here.

In fz_render_glyph, we take the glyph cache lock, and check to see
whether the glyph is in the cache. If it is, we bump the refcount,
drop the lock and returned the cached character. If it is not, we
need to render the character.

For freetype based fonts we keep the lock throughout the rendering
process, thus ensuring that freetype is only called in a single
threaded manner.

For type3 fonts, however, we need to invoke the interpreter again
to render the glyph streams. This can require reentrance to this
routine. We therefore drop the glyph cache lock, call the
interpreter to render us our pixmap, and take the lock again.

This dropping and retaking of the lock introduces a possible race
condition; 2 threads may try to render the same character at the
same time. We therefore modify our hash table insert routines to
behave differently if it comes to insert an entry only to find
that an entry with the same key is already there.

We spot this case; if we have just rendered a type3 glyph and when
we try to insert it into the cache discover that someone has beaten
us to it, we just discard our entry and use the cached one.

Hopefully this will seldom be a problem in practise; to solve it
properly would require greater complexity (probably involving
spotting that another thread is already working on the desired
rendering, and sleeping on a semaphore until it completes).

1 files changed, 71 insertions, 10 deletions

diff --git a/fitz/fitz.h b/fitz/fitz.h
index 9ce721ea..335088e5 100644
--- a/fitz/fitz.h
+++ b/fitz/fitz.h
@@ -110,6 +110,7 @@ typedef struct fz_error_context_s fz_error_context;
 typedef struct fz_warn_context_s fz_warn_context;
 typedef struct fz_font_context_s fz_font_context;
 typedef struct fz_aa_context_s fz_aa_context;
+typedef struct fz_locks_context_s fz_locks_context;
 typedef struct fz_store_s fz_store;
 typedef struct fz_glyph_cache_s fz_glyph_cache;
 typedef struct fz_context_s fz_context;
@@ -120,8 +121,6 @@ struct fz_alloc_context_s
 	void *(*malloc)(void *, unsigned int);
 	void *(*realloc)(void *, void *, unsigned int);
 	void (*free)(void *, void *);
-	void (*lock)(void *);
-	void (*unlock)(void *);
 };
 
 /* Default allocator */
@@ -363,6 +362,7 @@ void fz_flush_warnings(fz_context *ctx);
 struct fz_context_s
 {
 	fz_alloc_context *alloc;
+	fz_locks_context *locks;
 	fz_error_context *error;
 	fz_warn_context *warn;
 	fz_font_context *font;
@@ -371,27 +371,85 @@ struct fz_context_s
 	fz_glyph_cache *glyph_cache;
 };
 
-fz_context *fz_new_context(fz_alloc_context *alloc, unsigned int max_store);
+fz_context *fz_new_context(fz_alloc_context *alloc, fz_locks_context *locks, unsigned int max_store);
 fz_context *fz_clone_context(fz_context *ctx);
 void fz_free_context(fz_context *ctx);
 
 void fz_new_aa_context(fz_context *ctx);
 void fz_free_aa_context(fz_context *ctx);
 
+/* Locking functions
+ *
+ * MuPDF is kept deliberately free of any knowledge of particular threading
+ * systems. As such, in order for safe multi-threaded operation, we rely on
+ * callbacks to client provided functions.
+ *
+ * A client is expected to provide FZ_LOCK_MAX mutexes, and a function to
+ * lock/unlock each of them. These may be recursive mutexes, but do not have
+ * to be.
+ *
+ * If a client does not intend to use multiple threads, then it may pass
+ * NULL instead of the address of a lock structure.
+ *
+ * In order to avoid deadlocks, we have 1 simple rules internally as to how
+ * we use locks: We can never take lock n when we already hold any lock i,
+ * where 0 <= i <= n. In order to verify this, we have some debugging code
+ * built in, that is enabled by defining FITZ_DEBUG_LOCKING.
+ */
+
+#if defined(MEMENTO) || defined(DEBUG)
+#define FITZ_DEBUG_LOCKING
+#endif
+
+struct fz_locks_context_s
+{
+	void *user;
+	void (*lock)(void *, int);
+	void (*unlock)(void *, int);
+};
+
+enum {
+	FZ_LOCK_ALLOC = 0,
+	FZ_LOCK_STORE,
+	FZ_LOCK_FILE,
+	FZ_LOCK_GLYPHCACHE,
+	FZ_LOCK_MAX
+};
+
+/* Default locks */
+extern fz_locks_context fz_locks_default;
+
+#ifdef FITZ_DEBUG_LOCKING
+
+void fz_assert_lock_held(fz_context *ctx, int lock);
+void fz_assert_lock_not_held(fz_context *ctx, int lock);
+void fz_lock_debug_lock(fz_context *ctx, int lock);
+void fz_lock_debug_unlock(fz_context *ctx, int lock);
+
+#else
+
+#define fz_assert_lock_held(A,B) do { } while (0)
+#define fz_assert_lock_not_held(A,B) do { } while (0)
+#define fz_lock_debug_lock(A,B) do { } while (0)
+#define fz_lock_debug_unlock(A,B) do { } while (0)
+
+#endif /* !FITZ_DEBUG_LOCKING */
+
 static inline void
-fz_lock(fz_context *ctx)
+fz_lock(fz_context *ctx, int lock)
 {
-	if (ctx->alloc->lock)
-		ctx->alloc->lock(ctx->alloc->user);
+	fz_lock_debug_lock(ctx, lock);
+	ctx->locks->lock(ctx->locks->user, lock);
 }
 
 static inline void
-fz_unlock(fz_context *ctx)
+fz_unlock(fz_context *ctx, int lock)
 {
-	if (ctx->alloc->unlock)
-		ctx->alloc->unlock(ctx->alloc->user);
+	fz_lock_debug_unlock(ctx, lock);
+	ctx->locks->unlock(ctx->locks->user, lock);
 }
 
+
 /*
  * Basic runtime and utility functions
  */
@@ -451,7 +509,7 @@ void fz_empty_hash(fz_context *ctx, fz_hash_table *table);
 void fz_free_hash(fz_context *ctx, fz_hash_table *table);
 
 void *fz_hash_find(fz_context *ctx, fz_hash_table *table, void *key);
-void fz_hash_insert(fz_context *ctx, fz_hash_table *table, void *key, void *val);
+void *fz_hash_insert(fz_context *ctx, fz_hash_table *table, void *key, void *val);
 void fz_hash_remove(fz_context *ctx, fz_hash_table *table, void *key);
 
 int fz_hash_len(fz_context *ctx, fz_hash_table *table);
@@ -781,6 +839,7 @@ struct fz_stream_s
 	int pos;
 	int avail;
 	int bits;
+	int locked;
 	unsigned char *bp, *rp, *wp, *ep;
 	void *state;
 	int (*read)(fz_stream *stm, unsigned char *buf, int len);
@@ -795,6 +854,7 @@ fz_stream *fz_open_file_w(fz_context *ctx, const wchar_t *filename); /* only on
 fz_stream *fz_open_buffer(fz_context *ctx, fz_buffer *buf);
 fz_stream *fz_open_memory(fz_context *ctx, unsigned char *data, int len);
 void fz_close(fz_stream *stm);
+void fz_lock_stream(fz_stream *stm);
 
 fz_stream *fz_new_stream(fz_context *ctx, void*, int(*)(fz_stream*, unsigned char*, int), void(*)(fz_context *, void *));
 fz_stream *fz_keep_stream(fz_stream *stm);
@@ -1188,6 +1248,7 @@ void fz_debug_path(fz_context *ctx, fz_path *, int indent);
  */
 
 void fz_new_glyph_cache_context(fz_context *ctx);
+fz_glyph_cache *fz_glyph_cache_keep(fz_context *ctx);
 void fz_free_glyph_cache_context(fz_context *ctx);
 
 fz_pixmap *fz_render_ft_glyph(fz_context *ctx, fz_font *font, int cid, fz_matrix trm);