# gpui_windows: Harden DirectWrite and DirectX text rendering \(\#60124\) · gitcafe/zed

[View on GitCafe](https://git.cafe/gitcafe/zed/commit/89e8a4b9ec7e0fa8a49987a3c1dbf29343dc6999)

Repository: [gitcafe/zed](https://git.cafe/gitcafe/zed)

Visibility: public

Requested revision: 89e8a4b9ec7e0fa8a49987a3c1dbf29343dc6999

Requested commit: 89e8a4b9ec7e0fa8a49987a3c1dbf29343dc6999

Commit: 89e8a4b9ec7e0fa8a49987a3c1dbf29343dc6999

Tree: 7ebfc34d6457c706056e559025f99d2c64a11f0e

Author: Richard Feldman

Committer: GitHub

## Message

```
gpui_windows: Harden DirectWrite and DirectX text rendering (#60124)

This hardens the Windows text rendering path in gpui_windows against
undefined behavior and out-of-bounds access. DirectWrite hands back
glyph-run arrays (glyph indices, advances, offsets) and cluster maps as
raw pointers that may be null; these are now interpreted through a
shared `slice_from_nullable` helper that treats a null pointer with zero
length as an empty slice and returns `E_INVALIDARG` when a null pointer
arrives with a nonzero length, instead of constructing a slice from a
null pointer. It also fixes a provenance bug: the renderer context
passed to `IDWriteTextLayout::Draw` was derived via `&raw const` from a
non-mut binding, but the `DrawGlyphRun` callback recovers that pointer
and writes through it, which is undefined behavior under Stacked/Tree
Borrows; the binding is now `mut` and the pointer is derived from `&raw
mut` so its provenance matches the write (codegen is unchanged).

On the DirectX side, the atlas upload is now bounded by the source slice
length so a mismatched destination region cannot read past the end of
the source, and the color-glyph staging texture is unmapped after
readback so the mapping is no longer leaked and the resource pinned. The
color-glyph rasterizer drives the shared, non-thread-safe D3D11
immediate context that `DirectXRenderer` and `DirectXAtlas` also use, so
it must stay on the main UI thread — which it always is today; a comment
documents that invariant.

Since gpui_windows is a Windows-only crate, it cannot be compiled on
non-Windows hosts, so Windows CI is the compile gate for these changes.

Release Notes:

- N/A
```

## Parents

- [715557fe51ce8baff5bef1259a1d2fe133d2b4f9](https://git.cafe/gitcafe/zed/commit/715557fe51ce8baff5bef1259a1d2fe133d2b4f9?format=markdown)

[Source at this commit](https://git.cafe/gitcafe/zed/tree/89e8a4b9ec7e0fa8a49987a3c1dbf29343dc6999?format=markdown)