nephele
/
haikuwebkit
1
0
Fork 0
Code Issues Releases Activity
haikuwebkit/LayoutTests/fast/text/font-face-set-destroy-docum...

4 lines
143 B
HTML
Raw Permalink Normal View History

Documents can be destroyed before their CSSFontFaceSet is destroyed https://bugs.webkit.org/show_bug.cgi?id=195830 Reviewed by Darin Adler. Source/WebCore: CSSFontFaceSet has a raw pointer to its owning document. JS can keep the CSSFontFaceSet alive (by using FontFaceSet) and can destroy the document at any time. When the document is destroyed, the link between the two objects needs to be severed. Test: fast/text/font-face-set-destroy-document.html * css/CSSFontFace.cpp: (WebCore::CSSFontFace::CSSFontFace): * css/CSSFontFace.h: * css/CSSFontFaceSet.cpp: (WebCore::CSSFontFaceSet::CSSFontFaceSet): (WebCore::CSSFontFaceSet::ensureLocalFontFacesForFamilyRegistered): * css/CSSFontFaceSet.h: * css/CSSFontSelector.cpp: (WebCore::CSSFontSelector::CSSFontSelector): (WebCore::CSSFontSelector::addFontFaceRule): * css/CSSFontSelector.h: * css/FontFace.cpp: (WebCore::FontFace::FontFace): LayoutTests: * fast/text/font-face-set-destroy-document-expected.html: Added. * fast/text/font-face-set-destroy-document.html: Added. Canonical link: https://commits.webkit.org/210824@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243828 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2019-04-03 21:46:55 +00:00
<html>
This test makes sure FontFaceSets don't access deleted documents. The test passes if there is no crash when running under ASan.
</html>