Changeset 245190 in webkit

Timestamp:

May 10, 2019, 1:10:59 PM (7 years ago)

Author:

Brent Fulgham

Message:

Gracefully handle inaccessible font face data
​https://bugs.webkit.org/show_bug.cgi?id=197762
<rdar://problem/50433861>

Reviewed by Per Arne Vollan.

Make sure CSS Font Face handling gracefully recovers from
missing font data.

Test: fast/text/missing-font-crash.html

• css/CSSFontFace.cpp:

(WebCore::CSSFontFace::fontLoadEventOccurred):
(WebCore::CSSFontFace::timeoutFired):
(WebCore::CSSFontFace::fontLoaded):
(WebCore::CSSFontFace::font):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• css/CSSFontFace.cpp (modified) (5 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-05-10  Brent Fulgham  <bfulgham@apple.com>
+
+        Gracefully handle inaccessible font face data
+        https://bugs.webkit.org/show_bug.cgi?id=197762
+        <rdar://problem/50433861>
+
+        Reviewed by Per Arne Vollan.
+
+        Make sure CSS Font Face handling gracefully recovers from
+        missing font data.
+
+        Test: fast/text/missing-font-crash.html
+
+        * css/CSSFontFace.cpp:
+        (WebCore::CSSFontFace::fontLoadEventOccurred):
+        (WebCore::CSSFontFace::timeoutFired):
+        (WebCore::CSSFontFace::fontLoaded):
+        (WebCore::CSSFontFace::font):
+
 2019-05-10  Simon Fraser  <simon.fraser@apple.com>
 

trunk/Source/WebCore/css/CSSFontFace.cpp

@@ -1 +1 @@
 /*
- * Copyright (C) 2007, 2008, 2011, 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2007-2019 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -474 +474 @@
 void CSSFontFace::fontLoadEventOccurred()
 {
-    Ref<CSSFontFace> protectedThis(*this);
-
     // If the font is already in the cache, CSSFontFaceSource may report it's loaded before it is added here as a source.
     // Let's not pump the state machine until we've got all our sources. font() and load() are smart enough to act correctly
@@ -492 +490 @@
 void CSSFontFace::timeoutFired()
 {
+    Ref<CSSFontFace> protectedThis(*this);
+    
     switch (status()) {
     case Status::Loading:
@@ -685 +685 @@
 void CSSFontFace::fontLoaded(CSSFontFaceSource&)
 {
+    Ref<CSSFontFace> protectedThis(*this);
+    
     fontLoadEventOccurred();
 }
@@ -784 +786 @@
         return nullptr;
 
+    Ref<CSSFontFace> protectedThis(*this);
+    
     // Our status is derived from the first non-failed source. However, this source may
     // return null from font(), which means we need to continue looping through the remainder