reference_table() in src/java.desktop/share/native/libfontmanager/hb-jdk-font.cc allocates "buffer" with new[] operator, and calls hb_blob_create() where it pass a function pointer to free() to free memory when time comes:

http://hg.openjdk.java.net/jdk9/dev/jdk/file/41e3c10db27a/src/java.desktop/share/native/libfontmanager/hb-jdk-font.cc#l296

...
  buffer = new jbyte[length];
  env->GetByteArrayRegion(tableBytes, 0, length, buffer);

  return hb_blob_create((const char *)buffer, length,
                         HB_MEMORY_MODE_WRITABLE,
                         buffer, free);
...

It should use delete[] operator instead. The main difference is that free() doesn't call a destructor before deallocating memory, but delete[] operator does.

But in this case it doesn't seem to be a serious issue because jbyte is defined as a signed char, so that it doesn't have a descructor:

http://hg.openjdk.java.net/jdk9/dev/hotspot/file/934f6793f5f7/src/cpu/zero/vm/jni_zero.h#l44

The following patch fixes this:


diff -r 41e3c10db27a src/java.desktop/share/native/libfontmanager/hb-jdk-font.cc
--- a/src/java.desktop/share/native/libfontmanager/hb-jdk-font.cc Fri Feb 26 12:11:28 2016 +0100
+++ b/src/java.desktop/share/native/libfontmanager/hb-jdk-font.cc Fri Feb 26 20:14:54 2016 -0800
@@ -273,6 +273,10 @@
 static void _do_nothing(void) {
 }
 
+static void _delete_jbyte_array(jbyte *p) {
+ delete[] p;
+}
+
 static hb_blob_t *
 reference_table(hb_face_t *face HB_UNUSED, hb_tag_t tag, void *user_data) {
 
@@ -298,7 +302,7 @@
 
   return hb_blob_create((const char *)buffer, length,
                          HB_MEMORY_MODE_WRITABLE,
- buffer, free);
+ buffer, (hb_destroy_func_t) _delete_jbyte_array);
 }
 
 hb_face_t*