How to avoid memory leak with CTFontCreateWithGraphicsFont?

Question

I've reduced a leak issue to this easy to compile code which shows after CTFontCreateWithGraphicsFont use and release ct_font, an extra ref to cg_font will be left. Is this an internal Apple ref count issue or am I missing something around like having to double release cg_font or changing order of the releases? Thanks.

#include <stdio.h>
#include <stdlib.h>
#include <ApplicationServices/ApplicationServices.h>

int main(int argc, char **argv) {
    FILE *f = fopen("/Library/Fonts/Tahoma.ttf", "rb");
    fseek(f, 0, SEEK_END);
    long fsize = ftell(f);
    fseek(f, 0, SEEK_SET);
    
    char* font = (char*)malloc(fsize);
    fread(font, fsize, 1, f);
    fclose(f);
    
    CGDataProviderRef provider = CGDataProviderCreateWithData(NULL, font, fsize, NULL);
    CGFontRef cg_font = CGFontCreateWithDataProvider(provider);
    CTFontRef ct_font = CTFontCreateWithGraphicsFont(cg_font, 36., NULL, NULL);
    CGDataProviderRelease(provider);

    //
    
    CFRelease(ct_font);
    CFRelease(cg_font);
    
    printf("ct_font: %d\ncg_font: %d\n", (int)CFGetRetainCount(ct_font), (int)CFGetRetainCount(cg_font));

    free(font);
    
    return 0;
}

Result after compile and run:

ct_font: -1

cg_font: 1

Answer 1

The retain of the CGFont happens in the TInMemoryBaseFont constructor:

#0  0x00007fff8928e4d0 in CFRetain ()
#1  0x00007fff86472906 in TInMemoryBaseFont::TInMemoryBaseFont(CGFont*) ()
#2  0x00007fff864728b8 in CTFontDescriptor::CTFontDescriptor(CGFont*, is_inmemory_t const&) ()
#3  0x00007fff8646cb30 in TDescriptorSource::CopyDescriptor(CGFont*, __CFDictionary const*) const ()
#4  0x00007fff8646c99a in TFont::InitDescriptor(CGFont*, __CTFontDescriptor const*) ()
#5  0x00007fff8646c7b4 in TFont::TFont(CGFont*, double, CGAffineTransform const*, __CTFontDescriptor const*) ()
#6  0x00007fff8646c775 in CTFontCreateWithGraphicsFont ()

It's not matched with a release upon releasing the CTFont, probably because the TInMemoryBaseFont destructor is never called (for unknown reasons).

This isn't a solution, but might help someone coming along debug the problem further.