Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 53bedf3f8f4d917e3f0b4d95d91c139252075e5f
https://github.com/WebKit/WebKit/commit/53bedf3f8f4d917e3f0b4d95d91c139252075e5f
Author: Kristian Monsen <[email protected]>
Date: 2026-08-05 (Wed, 05 Aug 2026)
Changed paths:
A LayoutTests/fast/text/text-spacing-trim-null-font-crash-expected.txt
A LayoutTests/fast/text/text-spacing-trim-null-font-crash.html
M Source/WebCore/platform/graphics/WidthIterator.cpp
Log Message:
-----------
Crash in WidthIterator::applyTextSpacingTrimIfNeeded when a character has no
glyph in any font
https://bugs.webkit.org/show_bug.cgi?id=321023
rdar://183317081
Reviewed by Vitor Roriz.
glyphDataForCharacter() can legitimately return a GlyphData with a null font (a
SingleThreadWeakPtr<const Font>) whenever no font — including every fallback —
has a glyph for the
character, which happens for code points like U+001F that no installed font
maps. applyTextSpacingTrimIfNeeded() didn't account for that case: it
unconditionally did
*protect(glyphData.font) to pass the font by reference into
getHalfWidthFontIfNeeded(), dereferencing a null RefPtr and crashing.
The fix adds a !glyphData.font check alongside the existing isSpaceAll() early
return, so the function bails out before dereferencing when there's no font to
consult. This mirrors
how the equivalent code in ComplexTextController.cpp already guards the same
lookup with nextFont && before touching it — this path is now consistent with
that sibling
implementation. Since a glyph-less character has no font whose text-spacing
metrics could apply anyway, skipping the trim logic in that case is correct
behavior, not just a crash
guard.
Test: fast/text/text-spacing-trim-null-font-crash.html
* LayoutTests/fast/text/text-spacing-trim-null-font-crash-expected.txt: Added.
* LayoutTests/fast/text/text-spacing-trim-null-font-crash.html: Added.
* Source/WebCore/platform/graphics/WidthIterator.cpp:
(WebCore::applyTextSpacingTrimIfNeeded):
Canonical link: https://commits.webkit.org/318619@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
