Changeset 52174 in webkit

Timestamp:

Dec 15, 2009, 2:12:50 PM (15 years ago)

Author:

mitz@apple.com

Message:

<rdar://problem/7470452> Safari/Chromium crashes on complicated @font-face rule
​https://bugs.webkit.org/show_bug.cgi?id=32257

Reviewed by Darin Adler.

WebCore:

Test: fast/css/font-face-unused-source-loaded.html

The loading of a font resource caused a CSSFontFace that had the resource in one of its
sources, but wasn’t using it (due to using an earlier source) to invalidate its
CSSSegmentedFontFaces. This caused FontData for the active source (the one that did not just
finish loading) to be deleted, but that went unnoticed by Font::operator==(), since the
corresponding FontFallbackLists were not in the loading state. The fix is for CSSFontFace to
ignore loads from unused sources.

• css/CSSFontFace.cpp:

(WebCore::CSSFontFace::fontLoaded): Bail out if the loaded source is not the active source.
(WebCore::CSSFontFace::getFontData): Set m_activeSource to the source that supplied the

FontData.

• css/CSSFontFace.h:

(WebCore::CSSFontFace::CSSFontFace): Initialize m_activeSource.

LayoutTests:

• fast/css/font-face-unused-source-loaded-expected.txt: Added.
• fast/css/font-face-unused-source-loaded.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/css/font-face-unused-source-loaded-expected.txt (added)
• LayoutTests/fast/css/font-face-unused-source-loaded.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/css/CSSFontFace.cpp (modified) (2 diffs)
• WebCore/css/CSSFontFace.h (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2009-12-15  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7470452> Safari/Chromium crashes on complicated @font-face rule
+        https://bugs.webkit.org/show_bug.cgi?id=32257
+
+        * fast/css/font-face-unused-source-loaded-expected.txt: Added.
+        * fast/css/font-face-unused-source-loaded.html: Added.
+
 2009-12-15  Kenneth Russell  <kbr@google.com>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2009-12-15  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7470452> Safari/Chromium crashes on complicated @font-face rule
+        https://bugs.webkit.org/show_bug.cgi?id=32257
+
+        Test: fast/css/font-face-unused-source-loaded.html
+
+        The loading of a font resource caused a CSSFontFace that had the resource in one of its
+        sources, but wasn’t using it (due to using an earlier source) to invalidate its
+        CSSSegmentedFontFaces. This caused FontData for the active source (the one that did not just
+        finish loading) to be deleted, but that went unnoticed by Font::operator==(), since the
+        corresponding FontFallbackLists were not in the loading state. The fix is for CSSFontFace to
+        ignore loads from unused sources.
+
+        * css/CSSFontFace.cpp:
+        (WebCore::CSSFontFace::fontLoaded): Bail out if the loaded source is not the active source.
+        (WebCore::CSSFontFace::getFontData): Set m_activeSource to the source that supplied the
+            FontData.
+        * css/CSSFontFace.h:
+        (WebCore::CSSFontFace::CSSFontFace): Initialize m_activeSource.
+
 2009-12-15  Yael Aharon  <yael.aharon@nokia.com>
 

trunk/WebCore/css/CSSFontFace.cpp

@@ -78 +78 @@
 }
 
-void CSSFontFace::fontLoaded(CSSFontFaceSource*)
+void CSSFontFace::fontLoaded(CSSFontFaceSource* source)
 {
+    if (source != m_activeSource)
+        return;
+
     // FIXME: Can we assert that m_segmentedFontFaces is not empty? That may
     // require stopping in-progress font loading when the last
@@ -98 +101 @@
 SimpleFontData* CSSFontFace::getFontData(const FontDescription& fontDescription, bool syntheticBold, bool syntheticItalic)
 {
+    m_activeSource = 0;
     if (!isValid())
         return 0;
-        
+
     ASSERT(!m_segmentedFontFaces.isEmpty());
     CSSFontSelector* fontSelector = (*m_segmentedFontFaces.begin())->fontSelector();
 
-    SimpleFontData* result = 0;
-    unsigned size = m_sources.size();
-    for (unsigned i = 0; i < size && !result; i++)
-        result = m_sources[i]->getFontData(fontDescription, syntheticBold, syntheticItalic, fontSelector);
-    return result;
+    size_t size = m_sources.size();
+    for (size_t i = 0; i < size; ++i) {
+        if (SimpleFontData* result = m_sources[i]->getFontData(fontDescription, syntheticBold, syntheticItalic, fontSelector)) {
+            m_activeSource = m_sources[i];
+            return result;
+        }
+    }
+
+    return 0;
 }
 

trunk/WebCore/css/CSSFontFace.h

@@ -83 +83 @@
     CSSFontFace(FontTraitsMask traitsMask)
         : m_traitsMask(traitsMask)
+        , m_activeSource(0)
     {
     }
@@ -90 +91 @@
     HashSet<CSSSegmentedFontFace*> m_segmentedFontFaces;
     Vector<CSSFontFaceSource*> m_sources;
+    CSSFontFaceSource* m_activeSource;
 };