Diff
Modified: branches/safari-612.1.5-branch/LayoutTests/ChangeLog (273797 => 273798)
--- branches/safari-612.1.5-branch/LayoutTests/ChangeLog 2021-03-03 03:08:58 UTC (rev 273797)
+++ branches/safari-612.1.5-branch/LayoutTests/ChangeLog 2021-03-03 03:09:02 UTC (rev 273798)
@@ -1,5 +1,54 @@
2021-03-02 Alan Coon <[email protected]>
+ Cherry-pick r273512. rdar://problem/74953022
+
+ REGRESSION(r269957): Empty font names passed to canvas2d cause all text routines to crash
+ https://bugs.webkit.org/show_bug.cgi?id=222402
+ <rdar://problem/72621268>
+
+ Reviewed by Darin Adler and Chris Lord.
+
+ Source/WebCore:
+
+ It looks like it was simply an oversight from that patch. If the font name is empty,
+ CanvasRenderingContext2D::setFont() will set the font object to one that doesn't have
+ its internal FontCascadeFonts pointer set.
+
+ Tests: fast/text/canvas-font-resolution-2.html
+ fast/text/canvas-font-resolution.html
+
+ * html/canvas/CanvasRenderingContext2D.cpp:
+ (WebCore::CanvasRenderingContext2D::setFont):
+ * html/canvas/CanvasRenderingContext2DBase.h:
+ (WebCore::CanvasRenderingContext2DBase::FontProxy::isPopulated const):
+ * style/StyleResolveForFontRaw.cpp:
+ (WebCore::Style::resolveForFontRaw):
+
+ LayoutTests:
+
+ * fast/text/canvas-font-resolution-2-expected.html: Added.
+ * fast/text/canvas-font-resolution-2.html: Added.
+ * fast/text/canvas-font-resolution-expected.txt: Added.
+ * fast/text/canvas-font-resolution.html: Added.
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@273512 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2021-02-25 Myles C. Maxfield <[email protected]>
+
+ REGRESSION(r269957): Empty font names passed to canvas2d cause all text routines to crash
+ https://bugs.webkit.org/show_bug.cgi?id=222402
+ <rdar://problem/72621268>
+
+ Reviewed by Darin Adler and Chris Lord.
+
+ * fast/text/canvas-font-resolution-2-expected.html: Added.
+ * fast/text/canvas-font-resolution-2.html: Added.
+ * fast/text/canvas-font-resolution-expected.txt: Added.
+ * fast/text/canvas-font-resolution.html: Added.
+
+2021-03-02 Alan Coon <[email protected]>
+
Cherry-pick r273438. rdar://problem/74953033
Regression(r268700) postMessage changes prototype of basic types
Added: branches/safari-612.1.5-branch/LayoutTests/fast/text/canvas-font-resolution-2-expected.html (0 => 273798)
--- branches/safari-612.1.5-branch/LayoutTests/fast/text/canvas-font-resolution-2-expected.html (rev 0)
+++ branches/safari-612.1.5-branch/LayoutTests/fast/text/canvas-font-resolution-2-expected.html 2021-03-03 03:09:02 UTC (rev 273798)
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+This test makes sure that canvas2d's text functions don't crash when passed unexpected font strings.
+The test passes if you see "Hello" in Helvetica, followed by "Hello" in Times.
+<div><canvas id="c" width="400" height="400"></canvas></div>
+<script>
+var context = document.getElementById("c").getContext("2d");
+context.font = "32px 'Helvetica'";
+context.fillText("Hello", 0, 100);
+context.font = "32px 'Times'";
+context.fillText("Hello", 0, 200);
+</script>
+</body>
+</html>
+</script>
+</body>
+</html>
Added: branches/safari-612.1.5-branch/LayoutTests/fast/text/canvas-font-resolution-2.html (0 => 273798)
--- branches/safari-612.1.5-branch/LayoutTests/fast/text/canvas-font-resolution-2.html (rev 0)
+++ branches/safari-612.1.5-branch/LayoutTests/fast/text/canvas-font-resolution-2.html 2021-03-03 03:09:02 UTC (rev 273798)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+This test makes sure that canvas2d's text functions don't crash when passed unexpected font strings.
+The test passes if you see "Hello" in Helvetica, followed by "Hello" in Times.
+<div><canvas id="c" width="400" height="400"></canvas></div>
+<script>
+var context = document.getElementById("c").getContext("2d");
+context.font = "32px 'Helvetica'";
+context.font = "32px ''";
+context.fillText("Hello", 0, 100);
+context.font = "32px 'Times'";
+context.font = "32px ''";
+context.fillText("Hello", 0, 200);
+</script>
+</body>
+</html>
+</script>
+</body>
+</html>
Added: branches/safari-612.1.5-branch/LayoutTests/fast/text/canvas-font-resolution-expected.txt (0 => 273798)
--- branches/safari-612.1.5-branch/LayoutTests/fast/text/canvas-font-resolution-expected.txt (rev 0)
+++ branches/safari-612.1.5-branch/LayoutTests/fast/text/canvas-font-resolution-expected.txt 2021-03-03 03:09:02 UTC (rev 273798)
@@ -0,0 +1 @@
+This test makes sure that canvas2d's text functions don't crash when passed unexpected font strings. The test passes if there is no crash.
Added: branches/safari-612.1.5-branch/LayoutTests/fast/text/canvas-font-resolution.html (0 => 273798)
--- branches/safari-612.1.5-branch/LayoutTests/fast/text/canvas-font-resolution.html (rev 0)
+++ branches/safari-612.1.5-branch/LayoutTests/fast/text/canvas-font-resolution.html 2021-03-03 03:09:02 UTC (rev 273798)
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+This test makes sure that canvas2d's text functions don't crash when passed unexpected font strings.
+The test passes if there is no crash.
+<canvas id="c" width="20" height="20"></canvas>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+var context = document.getElementById("c").getContext("2d");
+context.font = "100px ''";
+context.measureText("hello");
+context.font = "100px 'initial'";
+context.measureText("hello");
+context.font = "100px 'inherit'";
+context.measureText("hello");
+context.font = "100px 'revert'";
+context.measureText("hello");
+context.font = "100px 'thisisnotarealfontname'";
+context.measureText("hello");
+context.font = "100px '~~~~~~~~'";
+context.measureText("hello");
+context.font = "100px '~~~~~~~~'";
+context.measureText("hello");
+context.font = "100px '\u0660'";
+context.measureText("hello");
+context.font = "~~~~~";
+context.measureText("hello");
+</script>
+</body>
+</html>
+</script>
+</body>
+</html>
Modified: branches/safari-612.1.5-branch/Source/WebCore/ChangeLog (273797 => 273798)
--- branches/safari-612.1.5-branch/Source/WebCore/ChangeLog 2021-03-03 03:08:58 UTC (rev 273797)
+++ branches/safari-612.1.5-branch/Source/WebCore/ChangeLog 2021-03-03 03:09:02 UTC (rev 273798)
@@ -1,5 +1,63 @@
2021-03-02 Alan Coon <[email protected]>
+ Cherry-pick r273512. rdar://problem/74953022
+
+ REGRESSION(r269957): Empty font names passed to canvas2d cause all text routines to crash
+ https://bugs.webkit.org/show_bug.cgi?id=222402
+ <rdar://problem/72621268>
+
+ Reviewed by Darin Adler and Chris Lord.
+
+ Source/WebCore:
+
+ It looks like it was simply an oversight from that patch. If the font name is empty,
+ CanvasRenderingContext2D::setFont() will set the font object to one that doesn't have
+ its internal FontCascadeFonts pointer set.
+
+ Tests: fast/text/canvas-font-resolution-2.html
+ fast/text/canvas-font-resolution.html
+
+ * html/canvas/CanvasRenderingContext2D.cpp:
+ (WebCore::CanvasRenderingContext2D::setFont):
+ * html/canvas/CanvasRenderingContext2DBase.h:
+ (WebCore::CanvasRenderingContext2DBase::FontProxy::isPopulated const):
+ * style/StyleResolveForFontRaw.cpp:
+ (WebCore::Style::resolveForFontRaw):
+
+ LayoutTests:
+
+ * fast/text/canvas-font-resolution-2-expected.html: Added.
+ * fast/text/canvas-font-resolution-2.html: Added.
+ * fast/text/canvas-font-resolution-expected.txt: Added.
+ * fast/text/canvas-font-resolution.html: Added.
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@273512 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2021-02-25 Myles C. Maxfield <[email protected]>
+
+ REGRESSION(r269957): Empty font names passed to canvas2d cause all text routines to crash
+ https://bugs.webkit.org/show_bug.cgi?id=222402
+ <rdar://problem/72621268>
+
+ Reviewed by Darin Adler and Chris Lord.
+
+ It looks like it was simply an oversight from that patch. If the font name is empty,
+ CanvasRenderingContext2D::setFont() will set the font object to one that doesn't have
+ its internal FontCascadeFonts pointer set.
+
+ Tests: fast/text/canvas-font-resolution-2.html
+ fast/text/canvas-font-resolution.html
+
+ * html/canvas/CanvasRenderingContext2D.cpp:
+ (WebCore::CanvasRenderingContext2D::setFont):
+ * html/canvas/CanvasRenderingContext2DBase.h:
+ (WebCore::CanvasRenderingContext2DBase::FontProxy::isPopulated const):
+ * style/StyleResolveForFontRaw.cpp:
+ (WebCore::Style::resolveForFontRaw):
+
+2021-03-02 Alan Coon <[email protected]>
+
Cherry-pick r273499. rdar://problem/74952752
Avoid setting page muted state if unchanged
Modified: branches/safari-612.1.5-branch/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp (273797 => 273798)
--- branches/safari-612.1.5-branch/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp 2021-03-03 03:08:58 UTC (rev 273797)
+++ branches/safari-612.1.5-branch/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp 2021-03-03 03:09:02 UTC (rev 273798)
@@ -112,11 +112,6 @@
if (!fontRaw)
return;
- // The parse succeeded.
- String newFontSafeCopy(newFont); // Create a string copy since newFont can be deleted inside realizeSaves.
- realizeSaves();
- modifiableState().unparsedFont = newFontSafeCopy;
-
// Map the <canvas> font into the text style. If the font uses keywords like larger/smaller, these will work
// relative to the canvas.
Document& document = canvas().document();
@@ -131,8 +126,17 @@
fontDescription.setComputedSize(DefaultFontSize);
}
- if (auto fontStyle = Style::resolveForFontRaw(*fontRaw, WTFMove(fontDescription), document))
- modifiableState().font.initialize(document.fontSelector(), *fontStyle);
+ auto fontStyle = Style::resolveForFontRaw(*fontRaw, WTFMove(fontDescription), document);
+ if (!fontStyle)
+ return;
+
+ String newFontSafeCopy(newFont); // Create a string copy since newFont can be deleted inside realizeSaves.
+ realizeSaves();
+ modifiableState().unparsedFont = newFontSafeCopy;
+
+ modifiableState().font.initialize(document.fontSelector(), *fontStyle);
+ ASSERT(state().font.realized());
+ ASSERT(state().font.isPopulated());
}
inline TextDirection CanvasRenderingContext2D::toTextDirection(Direction direction, const RenderStyle** computedStyle) const
Modified: branches/safari-612.1.5-branch/Source/WebCore/html/canvas/CanvasRenderingContext2DBase.h (273797 => 273798)
--- branches/safari-612.1.5-branch/Source/WebCore/html/canvas/CanvasRenderingContext2DBase.h 2021-03-03 03:08:58 UTC (rev 273797)
+++ branches/safari-612.1.5-branch/Source/WebCore/html/canvas/CanvasRenderingContext2DBase.h 2021-03-03 03:09:02 UTC (rev 273798)
@@ -241,6 +241,10 @@
float width(const TextRun&, GlyphOverflow* = 0) const;
void drawBidiText(GraphicsContext&, const TextRun&, const FloatPoint&, FontCascade::CustomFontNotReadyAction) const;
+#if ASSERT_ENABLED
+ bool isPopulated() const { return m_font.fonts(); }
+#endif
+
private:
void update(FontSelector&);
void fontsNeedUpdate(FontSelector&) override;
Modified: branches/safari-612.1.5-branch/Source/WebCore/style/StyleResolveForFontRaw.cpp (273797 => 273798)
--- branches/safari-612.1.5-branch/Source/WebCore/style/StyleResolveForFontRaw.cpp 2021-03-03 03:08:58 UTC (rev 273797)
+++ branches/safari-612.1.5-branch/Source/WebCore/style/StyleResolveForFontRaw.cpp 2021-03-03 03:09:02 UTC (rev 273798)
@@ -73,8 +73,7 @@
bool isGenericFamily = false;
switchOn(item, [&] (CSSValueID ident) {
isGenericFamily = ident != CSSValueWebkitBody;
- family = isGenericFamily ? CSSPropertyParserHelpers::genericFontFamilyFromValueID(ident)
- : AtomString(document.settings().standardFontFamily());
+ family = isGenericFamily ? CSSPropertyParserHelpers::genericFontFamilyFromValueID(ident) : AtomString(document.settings().standardFontFamily());
}, [&] (const String& familyString) {
family = familyString;
});
