⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 244018 in webkit


Ignore:
Timestamp:
Apr 8, 2019, 5:40:04 AM (7 years ago)
Author:
Carlos Garcia Campos
Message:

Merge r243828 - Documents can be destroyed before their CSSFontFaceSet is destroyed
​https://bugs.webkit.org/show_bug.cgi?id=195830

Reviewed by Darin Adler.

Source/WebCore:

CSSFontFaceSet has a raw pointer to its owning document. JS can keep the CSSFontFaceSet alive (by using FontFaceSet)
and can destroy the document at any time. When the document is destroyed, the link between the two objects needs to
be severed.

Test: fast/text/font-face-set-destroy-document.html

  • css/CSSFontFace.cpp:

(WebCore::CSSFontFace::CSSFontFace):

  • css/CSSFontFace.h:
  • css/CSSFontFaceSet.cpp:

(WebCore::CSSFontFaceSet::CSSFontFaceSet):
(WebCore::CSSFontFaceSet::ensureLocalFontFacesForFamilyRegistered):

  • css/CSSFontFaceSet.h:
  • css/CSSFontSelector.cpp:

(WebCore::CSSFontSelector::CSSFontSelector):
(WebCore::CSSFontSelector::addFontFaceRule):

  • css/CSSFontSelector.h:
  • css/FontFace.cpp:

(WebCore::FontFace::FontFace):

LayoutTests:

  • fast/text/font-face-set-destroy-document-expected.html: Added.
  • fast/text/font-face-set-destroy-document.html: Added.
Location:
releases/WebKitGTK/webkit-2.24
Files:
2 added
6 edited

Legend:

Unmodified
Added
Removed

  • releases/WebKitGTK/webkit-2.24/LayoutTests/ChangeLog

    r244015 r244018  
     12019-04-03  Myles C. Maxfield  <mmaxfield@apple.com>
     2
     3        Documents can be destroyed before their CSSFontFaceSet is destroyed
     4        https://bugs.webkit.org/show_bug.cgi?id=195830
     5
     6        Reviewed by Darin Adler.
     7
     8        * fast/text/font-face-set-destroy-document-expected.html: Added.
     9        * fast/text/font-face-set-destroy-document.html: Added.
     10
    1112019-03-26  Dean Jackson  <dino@apple.com>
    212

  • releases/WebKitGTK/webkit-2.24/Source/WebCore/ChangeLog

    r244017 r244018  
     12019-04-03  Myles C. Maxfield  <mmaxfield@apple.com>
     2
     3        Documents can be destroyed before their CSSFontFaceSet is destroyed
     4        https://bugs.webkit.org/show_bug.cgi?id=195830
     5
     6        Reviewed by Darin Adler.
     7
     8        CSSFontFaceSet has a raw pointer to its owning document. JS can keep the CSSFontFaceSet alive (by using FontFaceSet)
     9        and can destroy the document at any time. When the document is destroyed, the link between the two objects needs to
     10        be severed.
     11
     12        Test: fast/text/font-face-set-destroy-document.html
     13
     14        * css/CSSFontFace.cpp:
     15        (WebCore::CSSFontFace::CSSFontFace):
     16        * css/CSSFontFace.h:
     17        * css/CSSFontFaceSet.cpp:
     18        (WebCore::CSSFontFaceSet::CSSFontFaceSet):
     19        (WebCore::CSSFontFaceSet::ensureLocalFontFacesForFamilyRegistered):
     20        * css/CSSFontFaceSet.h:
     21        * css/CSSFontSelector.cpp:
     22        (WebCore::CSSFontSelector::CSSFontSelector):
     23        (WebCore::CSSFontSelector::addFontFaceRule):
     24        * css/CSSFontSelector.h:
     25        * css/FontFace.cpp:
     26        (WebCore::FontFace::FontFace):
     27
    1282019-04-02  Ryosuke Niwa  <rniwa@webkit.org>
    229

  • releases/WebKitGTK/webkit-2.24/Source/WebCore/css/CSSFontFace.h

    r233648 r244018  
    190190
    191191    Vector<std::unique_ptr<CSSFontFaceSource>, 0, CrashOnOverflow, 0> m_sources;
    192     RefPtr<CSSFontSelector> m_fontSelector;
     192    RefPtr<CSSFontSelector> m_fontSelector; // FIXME: https://bugs.webkit.org/show_bug.cgi?id=196437 There's a retain cycle: CSSFontSelector -> CSSFontFaceSet -> CSSFontFace -> CSSFontSelector
    193193    RefPtr<StyleRuleFontFace> m_cssConnection;
    194194    HashSet<Client*> m_clients;

  • releases/WebKitGTK/webkit-2.24/Source/WebCore/css/CSSFontFaceSet.cpp

    r238222 r244018  
    4343
    4444CSSFontFaceSet::CSSFontFaceSet(CSSFontSelector* owningFontSelector)
    45     : m_owningFontSelector(owningFontSelector)
     45    : m_owningFontSelector(makeWeakPtr(owningFontSelector))
    4646{
    4747}
    … …  
    114114    Vector<Ref<CSSFontFace>> faces;
    115115    for (auto item : capabilities) {
    116         Ref<CSSFontFace> face = CSSFontFace::create(m_owningFontSelector, nullptr, nullptr, true);
     116        Ref<CSSFontFace> face = CSSFontFace::create(m_owningFontSelector.get(), nullptr, nullptr, true);
    117117       
    118118        Ref<CSSValueList> familyList = CSSValueList::createCommaSeparated();

  • releases/WebKitGTK/webkit-2.24/Source/WebCore/css/CSSFontFaceSet.h

    r239427 r244018  
    121121    Status m_status { Status::Loaded };
    122122    HashSet<CSSFontFaceSetClient*> m_clients;
    123     CSSFontSelector* m_owningFontSelector;
     123    WeakPtr<CSSFontSelector> m_owningFontSelector;
    124124    unsigned m_activeCount { 0 };
    125125};

  • releases/WebKitGTK/webkit-2.24/Source/WebCore/css/CSSFontSelector.h

    r226930 r244018  
    4848class StyleRuleFontFace;
    4949
    50 class CSSFontSelector final : public FontSelector, public CSSFontFaceSetClient {
     50class CSSFontSelector final : public FontSelector, public CSSFontFaceSetClient, public CanMakeWeakPtr<CSSFontSelector> {
    5151public:
    5252    static Ref<CSSFontSelector> create(Document& document)
Note: See TracChangeset for help on using the changeset viewer.