From 060e2965b83785c847f4e60feff3e1e5a6aa5484 Mon Sep 17 00:00:00 2001
From: Moonchild <moonchild@palemoon.org>
Date: Wed, 27 Aug 2025 15:53:56 +0200
Subject: [PATCH] Revert "[gfx] Guard against possible race via
 gfxFontEntry::GetFontTable."

This reverts commit a1cf966815240aef59e33c49c9496e3516b1fdd7.
---
 gfx/thebes/gfxFontEntry.cpp | 13 ++++---------
 gfx/thebes/gfxFontEntry.h   |  2 +-
 2 files changed, 5 insertions(+), 10 deletions(-)

diff --git a/gfx/thebes/gfxFontEntry.cpp b/gfx/thebes/gfxFontEntry.cpp
index bfc7cee2f7..e8bb39e689 100644
--- a/gfx/thebes/gfxFontEntry.cpp
+++ b/gfx/thebes/gfxFontEntry.cpp
@@ -495,7 +495,7 @@ public:
 
 private:
     // The font table data block
-    const nsTArray<uint8_t> mTableData;
+    nsTArray<uint8_t> mTableData;
 
     // The blob destroy function needs to know the owning font entry
     // so that it can hold the font-entry's reference while modifying the
@@ -591,16 +591,11 @@ gfxFontEntry::ShareFontTableAndGetBlob(uint32_t aTag,
       mFontTableCache = MakeUnique<nsTHashtable<FontTableHashEntry>>(8);
     }
 
-    FontTableHashEntry* entry;
-    if (MOZ_UNLIKELY(entry = mFontTableCache->GetEntry(aTag))) {
-      // We must have been racing with another GetFontTable for the same table,
-      // and it won the race and filled in the entry before us.
-      // Ignore `aBuffer` in that case, and return a reference to the existing blob.
-      return entry->GetBlob();
+    FontTableHashEntry *entry = mFontTableCache->PutEntry(aTag);
+    if (MOZ_UNLIKELY(!entry)) { // OOM
+        return nullptr;
     }
 
-    entry = mFontTableCache->PutEntry(aTag);
-
     if (!aBuffer) {
         // ensure the entry is null
         entry->Clear();
diff --git a/gfx/thebes/gfxFontEntry.h b/gfx/thebes/gfxFontEntry.h
index 04f27a3799..162fe4f083 100644
--- a/gfx/thebes/gfxFontEntry.h
+++ b/gfx/thebes/gfxFontEntry.h
@@ -265,7 +265,7 @@ public:
     // unregisters the table from the font entry.
     //
     // Pass nullptr for aBuffer to indicate that the table is not present and
-    // nullptr will be returned.
+    // nullptr will be returned.  Also returns nullptr on OOM.
     hb_blob_t *ShareFontTableAndGetBlob(uint32_t aTag,
                                         nsTArray<uint8_t>* aTable);