ASSERTION FAILED: !m_valueOrException under FontFaceSet::completedLoading loading...
authormmaxfield@apple.com <mmaxfield@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 13 Sep 2017 00:13:01 +0000 (00:13 +0000)
committermmaxfield@apple.com <mmaxfield@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 13 Sep 2017 00:13:01 +0000 (00:13 +0000)
https://bugs.webkit.org/show_bug.cgi?id=175899

Reviewed by Tim Horton.

Source/WebCore:

Slight style update to r221835. Also adds a test.

Test: fast/text/document-fonts-while-loading-crash.html

* css/CSSFontFaceSet.h:
* css/FontFaceSet.cpp:
(WebCore::FontFaceSet::FontFaceSet):

LayoutTests:

* fast/text/document-fonts-while-loading-crash-expected.txt: Added.
* fast/text/document-fonts-while-loading-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@221948 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/text/document-fonts-while-loading-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/text/document-fonts-while-loading-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/css/CSSFontFaceSet.h
Source/WebCore/css/FontFaceSet.cpp

index dd7ae2e..816b90b 100644 (file)
@@ -1,3 +1,13 @@
+2017-09-12  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        ASSERTION FAILED: !m_valueOrException under FontFaceSet::completedLoading loading a Serious Eats page
+        https://bugs.webkit.org/show_bug.cgi?id=175899
+
+        Reviewed by Tim Horton.
+
+        * fast/text/document-fonts-while-loading-crash-expected.txt: Added.
+        * fast/text/document-fonts-while-loading-crash.html: Added.
+
 2017-09-12  Ryosuke Niwa  <rniwa@webkit.org>
 
         Dragging & dropping a file creates an attachment element even when it's disabled
diff --git a/LayoutTests/fast/text/document-fonts-while-loading-crash-expected.txt b/LayoutTests/fast/text/document-fonts-while-loading-crash-expected.txt
new file mode 100644 (file)
index 0000000..e22bd9c
--- /dev/null
@@ -0,0 +1,7 @@
+This test passes if there is no ASSERT in debug mode. This happens when:
+No one uses the CSS Font Loading API
+A font starts loading
+Someone uses the CSS Font Loading API, causing us to create Javascript wrappers for our internal objects
+The font finishes loading
+The bug occurs when the wrappers do not correctly understand that there are in-flight loads already happening.
+Hello
diff --git a/LayoutTests/fast/text/document-fonts-while-loading-crash.html b/LayoutTests/fast/text/document-fonts-while-loading-crash.html
new file mode 100644 (file)
index 0000000..1695eed
--- /dev/null
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+if (window.internals) {
+    internals.invalidateFontCache();
+    internals.clearMemoryCache();
+}
+if (window.testRunner) {
+    testRunner.waitUntilDone();
+    testRunner.dumpAsText();
+}
+</script>
+<style>
+@font-face {
+    font-family: "WebFont";
+    src: url("../../resources/Ahem.otf") format("opentype");
+}
+</style>
+</head>
+<body>
+This test passes if there is no ASSERT in debug mode. This happens when:
+<ol>
+<li>No one uses the CSS Font Loading API</li>
+<li>A font starts loading</li>
+<li>Someone uses the CSS Font Loading API, causing us to create Javascript wrappers for our internal objects</li>
+<li>The font finishes loading</li>
+</ol>
+The bug occurs when the wrappers do not correctly understand that there are in-flight loads already happening.
+<div style="font-family: 'WebFont';">Hello</div>
+<script>
+document.body.offsetTop; // Force layout, which starts fonts loading
+document.fonts.ready.then(function() {
+    if (window.testRunner)
+        testRunner.notifyDone();
+});
+</script>
+</body>
+</html>
index ee6c94c..462daae 100644 (file)
@@ -1,5 +1,20 @@
 2017-09-12  Myles C. Maxfield  <mmaxfield@apple.com>
 
+        ASSERTION FAILED: !m_valueOrException under FontFaceSet::completedLoading loading a Serious Eats page
+        https://bugs.webkit.org/show_bug.cgi?id=175899
+
+        Reviewed by Tim Horton.
+
+        Slight style update to r221835. Also adds a test.
+
+        Test: fast/text/document-fonts-while-loading-crash.html
+
+        * css/CSSFontFaceSet.h:
+        * css/FontFaceSet.cpp:
+        (WebCore::FontFaceSet::FontFaceSet):
+
+2017-09-12  Myles C. Maxfield  <mmaxfield@apple.com>
+
         Inline ParserUtilities.h
         https://bugs.webkit.org/show_bug.cgi?id=176572
 
index a6d608e..b63ba6b 100644 (file)
@@ -73,6 +73,8 @@ public:
     enum class Status { Loading, Loaded };
     Status status() const { return m_status; }
 
+    bool hasActiveFontFaces() { return status() == Status::Loading; }
+
     ExceptionOr<Vector<std::reference_wrapper<CSSFontFace>>> matchingFaces(const String& font, const String& text);
 
     // CSSFontFace::Client needs to be able to be held in a RefPtr.
index 582a03e..e219e2b 100644 (file)
@@ -63,9 +63,9 @@ FontFaceSet::FontFaceSet(Document& document, CSSFontFaceSet& backing)
     , m_backing(backing)
     , m_readyPromise(*this, &FontFaceSet::readyPromiseResolve)
 {
-    m_backing->addClient(*this);
-    if (m_backing->status() == CSSFontFaceSet::Status::Loaded)
+    if (!backing.hasActiveFontFaces())
         m_readyPromise.resolve(*this);
+    m_backing->addClient(*this);
 }
 
 FontFaceSet::~FontFaceSet()