From ff4e8c7eac26f3183cb88a37dadb578362d44405 Mon Sep 17 00:00:00 2001
From: Garret Rieger <grieger@google.com>
Date: Fri, 14 Jan 2022 16:20:31 -0800
Subject: [PATCH] [map] Fix bad memory access if hb_map.fini() was called
 twice.

---
 src/hb-map.hh   | 12 +++++++-----
 src/test-map.cc |  8 ++++++++
 2 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/src/hb-map.hh b/src/hb-map.hh
index f091aa08c..218350885 100644
--- a/src/hb-map.hh
+++ b/src/hb-map.hh
@@ -131,11 +131,13 @@ struct hb_hashmap_t
   }
   void fini_shallow ()
   {
-    unsigned size = mask + 1;
-    for (unsigned i = 0; i < size; i++)
-      items[i].~item_t ();
-    hb_free (items);
-    items = nullptr;
+    if (unlikely (!items)) {
+      unsigned size = mask + 1;
+      for (unsigned i = 0; i < size; i++)
+        items[i].~item_t ();
+      hb_free (items);
+      items = nullptr;
+    }
     population = occupancy = 0;
   }
   void fini ()
diff --git a/src/test-map.cc b/src/test-map.cc
index 5d24ec347..fd2b2f0e6 100644
--- a/src/test-map.cc
+++ b/src/test-map.cc
@@ -78,6 +78,14 @@ main (int argc, char **argv)
     assert (v.get_population () == 2);
   }
 
+  /* Test call fini() twice. */
+  {
+    hb_map_t s;
+    for (int i = 0; i < 16; i++)
+      s.set(i, i+1);
+    s.fini();
+  }
+
   /* Test initializing from iterator. */
   {
     hb_map_t s;