IssueTracker

Steps to reproduce:

1. Write an application that calls Typeface.createFromAsset() multiple times.
2. Make sure that the typeface objects are out of scope and the garbage collector has completed at least one pass.
3. Run adb shell dumpsys meminfo <your app package>

Observe: There are multiple opened fonts under "Asset Allocations".

I was able to reproduce this bug on a device with Eclair firmware as well as on a device with Froyo. This is a significant bug as an application with custom fonts can quickly run out of memory.

My first thought of the leak was that the framework may ententionally cache opened asset files. I took a dive into the framework to find out if this was the case. I'm sharing my findings here so it will be easier for the developer fixing the bug to get started.

In the JNI layer, createFromAsset is implemented in Typeface.cpp:

static SkTypeface* Typeface_createFromAsset(JNIEnv* env, jobject,
                                            jobject jassetMgr,
                                            jstring jpath) {

    NPE_CHECK_RETURN_ZERO(env, jassetMgr);
    NPE_CHECK_RETURN_ZERO(env, jpath);

    AssetManager* mgr = assetManagerForJavaObject(env, jassetMgr);
    if (NULL == mgr) {
        return NULL;
    }

    AutoJavaStringToUTF8    str(env, jpath);
    Asset* asset = mgr->open(str.c_str(), Asset::ACCESS_BUFFER);
    if (NULL == asset) {
        return NULL;
    }

    return SkTypeface::CreateFromStream(new AssetStream(asset, true));
}

AssetStream is a local class which derives from SkStream. SkStream in turn derives from SkRefCnt, which is ref counted. The initial ref count is set to 1 in the constructor.

The body of SkTypeface::CreateFromStream() invokes SkFontHost::CreateTypefaceFromStream(). The body of that function is located in SkFontHost_android.cpp:

SkTypeface* SkFontHost::CreateTypefaceFromStream(SkStream* stream) {
    if (NULL == stream || stream->getLength() <= 0) {
        return NULL;
    }

    SkString name;
    SkTypeface::Style style = find_name_and_style(stream, &name);

    return SkNEW_ARGS(StreamTypeface, (style, false, NULL, stream));
}

Here, the stream is passed in the constructor of a new StreamTypeface object. In the constructor, the StreamTypeface increments the ref count of the stream by 1 to become 2.

The resulting Typeface is returned back to the Java layer. When the typeface gets out of scope, the object is garbage collected and the finalize() method is invoked. This will call the unref function which lowers the ref count:

static void Typeface_unref(JNIEnv* env, jobject obj, SkTypeface* face) {
    SkSafeUnref(face);
}

At this point, you would expect the native object to be freed and the asset stream to be closed. However, after lowering the ref count, the value is 1, which is not enough to free the native object.

It seems that the ref count of the Typeface object should be lowered by one in the JNI layer (Typeface_createFromAsset), before returning the object. For reference, another method in the font host does decrement the ref count before returning:

SkTypeface* SkFontHost::CreateTypefaceFromFile(const char path[]) {
    SkStream* stream = SkNEW_ARGS(SkMMAPStream, (path));
    SkTypeface* face = SkFontHost::CreateTypefaceFromStream(stream);
    // since we created the stream, we let go of our ref() here
    stream->unref();
    return face;
}

Thanks!