--- a/jdk/src/share/classes/sun/font/FileFont.java	Sat Jan 28 22:47:07 2012 -0800
+++ b/jdk/src/share/classes/sun/font/FileFont.java	Fri Feb 03 09:57:45 2012 -0800
@@ -163,7 +163,9 @@
                 }
             }
         }
-        scaler.dispose();
+        if (scaler != null) {
+            scaler.dispose();
+        }
         scaler = FontScaler.getNullScaler();
     }
 

--- a/jdk/src/share/classes/sun/font/StandardGlyphVector.java	Sat Jan 28 22:47:07 2012 -0800
+++ b/jdk/src/share/classes/sun/font/StandardGlyphVector.java	Fri Feb 03 09:57:45 2012 -0800
@@ -1740,8 +1740,9 @@
                                                      tx,
                                                      sgv.font.getStyle(),
                                                      aa, fm);
-
-            FontStrike strike = sgv.font2D.getStrike(desc);  // !!! getStrike(desc, false)
+            // Get the strike via the handle. Shouldn't matter
+            // if we've invalidated the font but its an extra precaution.
+            FontStrike strike = sgv.font2D.handle.font2D.getStrike(desc);  // !!! getStrike(desc, false)
 
             return new GlyphStrike(sgv, strike, dx, dy);
         }

--- a/jdk/src/share/classes/sun/font/SunFontManager.java	Sat Jan 28 22:47:07 2012 -0800
+++ b/jdk/src/share/classes/sun/font/SunFontManager.java	Fri Feb 03 09:57:45 2012 -0800
@@ -2619,6 +2619,9 @@
         physicalFonts.remove(oldFont.fullName);
         fullNameToFont.remove(oldFont.fullName.toLowerCase(Locale.ENGLISH));
         FontFamily.remove(oldFont);
+        if (oldFont instanceof FileFont) {
+            ((FileFont)oldFont).deregisterFontAndClearStrikeCache();
+        }
 
         if (localeFullNamesToFont != null) {
             Map.Entry[] mapEntries =

--- a/jdk/src/share/classes/sun/font/TrueTypeFont.java	Sat Jan 28 22:47:07 2012 -0800
+++ b/jdk/src/share/classes/sun/font/TrueTypeFont.java	Fri Feb 03 09:57:45 2012 -0800
@@ -1037,6 +1037,9 @@
             if (head_Table != null && head_Table.capacity() >= 18) {
                 ShortBuffer sb = head_Table.asShortBuffer();
                 upem = sb.get(9) & 0xffff;
+                if (upem < 16 || upem > 16384) {
+                    upem = 2048;
+                }
             }
 
             ByteBuffer os2_Table = getTableBuffer(os_2Tag);