Title: [243483] trunk/Source/WebCore
- Revision
- 243483
- Author
- [email protected]
- Date
- 2019-03-25 20:34:43 -0700 (Mon, 25 Mar 2019)
Log Message
Leak of SVGFontFaceElement when RenderStyle holds onto a FontRances which uses it
https://bugs.webkit.org/show_bug.cgi?id=196059
Reviewed by Zalan Bujtas.
SVGFontFaceElement keeps its RenderStyle alive via ElementRareData but RenderStyle can hold onto FontRanges
and therefore CSSFontSource, which in turn keeps SVGFontFaceElement alive, making a reference cycle.
More precisely, there are two reference cycles:
SVGFontFaceElement (1) -> ElementRareData -> StyleInheritedData -> FontCascade -> FontCascadeFonts (2)
FontCascadeFonts (2) -> FontRanges (3)
FontCascadeFonts (2) -> CSSFontSelector -> CSSFontFaceSet -> CSSSegmentedFontFace -> FontRanges (3)
FontRanges (3) -> CSSFontAccessor > CSSFontFace > CSSFontSource -> SVGFontFaceElement (1)
No new tests. Unfortunately, writing a test proved to be intractable. The leak can be reproduced by running
svg/text/text-text-05-t.svg then svg/zoom/page/zoom-img-preserveAspectRatio-support-1.html consecutively.
* css/CSSFontFaceSource.cpp:
(WebCore::CSSFontFaceSource::CSSFontFaceSource):
(WebCore::CSSFontFaceSource::load):
(WebCore::CSSFontFaceSource::font):
(WebCore::CSSFontFaceSource::isSVGFontFaceSource const):
* css/CSSFontFaceSource.h:
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (243482 => 243483)
--- trunk/Source/WebCore/ChangeLog 2019-03-26 03:30:12 UTC (rev 243482)
+++ trunk/Source/WebCore/ChangeLog 2019-03-26 03:34:43 UTC (rev 243483)
@@ -1,3 +1,29 @@
+2019-03-20 Ryosuke Niwa <[email protected]>
+
+ Leak of SVGFontFaceElement when RenderStyle holds onto a FontRances which uses it
+ https://bugs.webkit.org/show_bug.cgi?id=196059
+
+ Reviewed by Zalan Bujtas.
+
+ SVGFontFaceElement keeps its RenderStyle alive via ElementRareData but RenderStyle can hold onto FontRanges
+ and therefore CSSFontSource, which in turn keeps SVGFontFaceElement alive, making a reference cycle.
+
+ More precisely, there are two reference cycles:
+ SVGFontFaceElement (1) -> ElementRareData -> StyleInheritedData -> FontCascade -> FontCascadeFonts (2)
+ FontCascadeFonts (2) -> FontRanges (3)
+ FontCascadeFonts (2) -> CSSFontSelector -> CSSFontFaceSet -> CSSSegmentedFontFace -> FontRanges (3)
+ FontRanges (3) -> CSSFontAccessor > CSSFontFace > CSSFontSource -> SVGFontFaceElement (1)
+
+ No new tests. Unfortunately, writing a test proved to be intractable. The leak can be reproduced by running
+ svg/text/text-text-05-t.svg then svg/zoom/page/zoom-img-preserveAspectRatio-support-1.html consecutively.
+
+ * css/CSSFontFaceSource.cpp:
+ (WebCore::CSSFontFaceSource::CSSFontFaceSource):
+ (WebCore::CSSFontFaceSource::load):
+ (WebCore::CSSFontFaceSource::font):
+ (WebCore::CSSFontFaceSource::isSVGFontFaceSource const):
+ * css/CSSFontFaceSource.h:
+
2019-03-25 Fujii Hironori <[email protected]>
Unreviewed, rolling out r243450.
Modified: trunk/Source/WebCore/css/CSSFontFaceSource.cpp (243482 => 243483)
--- trunk/Source/WebCore/css/CSSFontFaceSource.cpp 2019-03-26 03:30:12 UTC (rev 243482)
+++ trunk/Source/WebCore/css/CSSFontFaceSource.cpp 2019-03-26 03:34:43 UTC (rev 243483)
@@ -79,7 +79,8 @@
, m_face(owner)
, m_immediateSource(WTFMove(arrayBufferView))
#if ENABLE(SVG_FONTS)
- , m_svgFontFaceElement(fontFace)
+ , m_svgFontFaceElement(makeWeakPtr(fontFace))
+ , m_hasSVGFontFaceElement(m_svgFontFaceElement)
#endif
{
#if !ENABLE(SVG_FONTS)
@@ -154,8 +155,8 @@
} else {
bool success = false;
#if ENABLE(SVG_FONTS)
- if (m_svgFontFaceElement) {
- if (is<SVGFontElement>(m_svgFontFaceElement->parentNode())) {
+ if (m_hasSVGFontFaceElement) {
+ if (m_svgFontFaceElement && is<SVGFontElement>(m_svgFontFaceElement->parentNode())) {
ASSERT(!m_inDocumentCustomPlatformData);
SVGFontElement& fontElement = downcast<SVGFontElement>(*m_svgFontFaceElement->parentNode());
if (auto otfFont = convertSVGToOTFFont(fontElement))
@@ -195,12 +196,11 @@
{
ASSERT(status() == Status::Success);
- SVGFontFaceElement* fontFaceElement = nullptr;
#if ENABLE(SVG_FONTS)
- fontFaceElement = m_svgFontFaceElement.get();
+ bool usesInDocumentSVGFont = m_hasSVGFontFaceElement;
#endif
- if (!m_font && !fontFaceElement) {
+ if (!m_font && !usesInDocumentSVGFont) {
if (m_immediateSource) {
if (!m_immediateFontCustomPlatformData)
return nullptr;
@@ -222,12 +222,11 @@
return result;
}
- // In-Document SVG Fonts
- if (!fontFaceElement)
+ if (!usesInDocumentSVGFont)
return nullptr;
#if ENABLE(SVG_FONTS)
- if (!is<SVGFontElement>(m_svgFontFaceElement->parentNode()))
+ if (!m_svgFontFaceElement || !is<SVGFontElement>(m_svgFontFaceElement->parentNode()))
return nullptr;
if (!m_inDocumentCustomPlatformData)
return nullptr;
@@ -241,7 +240,7 @@
#if ENABLE(SVG_FONTS)
bool CSSFontFaceSource::isSVGFontFaceSource() const
{
- return m_svgFontFaceElement || is<CachedSVGFont>(m_font.get());
+ return m_hasSVGFontFaceElement || is<CachedSVGFont>(m_font.get());
}
#endif
Modified: trunk/Source/WebCore/css/CSSFontFaceSource.h (243482 => 243483)
--- trunk/Source/WebCore/css/CSSFontFaceSource.h 2019-03-26 03:30:12 UTC (rev 243482)
+++ trunk/Source/WebCore/css/CSSFontFaceSource.h 2019-03-26 03:34:43 UTC (rev 243483)
@@ -93,11 +93,14 @@
std::unique_ptr<FontCustomPlatformData> m_immediateFontCustomPlatformData;
#if ENABLE(SVG_FONTS)
- RefPtr<SVGFontFaceElement> m_svgFontFaceElement;
+ WeakPtr<SVGFontFaceElement> m_svgFontFaceElement;
#endif
std::unique_ptr<FontCustomPlatformData> m_inDocumentCustomPlatformData;
Status m_status { Status::Pending };
+#if ENABLE(SVG_FONTS)
+ bool m_hasSVGFontFaceElement;
+#endif
};
} // namespace WebCore
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
