fix(streaming/five): sfFont thread safety

Fixes #2157

code/components/gta-streaming-five/include/sfDefinitions.h

@@ -69,6 +69,9 @@ class GMemoryHeap
 	virtual void* Alloc(uint32_t size) = 0;
 	virtual void m_58() = 0;
 	virtual void Free(void* memory) = 0;
+
+	char pad_08[0xB8];
+	bool useLocks;
 };
 
 // Unification of GRefCountBase and GRefCountBaseNTS. Once the Scaleform bits
@@ -191,7 +194,9 @@ class GFxMovieRoot : public GRefCountBase
 	virtual void SetVariable(const char* path, const GFxValue& value, int type) = 0;
 
 public:
-	char pad_10[0xB8];
+	char pad_10[0x28];
+	GMemoryHeap *pHeap;
+	char pad_40[0x88];
 	GRectF VisibleFrameRect;
 };
 
@@ -394,5 +399,7 @@ class GFxSpriteDef : public GFxResource
 };
 
 #ifdef _DEBUG
+static_assert(offsetof(GFxMovieRoot, pHeap) == 56);
 static_assert(offsetof(GFxMovieRoot, VisibleFrameRect) == 200);
+static_assert(offsetof(GMemoryHeap, useLocks) == 192);
 #endif

code/components/gta-streaming-five/src/sfFontStuff.cpp

@@ -200,6 +200,14 @@ static void HandleEarlyLoading(TFn&& cb)
 				g_md = (GFxMovieDef*)* movieDefRef;
 				g_movie = (GFxMovieRoot*)movieRef;
 
+				// GH-2157: HandleSprite can be called from both MainThread and
+				// RenderThread simultaneously: ensure the heap is flagged to be
+				// thread-safe.
+				GMemoryHeap* heap = g_movie->pHeap;
+				if (!heap->useLocks)
+				{
+					heap->useLocks = true;
+				}
 				cb();
 			}
 		}
@@ -257,8 +265,12 @@ static LONG SafetyFilter(PEXCEPTION_POINTERS pointers)
 	return EXCEPTION_EXECUTE_HANDLER;
 }
 
+// GH-2157: Other methods used path into GASEnvironment/GlobalEnvironment bits
+// that are not thread-safe.
+static std::mutex g_handleSprite;
 static void HandleSprite(GFxResource* resource, GFxStyledText::HTMLImageTagInfo* imgTagInfo, uint64_t document, void* md, void* character)
 {
+	std::unique_lock _(g_handleSprite);
 	auto sprite = (GFxSpriteDef*)resource;
 
 	static uint32_t id = 0x1234;