Diff
Modified: releases/WebKitGTK/webkit-2.24/LayoutTests/ChangeLog (244017 => 244018)
--- releases/WebKitGTK/webkit-2.24/LayoutTests/ChangeLog 2019-04-08 12:39:58 UTC (rev 244017)
+++ releases/WebKitGTK/webkit-2.24/LayoutTests/ChangeLog 2019-04-08 12:40:04 UTC (rev 244018)
@@ -1,3 +1,13 @@
+2019-04-03 Myles C. Maxfield <[email protected]>
+
+ Documents can be destroyed before their CSSFontFaceSet is destroyed
+ https://bugs.webkit.org/show_bug.cgi?id=195830
+
+ Reviewed by Darin Adler.
+
+ * fast/text/font-face-set-destroy-document-expected.html: Added.
+ * fast/text/font-face-set-destroy-document.html: Added.
+
2019-03-26 Dean Jackson <[email protected]>
vertexAttribPointer must restrict offset parameter
Added: releases/WebKitGTK/webkit-2.24/LayoutTests/fast/text/font-face-set-destroy-document-expected.html (0 => 244018)
--- releases/WebKitGTK/webkit-2.24/LayoutTests/fast/text/font-face-set-destroy-document-expected.html (rev 0)
+++ releases/WebKitGTK/webkit-2.24/LayoutTests/fast/text/font-face-set-destroy-document-expected.html 2019-04-08 12:40:04 UTC (rev 244018)
@@ -0,0 +1,3 @@
+<html>
+This test makes sure FontFaceSets don't access deleted documents. The test passes if there is no crash when running under ASan.
+</html>
Added: releases/WebKitGTK/webkit-2.24/LayoutTests/fast/text/font-face-set-destroy-document.html (0 => 244018)
--- releases/WebKitGTK/webkit-2.24/LayoutTests/fast/text/font-face-set-destroy-document.html (rev 0)
+++ releases/WebKitGTK/webkit-2.24/LayoutTests/fast/text/font-face-set-destroy-document.html 2019-04-08 12:40:04 UTC (rev 244018)
@@ -0,0 +1,15 @@
+<html>
+This test makes sure FontFaceSets don't access deleted documents. The test passes if there is no crash when running under ASan.
+<script>
+
+d = document.implementation.createDocument(null, '');
+f = new FontFace('f', 'local(F)', {});
+ffs = d.fonts;
+delete d;
+// gc();
+GCController.collect();
+
+// trigger use after free
+ffs.add(f);
+</script>
+</html>
Modified: releases/WebKitGTK/webkit-2.24/Source/WebCore/ChangeLog (244017 => 244018)
--- releases/WebKitGTK/webkit-2.24/Source/WebCore/ChangeLog 2019-04-08 12:39:58 UTC (rev 244017)
+++ releases/WebKitGTK/webkit-2.24/Source/WebCore/ChangeLog 2019-04-08 12:40:04 UTC (rev 244018)
@@ -1,3 +1,30 @@
+2019-04-03 Myles C. Maxfield <[email protected]>
+
+ Documents can be destroyed before their CSSFontFaceSet is destroyed
+ https://bugs.webkit.org/show_bug.cgi?id=195830
+
+ Reviewed by Darin Adler.
+
+ CSSFontFaceSet has a raw pointer to its owning document. JS can keep the CSSFontFaceSet alive (by using FontFaceSet)
+ and can destroy the document at any time. When the document is destroyed, the link between the two objects needs to
+ be severed.
+
+ Test: fast/text/font-face-set-destroy-document.html
+
+ * css/CSSFontFace.cpp:
+ (WebCore::CSSFontFace::CSSFontFace):
+ * css/CSSFontFace.h:
+ * css/CSSFontFaceSet.cpp:
+ (WebCore::CSSFontFaceSet::CSSFontFaceSet):
+ (WebCore::CSSFontFaceSet::ensureLocalFontFacesForFamilyRegistered):
+ * css/CSSFontFaceSet.h:
+ * css/CSSFontSelector.cpp:
+ (WebCore::CSSFontSelector::CSSFontSelector):
+ (WebCore::CSSFontSelector::addFontFaceRule):
+ * css/CSSFontSelector.h:
+ * css/FontFace.cpp:
+ (WebCore::FontFace::FontFace):
+
2019-04-02 Ryosuke Niwa <[email protected]>
Crash in HTMLCanvasElement::createContext2d after the element got adopted to a new document
Modified: releases/WebKitGTK/webkit-2.24/Source/WebCore/css/CSSFontFace.h (244017 => 244018)
--- releases/WebKitGTK/webkit-2.24/Source/WebCore/css/CSSFontFace.h 2019-04-08 12:39:58 UTC (rev 244017)
+++ releases/WebKitGTK/webkit-2.24/Source/WebCore/css/CSSFontFace.h 2019-04-08 12:40:04 UTC (rev 244018)
@@ -189,7 +189,7 @@
FontLoadingBehavior m_loadingBehavior { FontLoadingBehavior::Auto };
Vector<std::unique_ptr<CSSFontFaceSource>, 0, CrashOnOverflow, 0> m_sources;
- RefPtr<CSSFontSelector> m_fontSelector;
+ RefPtr<CSSFontSelector> m_fontSelector; // FIXME: https://bugs.webkit.org/show_bug.cgi?id=196437 There's a retain cycle: CSSFontSelector -> CSSFontFaceSet -> CSSFontFace -> CSSFontSelector
RefPtr<StyleRuleFontFace> m_cssConnection;
HashSet<Client*> m_clients;
WeakPtr<FontFace> m_wrapper;
Modified: releases/WebKitGTK/webkit-2.24/Source/WebCore/css/CSSFontFaceSet.cpp (244017 => 244018)
--- releases/WebKitGTK/webkit-2.24/Source/WebCore/css/CSSFontFaceSet.cpp 2019-04-08 12:39:58 UTC (rev 244017)
+++ releases/WebKitGTK/webkit-2.24/Source/WebCore/css/CSSFontFaceSet.cpp 2019-04-08 12:40:04 UTC (rev 244018)
@@ -42,7 +42,7 @@
namespace WebCore {
CSSFontFaceSet::CSSFontFaceSet(CSSFontSelector* owningFontSelector)
- : m_owningFontSelector(owningFontSelector)
+ : m_owningFontSelector(makeWeakPtr(owningFontSelector))
{
}
@@ -113,7 +113,7 @@
Vector<Ref<CSSFontFace>> faces;
for (auto item : capabilities) {
- Ref<CSSFontFace> face = CSSFontFace::create(m_owningFontSelector, nullptr, nullptr, true);
+ Ref<CSSFontFace> face = CSSFontFace::create(m_owningFontSelector.get(), nullptr, nullptr, true);
Ref<CSSValueList> familyList = CSSValueList::createCommaSeparated();
familyList->append(CSSValuePool::singleton().createFontFamilyValue(familyName));
Modified: releases/WebKitGTK/webkit-2.24/Source/WebCore/css/CSSFontFaceSet.h (244017 => 244018)
--- releases/WebKitGTK/webkit-2.24/Source/WebCore/css/CSSFontFaceSet.h 2019-04-08 12:39:58 UTC (rev 244017)
+++ releases/WebKitGTK/webkit-2.24/Source/WebCore/css/CSSFontFaceSet.h 2019-04-08 12:40:04 UTC (rev 244018)
@@ -120,7 +120,7 @@
size_t m_facesPartitionIndex { 0 }; // All entries in m_faces before this index are CSS-connected.
Status m_status { Status::Loaded };
HashSet<CSSFontFaceSetClient*> m_clients;
- CSSFontSelector* m_owningFontSelector;
+ WeakPtr<CSSFontSelector> m_owningFontSelector;
unsigned m_activeCount { 0 };
};
Modified: releases/WebKitGTK/webkit-2.24/Source/WebCore/css/CSSFontSelector.h (244017 => 244018)
--- releases/WebKitGTK/webkit-2.24/Source/WebCore/css/CSSFontSelector.h 2019-04-08 12:39:58 UTC (rev 244017)
+++ releases/WebKitGTK/webkit-2.24/Source/WebCore/css/CSSFontSelector.h 2019-04-08 12:40:04 UTC (rev 244018)
@@ -47,7 +47,7 @@
class Document;
class StyleRuleFontFace;
-class CSSFontSelector final : public FontSelector, public CSSFontFaceSetClient {
+class CSSFontSelector final : public FontSelector, public CSSFontFaceSetClient, public CanMakeWeakPtr<CSSFontSelector> {
public:
static Ref<CSSFontSelector> create(Document& document)
{
