Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 2dc5b8b5faa521a99e320d8ac9ae0a7a0ba2360e
https://github.com/WebKit/WebKit/commit/2dc5b8b5faa521a99e320d8ac9ae0a7a0ba2360e
Author: Alan Baradlay <[email protected]>
Date: 2026-07-07 (Tue, 07 Jul 2026)
Changed paths:
A
LayoutTests/fast/canvas/offscreen-canvas-measureText-unrealized-font-crash-expected.txt
A
LayoutTests/fast/canvas/offscreen-canvas-measureText-unrealized-font-crash.html
M Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp
Log Message:
-----------
CanvasRenderingContext2DBase::measureTextInternal: don't use the font proxy
before it is realized
https://bugs.webkit.org/show_bug.cgi?id=318824
rdar://181437552
Reviewed by Simon Fraser.
measureText() on a 2D canvas context calls into
CanvasRenderingContext2DBase::measureTextInternal(const TextRun&), which
obtained the FontProxy via fontProxy() and immediately called
metricsOfPrimaryFont()/width() on it without first checking that the font was
realized.
1. fontProxy() returns &state().font unconditionally after attempting
setFont(state().unparsedFont).
2. The font fails to realize (e.g. a font string that parses but resolves to an
empty family list), so state().font's underlying FontCascade::m_fonts stays
null.
3. metricsOfPrimaryFont() then reaches FontCascade::primaryFont(), which
dereferences the null m_fonts;
The draw path does not hit this because it is gated by canDrawText(), which
returns false when the font is not realized.
The measure path had no equivalent guard.
* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp:
(WebCore::CanvasRenderingContext2DBase::measureTextInternal):
*
LayoutTests/fast/canvas/offscreen-canvas-measureText-unrealized-font-crash.html:
Added.
*
LayoutTests/fast/canvas/offscreen-canvas-measureText-unrealized-font-crash-expected.txt:
Added.
Canonical link: https://commits.webkit.org/316690@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
