Changeset 277378 in webkit

Timestamp:

May 12, 2021, 10:58:17 AM (5 years ago)

Author:

svillar@igalia.com

Message:

ASSERTION FAILED: m_clients.contains(&client) in CSSFontFace::removeClient via CSSSegmentedFontFace::~CSSSegmentedFontFace()
​https://bugs.webkit.org/show_bug.cgi?id=223790

Reviewed by Ryosuke Niwa.

Source/WebCore:

CSSFontFace does not support adding the same client twice as it uses a HashSet to track them. This means that
it's a mistake to call removeClient() more than once. This could happen when specifying the same font
family more than once in a <font-face> element inside a svg container.

Test: fast/css/svg-font-face-duplicate-crash.html

• css/CSSFontFaceSet.cpp:

(WebCore::CSSFontFaceSet::fontFace): Skip duplicate CSSFontFace's when before calling appendFontFace().

LayoutTests:

• fast/css/svg-font-face-duplicate-crash-expected.txt: Added.
• fast/css/svg-font-face-duplicate-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/css/svg-font-face-duplicate-crash-expected.txt (added)
• LayoutTests/fast/css/svg-font-face-duplicate-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/css/CSSFontFaceSet.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-05-12  Sergio Villar Senin  <svillar@igalia.com>
+
+        ASSERTION FAILED: m_clients.contains(&client) in CSSFontFace::removeClient via CSSSegmentedFontFace::~CSSSegmentedFontFace()
+        https://bugs.webkit.org/show_bug.cgi?id=223790
+
+        Reviewed by Ryosuke Niwa.
+
+        * fast/css/svg-font-face-duplicate-crash-expected.txt: Added.
+        * fast/css/svg-font-face-duplicate-crash.html: Added.
+
 2021-05-12  Ryosuke Niwa  <rniwa@webkit.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-05-12  Sergio Villar Senin  <svillar@igalia.com>
+
+        ASSERTION FAILED: m_clients.contains(&client) in CSSFontFace::removeClient via CSSSegmentedFontFace::~CSSSegmentedFontFace()
+        https://bugs.webkit.org/show_bug.cgi?id=223790
+
+        Reviewed by Ryosuke Niwa.
+
+        CSSFontFace does not support adding the same client twice as it uses a HashSet to track them. This means that
+        it's a mistake to call removeClient() more than once. This could happen when specifying the same font
+        family more than once in a <font-face> element inside a svg container.
+
+        Test: fast/css/svg-font-face-duplicate-crash.html
+
+        * css/CSSFontFaceSet.cpp:
+        (WebCore::CSSFontFaceSet::fontFace): Skip duplicate CSSFontFace's when before calling appendFontFace().
+
 2021-05-12  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebCore/css/CSSFontFaceSet.cpp

@@ -511 +511 @@
             return false;
         });
-        for (auto& candidate : candidateFontFaces)
+        CSSFontFace* previousCandidate = nullptr;
+        for (auto& candidate : candidateFontFaces) {
+            if (&candidate.get() == previousCandidate)
+                continue;
+            previousCandidate = &candidate.get();
             face->appendFontFace(candidate.get());
+        }
     }