Changeset 273512 in webkit

Timestamp:

Feb 25, 2021, 2:14:16 PM (6 years ago)

Author:

mmaxfield@apple.com

Message:

REGRESSION(r269957): Empty font names passed to canvas2d cause all text routines to crash
​https://bugs.webkit.org/show_bug.cgi?id=222402
<rdar://problem/72621268>

Reviewed by Darin Adler and Chris Lord.

Source/WebCore:

It looks like it was simply an oversight from that patch. If the font name is empty,
CanvasRenderingContext2D::setFont() will set the font object to one that doesn't have
its internal FontCascadeFonts pointer set.

Tests: fast/text/canvas-font-resolution-2.html

fast/text/canvas-font-resolution.html

• html/canvas/CanvasRenderingContext2D.cpp:

(WebCore::CanvasRenderingContext2D::setFont):

• html/canvas/CanvasRenderingContext2DBase.h:

(WebCore::CanvasRenderingContext2DBase::FontProxy::isPopulated const):

• style/StyleResolveForFontRaw.cpp:

(WebCore::Style::resolveForFontRaw):

LayoutTests:

• fast/text/canvas-font-resolution-2-expected.html: Added.
• fast/text/canvas-font-resolution-2.html: Added.
• fast/text/canvas-font-resolution-expected.txt: Added.
• fast/text/canvas-font-resolution.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/text/canvas-font-resolution-2-expected.html (added)
• LayoutTests/fast/text/canvas-font-resolution-2.html (added)
• LayoutTests/fast/text/canvas-font-resolution-expected.txt (added)
• LayoutTests/fast/text/canvas-font-resolution.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp (modified) (2 diffs)
• Source/WebCore/html/canvas/CanvasRenderingContext2DBase.h (modified) (1 diff)
• Source/WebCore/style/StyleResolveForFontRaw.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-02-25  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        REGRESSION(r269957): Empty font names passed to canvas2d cause all text routines to crash
+        https://bugs.webkit.org/show_bug.cgi?id=222402
+        <rdar://problem/72621268>
+
+        Reviewed by Darin Adler and Chris Lord.
+
+        * fast/text/canvas-font-resolution-2-expected.html: Added.
+        * fast/text/canvas-font-resolution-2.html: Added.
+        * fast/text/canvas-font-resolution-expected.txt: Added.
+        * fast/text/canvas-font-resolution.html: Added.
+
 2021-02-25  Amir Mark Jr  <amir_mark@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-02-25  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        REGRESSION(r269957): Empty font names passed to canvas2d cause all text routines to crash
+        https://bugs.webkit.org/show_bug.cgi?id=222402
+        <rdar://problem/72621268>
+
+        Reviewed by Darin Adler and Chris Lord.
+
+        It looks like it was simply an oversight from that patch. If the font name is empty,
+        CanvasRenderingContext2D::setFont() will set the font object to one that doesn't have
+        its internal FontCascadeFonts pointer set.
+
+        Tests: fast/text/canvas-font-resolution-2.html
+               fast/text/canvas-font-resolution.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setFont):
+        * html/canvas/CanvasRenderingContext2DBase.h:
+        (WebCore::CanvasRenderingContext2DBase::FontProxy::isPopulated const):
+        * style/StyleResolveForFontRaw.cpp:
+        (WebCore::Style::resolveForFontRaw):
+
 2021-02-25  Alex Christensen  <achristensen@webkit.org>
 

trunk/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp

@@ -113 +113 @@
         return;
 
-    // The parse succeeded.
-    String newFontSafeCopy(newFont); // Create a string copy since newFont can be deleted inside realizeSaves.
-    realizeSaves();
-    modifiableState().unparsedFont = newFontSafeCopy;
-
     // Map the <canvas> font into the text style. If the font uses keywords like larger/smaller, these will work
     // relative to the canvas.
@@ -132 +127 @@
     }
 
-    if (auto fontStyle = Style::resolveForFontRaw(*fontRaw, WTFMove(fontDescription), document))
-        modifiableState().font.initialize(document.fontSelector(), *fontStyle);
+    auto fontStyle = Style::resolveForFontRaw(*fontRaw, WTFMove(fontDescription), document);
+    if (!fontStyle)
+        return;
+
+    String newFontSafeCopy(newFont); // Create a string copy since newFont can be deleted inside realizeSaves.
+    realizeSaves();
+    modifiableState().unparsedFont = newFontSafeCopy;
+
+    modifiableState().font.initialize(document.fontSelector(), *fontStyle);
+    ASSERT(state().font.realized());
+    ASSERT(state().font.isPopulated());
 }
 

trunk/Source/WebCore/html/canvas/CanvasRenderingContext2DBase.h

@@ -242 +242 @@
         void drawBidiText(GraphicsContext&, const TextRun&, const FloatPoint&, FontCascade::CustomFontNotReadyAction) const;
 
+#if ASSERT_ENABLED
+        bool isPopulated() const { return m_font.fonts(); }
+#endif
+
     private:
         void update(FontSelector&);

trunk/Source/WebCore/style/StyleResolveForFontRaw.cpp

@@ -74 +74 @@
         switchOn(item, [&] (CSSValueID ident) {
             isGenericFamily = ident != CSSValueWebkitBody;
-            family = isGenericFamily ? CSSPropertyParserHelpers::genericFontFamilyFromValueID(ident)
-                : AtomString(document.settings().standardFontFamily());
+            family = isGenericFamily ? CSSPropertyParserHelpers::genericFontFamilyFromValueID(ident) : AtomString(document.settings().standardFontFamily());
         }, [&] (const String& familyString) {
             family = familyString;