Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 64a55fd574c40d8fda92b4f114d2a2afb9f0ec71
https://github.com/WebKit/WebKit/commit/64a55fd574c40d8fda92b4f114d2a2afb9f0ec71
Author: Vitor Roriz <[email protected]>
Date: 2026-08-20 (Thu, 20 Aug 2026)
Changed paths:
A
LayoutTests/fast/text/font-face/css-font-face-setstatus-reentrancy-crash-expected.txt
A
LayoutTests/fast/text/font-face/css-font-face-setstatus-reentrancy-crash.html
M Source/WebCore/css/CSSFontFace.cpp
Log Message:
-----------
CSSFontFace::setStatus should commit m_status before notifying clients
https://bugs.webkit.org/show_bug.cgi?id=322233
rdar://185462848
Reviewed by Brent Fulgham.
Two clients implement fontStateChanged:
A: FontFace, backing new FontFace('A', 'local(Helvetica)'). It resolves the
face.loaded promise, so notifying it can run author script.
B: CSSFontFaceSet, backing document.fonts. It validates the transition it is
handed.
setStatus() passed the m_status member to each client and assigned newStatus
only
after the loop ended. Script run from A re-enters pump(), which still sees
Loading
and drives setStatus(Success) again, committing m_status. B, visited after that,
gets Success as its oldState and hits its assertion.
Committing m_status first gives every client the same pair and makes the nested
pump() skip a transition that is already done.
* Source/WebCore/css/CSSFontFace.cpp:
(WebCore::CSSFontFace::setStatus):
*
LayoutTests/fast/text/font-face/css-font-face-setstatus-reentrancy-crash.html:
Added.
*
LayoutTests/fast/text/font-face/css-font-face-setstatus-reentrancy-crash-expected.txt:
Added.
Canonical link: https://commits.webkit.org/319575@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
