Remove is_static from fz_new{,_icc}_colorspace.

No longer required, and causes leaks.

Also, fix some reference counting problems with colorspaces.

4 files changed, 46 insertions, 25 deletions

diff --git a/source/fitz/colorspace.c b/source/fitz/colorspace.c
index ce608ef0..2cb5c3d9 100644
--- a/source/fitz/colorspace.c
+++ b/source/fitz/colorspace.c
@@ -154,10 +154,10 @@ clamp_default(const fz_colorspace *cs, const float *src, float *dst)
 }
 
 fz_colorspace *
-fz_new_colorspace(fz_context *ctx, char *name, int is_static, int n, int is_subtractive, fz_colorspace_convert_fn *to_ccs, fz_colorspace_convert_fn *from_ccs, fz_colorspace_base_fn *base, fz_colorspace_clamp_fn *clamp, fz_colorspace_destruct_fn *destruct, void *data, size_t size)
+fz_new_colorspace(fz_context *ctx, char *name, int n, int is_subtractive, fz_colorspace_convert_fn *to_ccs, fz_colorspace_convert_fn *from_ccs, fz_colorspace_base_fn *base, fz_colorspace_clamp_fn *clamp, fz_colorspace_destruct_fn *destruct, void *data, size_t size)
 {
 	fz_colorspace *cs = fz_malloc_struct(ctx, fz_colorspace);
-	FZ_INIT_STORABLE(cs, is_static ? -1 : 1, fz_drop_colorspace_imp);
+	FZ_INIT_STORABLE(cs, 1, fz_drop_colorspace_imp);
 	cs->size = sizeof(fz_colorspace) + size;
 	fz_strlcpy(cs->name, name, sizeof cs->name);
 	cs->n = n;
@@ -726,11 +726,11 @@ void fz_set_cmm_engine(fz_context *ctx, const fz_cmm_engine *engine)
 	fz_new_cmm_context(ctx);
 	if (engine)
 	{
-		cct->gray = fz_new_icc_colorspace(ctx, 1, 1, NULL, "gray-icc");
-		cct->rgb = fz_new_icc_colorspace(ctx, 1, 3, NULL, "rgb-icc");
-		cct->bgr = fz_new_icc_colorspace(ctx, 1, 3, NULL, "bgr-icc");
-		cct->cmyk = fz_new_icc_colorspace(ctx, 1, 4, NULL, "cmyk-icc");
-		cct->lab = fz_new_icc_colorspace(ctx, 1, 3, NULL, "lab-icc");
+		cct->gray = fz_new_icc_colorspace(ctx, 1, NULL, "gray-icc");
+		cct->rgb = fz_new_icc_colorspace(ctx, 3, NULL, "rgb-icc");
+		cct->bgr = fz_new_icc_colorspace(ctx, 3, NULL, "bgr-icc");
+		cct->cmyk = fz_new_icc_colorspace(ctx, 4, NULL, "cmyk-icc");
+		cct->lab = fz_new_icc_colorspace(ctx, 3, NULL, "lab-icc");
 	}
 	else
 		set_no_icc(cct);
@@ -778,7 +778,7 @@ void fz_drop_colorspace_context(fz_context *ctx)
 	{
 		fz_drop_colorspace(ctx, ctx->colorspace->gray);
 		fz_drop_colorspace(ctx, ctx->colorspace->rgb);
-		/* FIXME: bgr */
+		fz_drop_colorspace(ctx, ctx->colorspace->bgr);
 		fz_drop_colorspace(ctx, ctx->colorspace->cmyk);
 		fz_drop_colorspace(ctx, ctx->colorspace->lab);
 		fz_drop_cmm_context(ctx);
@@ -2774,11 +2774,11 @@ fz_new_indexed_colorspace(fz_context *ctx, fz_colorspace *base, int high, unsign
 
 	idx = fz_malloc_struct(ctx, struct indexed);
 	idx->lookup = lookup;
-	idx->base = base;
+	idx->base = fz_keep_colorspace(ctx, base);
 	idx->high = high;
 
 	fz_try(ctx)
-		cs = fz_new_colorspace(ctx, "Indexed", 0, 1, 0, fz_colorspace_is_icc(ctx, fz_device_rgb(ctx)) ? indexed_to_alt : indexed_to_rgb, NULL, base_indexed, clamp_indexed, free_indexed, idx, sizeof(*idx) + (base->n * (idx->high + 1)) + base->size);
+		cs = fz_new_colorspace(ctx, "Indexed", 1, 0, fz_colorspace_is_icc(ctx, fz_device_rgb(ctx)) ? indexed_to_alt : indexed_to_rgb, NULL, base_indexed, clamp_indexed, free_indexed, idx, sizeof(*idx) + (base->n * (idx->high + 1)) + base->size);
 	fz_catch(ctx)
 	{
 		fz_free(ctx, idx);
@@ -2978,7 +2978,7 @@ int fz_colorspace_is_lab_icc(fz_context *ctx, const fz_colorspace *cs)
 }
 
 fz_colorspace *
-fz_new_icc_colorspace(fz_context *ctx, int is_static, int num, fz_buffer *buf, const char *name)
+fz_new_icc_colorspace(fz_context *ctx, int num, fz_buffer *buf, const char *name)
 {
 	fz_colorspace *cs = NULL;
 	fz_iccprofile *profile;
@@ -3012,7 +3012,7 @@ fz_new_icc_colorspace(fz_context *ctx, int is_static, int num, fz_buffer *buf, c
 		{
 			fz_keep_buffer(ctx, buf);
 			fz_md5_icc(ctx, profile);
-			cs = fz_new_colorspace(ctx, "icc", is_static, num, 0, NULL, NULL, NULL, is_lab ? clamp_lab_icc : clamp_default_icc, free_icc, profile, sizeof(profile));
+			cs = fz_new_colorspace(ctx, "icc", num, 0, NULL, NULL, NULL, is_lab ? clamp_lab_icc : clamp_default_icc, free_icc, profile, sizeof(profile));
 		}
 	}
 	fz_catch(ctx)
@@ -3074,7 +3074,7 @@ fz_new_cal_colorspace(fz_context *ctx, float *wp, float *bp, float *gamma, float
 	cal_data->n = num;
 
 	fz_try(ctx)
-		cs = fz_new_colorspace(ctx, "pdf-cal", 0, num, 0, NULL, NULL, NULL, NULL, free_cal, cal_data, sizeof(cal_data));
+		cs = fz_new_colorspace(ctx, "pdf-cal", num, 0, NULL, NULL, NULL, NULL, free_cal, cal_data, sizeof(cal_data));
 	fz_catch(ctx)
 	{
 		fz_free(ctx, cal_data);
diff --git a/source/fitz/image.c b/source/fitz/image.c
index f2edf564..6ac6fb25 100644
--- a/source/fitz/image.c
+++ b/source/fitz/image.c
@@ -895,7 +895,7 @@ fz_new_image_from_buffer(fz_context *ctx, fz_buffer *buffer)
 {
 	fz_compressed_buffer *bc;
 	int w, h, xres, yres;
-	fz_colorspace *cspace = NULL;
+	fz_colorspace *cspace;
 	size_t len = buffer->len;
 	unsigned char *buf = buffer->data;
 	fz_image *image;
@@ -904,7 +904,7 @@ fz_new_image_from_buffer(fz_context *ctx, fz_buffer *buffer)
 	if (len < 8)
 		fz_throw(ctx, FZ_ERROR_GENERIC, "unknown image file format");
 
-	fz_var(cspace);
+	/* Note: cspace is only ever a borrowed reference here */
 
 	fz_try(ctx)
 	{
@@ -968,8 +968,6 @@ fz_new_image_from_buffer(fz_context *ctx, fz_buffer *buffer)
 			bc->params.u.jpeg.color_transform = -1;
 		image = fz_new_image_from_compressed_buffer(ctx, w, h, 8, cspace, xres, yres, 0, 0, NULL, NULL, bc, NULL);
 	}
-	fz_always(ctx)
-		fz_drop_colorspace(ctx, cspace);
 	fz_catch(ctx)
 		fz_rethrow(ctx);
 
diff --git a/source/fitz/list-device.c b/source/fitz/list-device.c
index a8f0bb09..4d2f0c00 100644
--- a/source/fitz/list-device.c
+++ b/source/fitz/list-device.c
@@ -1301,7 +1301,7 @@ fz_new_list_device(fz_context *ctx, fz_display_list *list)
 	dev->alpha = 1.0f;
 	dev->ctm = fz_identity;
 	dev->stroke = NULL;
-	dev->colorspace = fz_device_gray(ctx);
+	dev->colorspace = fz_keep_colorspace(ctx, fz_device_gray(ctx));
 	memset(dev->color, 0, sizeof(float)*FZ_MAX_COLORS);
 	dev->top = 0;
 	dev->tiled = 0;
@@ -1458,7 +1458,7 @@ fz_run_display_list(fz_context *ctx, fz_display_list *list, fz_device *dev, cons
 	fz_matrix ctm = fz_identity;
 	fz_stroke_state *stroke = NULL;
 	float color[FZ_MAX_COLORS] = { 0 };
-	fz_colorspace *colorspace = fz_device_gray(ctx);
+	fz_colorspace *colorspace = fz_keep_colorspace(ctx, fz_device_gray(ctx));
 	fz_color_params color_params;
 	fz_rect rect = { 0 };
 
diff --git a/source/fitz/store.c b/source/fitz/store.c
index 86f51acf..bf98c1aa 100644
--- a/source/fitz/store.c
+++ b/source/fitz/store.c
@@ -147,6 +147,8 @@ do_reap(fz_context *ctx)
 		}
 
 		/* Store whether to drop this value or not in 'prev' */
+		if (item->val->refs > 0)
+			(void)Memento_dropRef(item->val);
 		item->prev = (item->val->refs > 0 && --item->val->refs == 0) ? item : NULL;
 
 		/* Store it in our removal chain - just singly linked */
@@ -181,11 +183,10 @@ void fz_drop_key_storable(fz_context *ctx, const fz_key_storable *sc)
 	if (s == NULL)
 		return;
 
-	if (s->storable.refs > 0)
-		(void)Memento_dropRef(s);
 	fz_lock(ctx, FZ_LOCK_ALLOC);
 	if (s->storable.refs > 0)
 	{
+		(void)Memento_dropRef(s);
 		drop = --s->storable.refs == 0;
 		if (!drop && s->storable.refs == s->store_key_refs)
 		{
@@ -224,11 +225,10 @@ void *fz_keep_key_storable_key(fz_context *ctx, const fz_key_storable *sc)
 	if (s == NULL)
 		return NULL;
 
-	if (s->storable.refs > 0)
-		(void)Memento_takeRef(s);
 	fz_lock(ctx, FZ_LOCK_ALLOC);
 	if (s->storable.refs > 0)
 	{
+		(void)Memento_takeRef(s);
 		++s->storable.refs;
 		++s->store_key_refs;
 	}
@@ -246,10 +246,9 @@ void fz_drop_key_storable_key(fz_context *ctx, const fz_key_storable *sc)
 	if (s == NULL)
 		return;
 
-	if (s->storable.refs > 0)
-		(void)Memento_dropRef(s);
 	fz_lock(ctx, FZ_LOCK_ALLOC);
 	assert(s->store_key_refs > 0 && s->storable.refs >= s->store_key_refs);
+	(void)Memento_dropRef(s);
 	drop = --s->storable.refs == 0;
 	--s->store_key_refs;
 	fz_unlock(ctx, FZ_LOCK_ALLOC);
@@ -282,6 +281,8 @@ evict(fz_context *ctx, fz_item *item)
 		store->head = item->next;
 
 	/* Drop a reference to the value (freeing if required) */
+	if (item->val->refs > 0)
+		(void)Memento_dropRef(item->val);
 	drop = (item->val->refs > 0 && --item->val->refs == 0);
 
 	/* Remove from the hash table */
@@ -347,14 +348,20 @@ ensure_space(fz_context *ctx, size_t tofree)
 			 * not be cached. */
 			count += item->size;
 			if (prev)
+			{
+				(void)Memento_takeRef(prev->val);
 				prev->val->refs++;
+			}
 			evict(ctx, item); /* Drops then retakes lock */
 			/* So the store has 1 reference to prev, as do we, so
 			 * no other evict process can have thrown prev away in
 			 * the meantime. So we are safe to just decrement its
 			 * reference count here. */
 			if (prev)
+			{
+				(void)Memento_dropRef(prev->val);
 				--prev->val->refs;
+			}
 
 			if (count >= tofree)
 				return count;
@@ -462,7 +469,10 @@ fz_store_item(fz_context *ctx, void *key, void *val_, size_t itemsize, const fz_
 			 * to the existing one, and drop our current one. */
 			touch(store, existing);
 			if (existing->val->refs > 0)
+			{
+				(void)Memento_takeRef(existing->val);
 				existing->val->refs++;
+			}
 			fz_unlock(ctx, FZ_LOCK_ALLOC);
 			fz_free(ctx, item);
 			type->drop_key(ctx, key);
@@ -567,7 +577,10 @@ fz_find_item(fz_context *ctx, fz_store_drop_fn *drop, void *key, const fz_store_
 		touch(store, item);
 		/* And bump the refcount before returning */
 		if (item->val->refs > 0)
+		{
+			(void)Memento_takeRef(item->val);
 			item->val->refs++;
+		}
 		fz_unlock(ctx, FZ_LOCK_ALLOC);
 		return (void *)item->val;
 	}
@@ -622,6 +635,8 @@ fz_remove_item(fz_context *ctx, fz_store_drop_fn *drop, void *key, const fz_stor
 			else
 				store->head = item->next;
 		}
+		if (item->val->refs > 0)
+			(void)Memento_dropRef(item->val);
 		dodrop = (item->val->refs > 0 && --item->val->refs == 0);
 		fz_unlock(ctx, FZ_LOCK_ALLOC);
 		if (dodrop)
@@ -701,14 +716,20 @@ fz_debug_store_locked(fz_context *ctx)
 	{
 		next = item->next;
 		if (next)
+		{
+			(void)Memento_takeRef(next->val);
 			next->val->refs++;
+		}
 		fz_unlock(ctx, FZ_LOCK_ALLOC);
 		item->type->format_key(ctx, buf, sizeof buf, item->key);
 		fz_lock(ctx, FZ_LOCK_ALLOC);
 		printf("store[*][refs=%d][size=%d] key=%s val=%p\n",
 				item->val->refs, (int)item->size, buf, item->val);
 		if (next)
+		{
+			(void)Memento_dropRef(next->val);
 			next->val->refs--;
+		}
 	}
 
 	printf("-- resource store hash contents --\n");
@@ -887,6 +908,8 @@ void fz_filter_store(fz_context *ctx, fz_store_filter_fn *fn, void *arg, const f
 		}
 
 		/* Store whether to drop this value or not in 'prev' */
+		if (item->val->refs > 0)
+			(void)Memento_dropRef(item->val);
 		item->prev = (item->val->refs > 0 && --item->val->refs == 0) ? item : NULL;
 
 		/* Store it in our removal chain - just singly linked */