<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>210911</bug_id>
          
          <creation_ts>2020-04-23 06:21:06 -0700</creation_ts>
          <short_desc>Nullptr crash in objc_msgSend under WebCore::genericFamily</short_desc>
          <delta_ts>2020-04-24 23:55:36 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>Text</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Antti Koivisto">koivisto</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>andersca</cc>
    
    <cc>darin</cc>
    
    <cc>ggaren</cc>
    
    <cc>mmaxfield</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1644748</commentid>
    <comment_count>0</comment_count>
    <who name="Antti Koivisto">koivisto</who>
    <bug_when>2020-04-23 06:21:06 -0700</bug_when>
    <thetext>Thread[0] EXC_BAD_ACCESS (SIGSEGV) (KERN_INVALID_ADDRESS at 0x0000000000000018)
[  0] 0x00007fff6fffbc1d libobjc.A.dylib`objc_msgSend + 29

     0x00007fff6fffbc0a:      jne 0x5c83               ; &lt;+131&gt;
     0x00007fff6fffbc0d:  movabsq $0x7ffffffffff8, %r10
     0x00007fff6fffbc17:     andq (%rdi), %r10
     0x00007fff6fffbc1a:     movq %rsi, %r11
 -&gt;  0x00007fff6fffbc1d:     andl 0x18(%r10), %r11d
     0x00007fff6fffbc21:     shlq $0x4, %r11
     0x00007fff6fffbc25:     addq 0x10(%r10), %r11
     0x00007fff6fffbc29:     cmpq (%r11), %rsi
     0x00007fff6fffbc2c:      jne 0x5c38               ; &lt;+56&gt;

[  1] 0x00007fff2f697d01 JavaScriptCore`WTF::String::String(__CFString const*) + 49 at StringCF.cpp:36:20
       32  	{
       33  	    if (!str)
       34  	        return;
       35  	
    -&gt; 36  	    CFIndex size = CFStringGetLength(str);
       37  	    if (size == 0)
       38  	        m_impl = StringImpl::empty();
       39  	    else {
       40  	        Vector&lt;LChar, 1024&gt; lcharBuffer(size);
    
[  2] 0x00007fff3cc506e3 WebCore`WebCore::genericFamily(WTF::String const&amp;, WTF::HashMap&lt;WTF::String, WTF::String, WTF::StringHash, WTF::HashTraits&lt;WTF::String&gt;, WTF::HashTraits&lt;WTF::String&gt; &gt;&amp;, __CFString const*) [inlined] void WTF::GenericHashTraits&lt;WTF::String&gt;::assignToEmpty&lt;WTF::String, __CFString const*&gt;(WTF::String&amp;, __CFString const*&amp;&amp;) + 7 at HashTraits.h:72:22
[  2] 0x00007fff3cc506dc WebCore`WebCore::genericFamily(WTF::String const&amp;, WTF::HashMap&lt;WTF::String, WTF::String, WTF::StringHash, WTF::HashTraits&lt;WTF::String&gt;, WTF::HashTraits&lt;WTF::String&gt; &gt;&amp;, __CFString const*) [inlined] void WTF::HashMapEnsureTranslator&lt;WTF::HashMap&lt;WTF::String, WTF::String, WTF::StringHash, WTF::HashTraits&lt;WTF::String&gt;, WTF::HashTraits&lt;WTF::String&gt; &gt;::KeyValuePairTraits, WTF::StringHash&gt;::translate&lt;WTF::KeyValuePair&lt;WTF::String, WTF::String&gt;, WTF::String const&amp;, WebCore::genericFamily(WTF::String const&amp;, WTF::HashMap&lt;WTF::String, WTF::String, WTF::StringHash, WTF::HashTraits&lt;WTF::String&gt;, WTF::HashTraits&lt;WTF::String&gt; &gt;&amp;, __CFString const*)::$_3&gt;(WTF::KeyValuePair&lt;WTF::String, WTF::String&gt;&amp;, WTF::String const&amp;, WebCore::genericFamily(WTF::String const&amp;, WTF::HashMap&lt;WTF::String, WTF::String, WTF::StringHash, WTF::HashTraits&lt;WTF::String&gt;, WTF::HashTraits&lt;WTF::String&gt; &gt;&amp;, __CFString const*)::$_3&amp;&amp;) + 144 at HashMap.h:220
[  2] 0x00007fff3cc5064c WebCore`WebCore::genericFamily(WTF::String const&amp;, WTF::HashMap&lt;WTF::String, WTF::String, WTF::StringHash, WTF::HashTraits&lt;WTF::String&gt;, WTF::HashTraits&lt;WTF::String&gt; &gt;&amp;, __CFString const*) [inlined] WTF::HashTableAddResult&lt;WTF::HashTableIterator&lt;WTF::String, WTF::KeyValuePair&lt;WTF::String, WTF::String&gt;, WTF::KeyValuePairKeyExtractor&lt;WTF::KeyValuePair&lt;WTF::String, WTF::String&gt; &gt;, WTF::StringHash, WTF::HashMap&lt;WTF::String, WTF::String, WTF::StringHash, WTF::HashTraits&lt;WTF::String&gt;, WTF::HashTraits&lt;WTF::String&gt; &gt;::KeyValuePairTraits, WTF::HashTraits&lt;WTF::String&gt; &gt; &gt; WTF::HashTable&lt;WTF::String, WTF::KeyValuePair&lt;WTF::String, WTF::String&gt;, WTF::KeyValuePairKeyExtractor&lt;WTF::KeyValuePair&lt;WTF::String, WTF::String&gt; &gt;, WTF::StringHash, WTF::HashMap&lt;WTF::String, WTF::String, WTF::StringHash, WTF::HashTraits&lt;WTF::String&gt;, WTF::HashTraits&lt;WTF::String&gt; &gt;::KeyValuePairTraits, WTF::HashTraits&lt;WTF::String&gt; &gt;::add&lt;WTF::HashMapEnsureTranslator&lt;WTF::HashMap&lt;WTF::String, WTF::String, WTF::StringHash, WTF::HashTraits&lt;WTF::String&gt;, WTF::HashTraits&lt;WTF::String&gt; &gt;::KeyValuePairTraits, WTF::StringHash&gt;, WTF::String const&amp;, WebCore::genericFamily(WTF::String const&amp;, WTF::HashMap&lt;WTF::String, WTF::String, WTF::StringHash, WTF::HashTraits&lt;WTF::String&gt;, WTF::HashTraits&lt;WTF::String&gt; &gt;&amp;, __CFString const*)::$_3&gt;(WTF::String const&amp;, WebCore::genericFamily(WTF::String const&amp;, WTF::HashMap&lt;WTF::String, WTF::String, WTF::StringHash, WTF::HashTraits&lt;WTF::String&gt;, WTF::HashTraits&lt;WTF::String&gt; &gt;&amp;, __CFString const*)::$_3&amp;&amp;) + 268 at HashTable.h:994
[  2] 0x00007fff3cc50540 WebCore`WebCore::genericFamily(WTF::String const&amp;, WTF::HashMap&lt;WTF::String, WTF::String, WTF::StringHash, WTF::HashTraits&lt;WTF::String&gt;, WTF::HashTraits&lt;WTF::String&gt; &gt;&amp;, __CFString const*) [inlined] WTF::HashTableAddResult&lt;WTF::HashTableIterator&lt;WTF::String, WTF::KeyValuePair&lt;WTF::String, WTF::String&gt;, WTF::KeyValuePairKeyExtractor&lt;WTF::KeyValuePair&lt;WTF::String, WTF::String&gt; &gt;, WTF::StringHash, WTF::HashMap&lt;WTF::String, WTF::String, WTF::StringHash, WTF::HashTraits&lt;WTF::String&gt;, WTF::HashTraits&lt;WTF::String&gt; &gt;::KeyValuePairTraits, WTF::HashTraits&lt;WTF::String&gt; &gt; &gt; WTF::HashMap&lt;WTF::String, WTF::String, WTF::StringHash, WTF::HashTraits&lt;WTF::String&gt;, WTF::HashTraits&lt;WTF::String&gt; &gt;::inlineEnsure&lt;WTF::String const&amp;, WebCore::genericFamily(WTF::String const&amp;, WTF::HashMap&lt;WTF::String, WTF::String, WTF::StringHash, WTF::HashTraits&lt;WTF::String&gt;, WTF::HashTraits&lt;WTF::String&gt; &gt;&amp;, __CFString const*)::$_3&gt;(WTF::String const&amp;, WebCore::genericFamily(WTF::String const&amp;, WTF::HashMap&lt;WTF::String, WTF::String, WTF::StringHash, WTF::HashTraits&lt;WTF::String&gt;, WTF::HashTraits&lt;WTF::String&gt; &gt;&amp;, __CFString const*)::$_3&amp;&amp;) at HashMap.h:367
[  2] 0x00007fff3cc50540 WebCore`WebCore::genericFamily(WTF::String const&amp;, WTF::HashMap&lt;WTF::String, WTF::String, WTF::StringHash, WTF::HashTraits&lt;WTF::String&gt;, WTF::HashTraits&lt;WTF::String&gt; &gt;&amp;, __CFString const*) [inlined] WTF::HashTableAddResult&lt;WTF::HashTableIterator&lt;WTF::String, WTF::KeyValuePair&lt;WTF::String, WTF::String&gt;, WTF::KeyValuePairKeyExtractor&lt;WTF::KeyValuePair&lt;WTF::String, WTF::String&gt; &gt;, WTF::StringHash, WTF::HashMap&lt;WTF::String, WTF::String, WTF::StringHash, WTF::HashTraits&lt;WTF::String&gt;, WTF::HashTraits&lt;WTF::String&gt; &gt;::KeyValuePairTraits, WTF::HashTraits&lt;WTF::String&gt; &gt; &gt; WTF::HashMap&lt;WTF::String, WTF::String, WTF::StringHash, WTF::HashTraits&lt;WTF::String&gt;, WTF::HashTraits&lt;WTF::String&gt; &gt;::ensure&lt;WebCore::genericFamily(WTF::String const&amp;, WTF::HashMap&lt;WTF::String, WTF::String, WTF::StringHash, WTF::HashTraits&lt;WTF::String&gt;, WTF::HashTraits&lt;WTF::String&gt; &gt;&amp;, __CFString const*)::$_3&gt;(WTF::String const&amp;, WebCore::genericFamily(WTF::String const&amp;, WTF::HashMap&lt;WTF::String, WTF::String, WTF::StringHash, WTF::HashTraits&lt;WTF::String&gt;, WTF::HashTraits&lt;WTF::String&gt; &gt;&amp;, __CFString const*)::$_3&amp;&amp;) at HashMap.h:423
[  2] 0x00007fff3cc50540 WebCore`WebCore::genericFamily(WTF::String const&amp;, WTF::HashMap&lt;WTF::String, WTF::String, WTF::StringHash, WTF::HashTraits&lt;WTF::String&gt;, WTF::HashTraits&lt;WTF::String&gt; &gt;&amp;, __CFString const*) + 32 at SystemFontDatabaseCoreText.cpp:251
[  3] 0x00007fff3cc4da08 WebCore`WebCore::FontDescription::platformResolveGenericFamily(UScriptCode, WTF::AtomString const&amp;, WTF::AtomString const&amp;) + 408 at SystemFontDatabaseCoreText.cpp:0:12
[  4] 0x00007fff3c414406 WebCore`WebCore::CSSFontSelector::fontRangesForFamily(WebCore::FontDescription const&amp;, WTF::AtomString const&amp;)::$_1::operator()() const [inlined] WebCore::resolveGenericFamily(WebCore::Document*, WebCore::FontDescription const&amp;, WTF::AtomString const&amp;) + 24 at CSSFontSelector.cpp:266:27
[  4] 0x00007fff3c4143ee WebCore`WebCore::CSSFontSelector::fontRangesForFamily(WebCore::FontDescription const&amp;, WTF::AtomString const&amp;)::$_1::operator()() const + 46 at CSSFontSelector.cpp:306
[  5] 0x00007fff3c414179 WebCore`WebCore::CSSFontSelector::fontRangesForFamily(WebCore::FontDescription const&amp;, WTF::AtomString const&amp;) + 281 at CSSFontSelector.cpp:322:9
[  6] 0x00007fff3cbd1392 WebCore`WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*) [inlined] WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_0::operator()(WTF::AtomString const&amp;) const + 62 at FontCascadeFonts.cpp:149:45
[  6] 0x00007fff3cbd1354 WebCore`WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*) [inlined] WTF::__multi_visitor_return_type&lt;WTF::Visitor&lt;WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_0, WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_1&gt;, WTF::Variant&lt;WTF::AtomString, WebCore::FontFamilySpecificationCoreText&gt; const&gt;::__type WTF::__visit_helper&lt;0ul, WTF::__index_sequence&lt;0l&gt; &gt;::__visit&lt;WTF::Visitor&lt;WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_0, WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_1&gt;, WTF::Variant&lt;WTF::AtomString, WebCore::FontFamilySpecificationCoreText&gt; const&gt;(WTF::Visitor&lt;WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_0, WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_1&gt;&amp;, WTF::Variant&lt;WTF::AtomString, WebCore::FontFamilySpecificationCoreText&gt; const&amp;) at Variant.h:1903
[  6] 0x00007fff3cbd1354 WebCore`WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*) [inlined] WTF::__multi_visitor_return_type&lt;WTF::Visitor&lt;WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_0, WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_1&gt;, WTF::Variant&lt;WTF::AtomString, WebCore::FontFamilySpecificationCoreText&gt; const&amp;&gt;::__type WTF::__visit_helper2&lt;0l, 1ul&gt;::__visit&lt;WTF::Visitor&lt;WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_0, WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_1&gt;, WTF::Variant&lt;WTF::AtomString, WebCore::FontFamilySpecificationCoreText&gt; const&amp;&gt;(WTF::Visitor&lt;WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_0, WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_1&gt;&amp;, WTF::Variant&lt;WTF::AtomString, WebCore::FontFamilySpecificationCoreText&gt; const&amp;) at Variant.h:1939
[  6] 0x00007fff3cbd1354 WebCore`WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*) [inlined] WTF::__multi_visitor_return_type&lt;WTF::Visitor&lt;WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_0, WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_1&gt;, WTF::Variant&lt;WTF::AtomString, WebCore::FontFamilySpecificationCoreText&gt; const&amp;&gt;::__type WTF::__visit_helper2&lt;1l, 1ul&gt;::__visit&lt;WTF::Visitor&lt;WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_0, WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_1&gt;, WTF::Variant&lt;WTF::AtomString, WebCore::FontFamilySpecificationCoreText&gt; const&amp;&gt;(WTF::Visitor&lt;WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_0, WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_1&gt;&amp;, WTF::Variant&lt;WTF::AtomString, WebCore::FontFamilySpecificationCoreText&gt; const&amp;) at Variant.h:1940
[  6] 0x00007fff3cbd1354 WebCore`WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*) [inlined] WTF::__multi_visitor_return_type&lt;WTF::Visitor&lt;WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_0, WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_1&gt;, WTF::Variant&lt;WTF::AtomString, WebCore::FontFamilySpecificationCoreText&gt; const&amp;&gt;::__type WTF::__visit_helper&lt;1ul, WTF::__index_sequence&lt;&gt; &gt;::__visit&lt;WTF::Visitor&lt;WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_0, WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_1&gt;, WTF::Variant&lt;WTF::AtomString, WebCore::FontFamilySpecificationCoreText&gt; const&amp;&gt;(WTF::Visitor&lt;WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_0, WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_1&gt;&amp;, WTF::Variant&lt;WTF::AtomString, WebCore::FontFamilySpecificationCoreText&gt; const&amp;) at Variant.h:1977
[  6] 0x00007fff3cbd1354 WebCore`WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*) [inlined] WTF::__multi_visitor_return_type&lt;WTF::Visitor&lt;WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_0, WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_1&gt;&amp;, WTF::Variant&lt;WTF::AtomString, WebCore::FontFamilySpecificationCoreText&gt; const&amp;&gt;::__type WTF::visit&lt;WTF::Visitor&lt;WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_0, WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_1&gt;&amp;, WTF::Variant&lt;WTF::AtomString, WebCore::FontFamilySpecificationCoreText&gt; const&amp;&gt;(WTF::Visitor&lt;WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_0, WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*)::$_1&gt;&amp;, WTF::Variant&lt;WTF::AtomString, WebCore::FontFamilySpecificationCoreText&gt; const&amp;) at Variant.h:1989
[  6] 0x00007fff3cbd1354 WebCore`WebCore::realizeNextFallback(WebCore::FontCascadeDescription const&amp;, unsigned int&amp;, WebCore::FontSelector*) + 180 at FontCascadeFonts.cpp:160
[  7] 0x00007fff3cbd0d8c WebCore`WebCore::FontCascadeFonts::realizeFallbackRangesAt(WebCore::FontCascadeDescription const&amp;, unsigned int) + 668 at FontCascadeFonts.cpp:186:22
[  8] 0x00007fff3b5420cf WebCore`WebCore::FontCascadeFonts::primaryFont(WebCore::FontCascadeDescription const&amp;) + 47 at FontCascadeFonts.h:130:31
[  9] 0x00007fff3c436dd3 WebCore`WebCore::CSSPrimitiveValue::equalForLengthResolution(WebCore::RenderStyle const&amp;, WebCore::RenderStyle const&amp;) [inlined] WebCore::FontCascade::primaryFont() const + 4 at FontCascade.h:339:21
[  9] 0x00007fff3c436dcf WebCore`WebCore::CSSPrimitiveValue::equalForLengthResolution(WebCore::RenderStyle const&amp;, WebCore::RenderStyle const&amp;) [inlined] WebCore::FontCascade::fontMetrics() const at FontCascade.h:151</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1644749</commentid>
    <comment_count>1</comment_count>
    <who name="Antti Koivisto">koivisto</who>
    <bug_when>2020-04-23 06:21:20 -0700</bug_when>
    <thetext>&lt;rdar://problem/61510208&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1644750</commentid>
    <comment_count>2</comment_count>
      <attachid>397335</attachid>
    <who name="Antti Koivisto">koivisto</who>
    <bug_when>2020-04-23 06:28:04 -0700</bug_when>
    <thetext>Created attachment 397335
patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1644976</commentid>
    <comment_count>3</comment_count>
      <attachid>397335</attachid>
    <who name="Anders Carlsson">andersca</who>
    <bug_when>2020-04-23 14:53:22 -0700</bug_when>
    <thetext>Comment on attachment 397335
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=397335&amp;action=review

&gt; Source/WebCore/platform/graphics/cocoa/SystemFontDatabaseCoreText.cpp:253
&gt; +        auto value = adoptCF(CTFontDescriptorCopyAttribute(descriptor.get(), kCTFontFamilyNameAttribute));

Can use dynamic_cf_cast here.

https://trac.webkit.org/browser/webkit/trunk/Source/WTF/wtf/cf/TypeCastsCF.h</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1645017</commentid>
    <comment_count>4</comment_count>
      <attachid>397335</attachid>
    <who name="Darin Adler">darin</who>
    <bug_when>2020-04-23 17:04:05 -0700</bug_when>
    <thetext>Comment on attachment 397335
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=397335&amp;action=review

&gt;&gt; Source/WebCore/platform/graphics/cocoa/SystemFontDatabaseCoreText.cpp:253
&gt;&gt; +        auto value = adoptCF(CTFontDescriptorCopyAttribute(descriptor.get(), kCTFontFamilyNameAttribute));
&gt; 
&gt; Can use dynamic_cf_cast here.
&gt; 
&gt; https://trac.webkit.org/browser/webkit/trunk/Source/WTF/wtf/cf/TypeCastsCF.h

Or checked_cf_cast, since we know what the type is supposed to be</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1645032</commentid>
    <comment_count>5</comment_count>
    <who name="Anders Carlsson">andersca</who>
    <bug_when>2020-04-23 17:50:47 -0700</bug_when>
    <thetext>(In reply to Darin Adler from comment #4)
&gt; Comment on attachment 397335 [details]
&gt; patch
&gt; 
&gt; View in context:
&gt; https://bugs.webkit.org/attachment.cgi?id=397335&amp;action=review
&gt; 
&gt; &gt;&gt; Source/WebCore/platform/graphics/cocoa/SystemFontDatabaseCoreText.cpp:253
&gt; &gt;&gt; +        auto value = adoptCF(CTFontDescriptorCopyAttribute(descriptor.get(), kCTFontFamilyNameAttribute));
&gt; &gt; 
&gt; &gt; Can use dynamic_cf_cast here.
&gt; &gt; 
&gt; &gt; https://trac.webkit.org/browser/webkit/trunk/Source/WTF/wtf/cf/TypeCastsCF.h
&gt; 
&gt; Or checked_cf_cast, since we know what the type is supposed to be

Wouldn&apos;t that just cause a different crash though?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1645052</commentid>
    <comment_count>6</comment_count>
      <attachid>397335</attachid>
    <who name="Darin Adler">darin</who>
    <bug_when>2020-04-23 18:34:42 -0700</bug_when>
    <thetext>Comment on attachment 397335
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=397335&amp;action=review

&gt;&gt;&gt;&gt; Source/WebCore/platform/graphics/cocoa/SystemFontDatabaseCoreText.cpp:253
&gt;&gt;&gt;&gt; +        auto value = adoptCF(CTFontDescriptorCopyAttribute(descriptor.get(), kCTFontFamilyNameAttribute));
&gt;&gt;&gt; 
&gt;&gt;&gt; Can use dynamic_cf_cast here.
&gt;&gt;&gt; 
&gt;&gt;&gt; https://trac.webkit.org/browser/webkit/trunk/Source/WTF/wtf/cf/TypeCastsCF.h
&gt;&gt; 
&gt;&gt; Or checked_cf_cast, since we know what the type is supposed to be
&gt; 
&gt; Wouldn&apos;t that just cause a different crash though?

I’m puzzled about which is correct; if it’s a programming error to have the wrong type, then checked_cf_cast seems with. If it’s not a programming mistake then dynamic_cf_cast is the right thing to use, but asserting is wrong. This patch does ASSERT_NOT_REACHED, so it’s like a third &quot;half bad&quot; case.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1645080</commentid>
    <comment_count>7</comment_count>
      <attachid>397424</attachid>
    <who name="Antti Koivisto">koivisto</who>
    <bug_when>2020-04-23 21:55:29 -0700</bug_when>
    <thetext>Created attachment 397424
patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1645200</commentid>
    <comment_count>8</comment_count>
    <who name="Anders Carlsson">andersca</who>
    <bug_when>2020-04-24 08:12:59 -0700</bug_when>
    <thetext>(In reply to Darin Adler from comment #6)
&gt; Comment on attachment 397335 [details]
&gt; patch
&gt; 
&gt; View in context:
&gt; https://bugs.webkit.org/attachment.cgi?id=397335&amp;action=review
&gt; 
&gt; &gt;&gt;&gt;&gt; Source/WebCore/platform/graphics/cocoa/SystemFontDatabaseCoreText.cpp:253
&gt; &gt;&gt;&gt;&gt; +        auto value = adoptCF(CTFontDescriptorCopyAttribute(descriptor.get(), kCTFontFamilyNameAttribute));
&gt; &gt;&gt;&gt; 
&gt; &gt;&gt;&gt; Can use dynamic_cf_cast here.
&gt; &gt;&gt;&gt; 
&gt; &gt;&gt;&gt; https://trac.webkit.org/browser/webkit/trunk/Source/WTF/wtf/cf/TypeCastsCF.h
&gt; &gt;&gt; 
&gt; &gt;&gt; Or checked_cf_cast, since we know what the type is supposed to be
&gt; &gt; 
&gt; &gt; Wouldn&apos;t that just cause a different crash though?
&gt; 
&gt; I’m puzzled about which is correct; if it’s a programming error to have the
&gt; wrong type, then checked_cf_cast seems with. If it’s not a programming
&gt; mistake then dynamic_cf_cast is the right thing to use, but asserting is
&gt; wrong. This patch does ASSERT_NOT_REACHED, so it’s like a third &quot;half bad&quot;
&gt; case.

Good point, I missed the ASSERT_NOT_REACHED in the original patch.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1645202</commentid>
    <comment_count>9</comment_count>
    <who name="Antti Koivisto">koivisto</who>
    <bug_when>2020-04-24 08:30:34 -0700</bug_when>
    <thetext> dynamic_cf_cast does have debug assert so it seems equivalent to my original patch:

    ASSERT_WITH_SECURITY_IMPLICATION(CFGetTypeID(object) == CFTypeTrait&lt;T&gt;::typeID());
    if (CFGetTypeID(object) != CFTypeTrait&lt;T&gt;::typeID())
        return nullptr;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1645208</commentid>
    <comment_count>10</comment_count>
      <attachid>397424</attachid>
    <who name="Geoffrey Garen">ggaren</who>
    <bug_when>2020-04-24 09:03:15 -0700</bug_when>
    <thetext>Comment on attachment 397424
patch

r=me

You could declare the lambda &quot;[&amp;]() -&gt; String&quot; to maintain the existing one-liner return. Not sure if we like being that fancy or not.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1645209</commentid>
    <comment_count>11</comment_count>
    <who name="Antti Koivisto">koivisto</who>
    <bug_when>2020-04-24 09:10:27 -0700</bug_when>
    <thetext>I had that when there were multiple returns but went back for simplicity.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1645211</commentid>
    <comment_count>12</comment_count>
    <who name="EWS">ews-feeder</who>
    <bug_when>2020-04-24 09:20:39 -0700</bug_when>
    <thetext>Committed r260646: &lt;https://trac.webkit.org/changeset/260646&gt;

All reviewed patches have been landed. Closing bug and clearing flags on attachment 397424.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1645235</commentid>
    <comment_count>13</comment_count>
    <who name="Darin Adler">darin</who>
    <bug_when>2020-04-24 10:02:02 -0700</bug_when>
    <thetext>(In reply to Antti Koivisto from comment #9)
&gt;  dynamic_cf_cast does have debug assert so it seems equivalent to my
&gt; original patch:
&gt; 
&gt;     ASSERT_WITH_SECURITY_IMPLICATION(CFGetTypeID(object) ==
&gt; CFTypeTrait&lt;T&gt;::typeID());
&gt;     if (CFGetTypeID(object) != CFTypeTrait&lt;T&gt;::typeID())
&gt;         return nullptr;

Don’t get me started, though. dynamic_cf_cast is the wrong name for a function if it asserts, because dynamic_cast and dyanmic_objc_cast don’t!</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1645545</commentid>
    <comment_count>14</comment_count>
    <who name="Antti Koivisto">koivisto</who>
    <bug_when>2020-04-24 23:55:36 -0700</bug_when>
    <thetext>Agreed, I was just confused with the claim that I had invented some third way of doing things.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>397335</attachid>
            <date>2020-04-23 06:28:04 -0700</date>
            <delta_ts>2020-04-23 21:55:29 -0700</delta_ts>
            <desc>patch</desc>
            <filename>generic-family-crash.patch</filename>
            <type>text/plain</type>
            <size>2033</size>
            <attacher name="Antti Koivisto">koivisto</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0No
YW5nZUxvZwppbmRleCBmNDZjY2Q5YmY1Ni4uNGMwNTVmYTdhZTkgMTAwNjQ0Ci0tLSBhL1NvdXJj
ZS9XZWJDb3JlL0NoYW5nZUxvZworKysgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKQEAgLTEs
MyArMSwxOCBAQAorMjAyMC0wNC0yMyAgQW50dGkgS29pdmlzdG8gIDxhbnR0aUBhcHBsZS5jb20+
CisKKyAgICAgICAgTnVsbHB0ciBjcmFzaCBpbiBvYmpjX21zZ1NlbmQgdW5kZXIgV2ViQ29yZTo6
Z2VuZXJpY0ZhbWlseQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5j
Z2k/aWQ9MjEwOTExCisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS82MTUxMDIwOD4KKworICAgICAg
ICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBTcGVjdWxhdGl2ZSBmaXgu
CisKKyAgICAgICAgKiBwbGF0Zm9ybS9ncmFwaGljcy9jb2NvYS9TeXN0ZW1Gb250RGF0YWJhc2VD
b3JlVGV4dC5jcHA6CisgICAgICAgIChXZWJDb3JlOjpnZW5lcmljRmFtaWx5KToKKworICAgICAg
ICBUZXN0IHRoYXQgQ1RGb250RGVzY3JpcHRvckNvcHlBdHRyaWJ1dGUgaXMgcmVhbGx5IHJldHVy
bmluZyBDRlN0cmluZ1JlZi4KKwogMjAyMC0wNC0yMyAgWW91ZW5uIEZhYmxldCAgPHlvdWVubkBh
cHBsZS5jb20+CiAKICAgICAgICAgZ2V0RGlzcGxheU1lZGlhIGlzIG5vdCByZXNwZWN0aW5nIGFz
cGVjdCByYXRpbyB3aXRoIG1heCBjb25zdHJhaW50cwpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNv
cmUvcGxhdGZvcm0vZ3JhcGhpY3MvY29jb2EvU3lzdGVtRm9udERhdGFiYXNlQ29yZVRleHQuY3Bw
IGIvU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3MvY29jb2EvU3lzdGVtRm9udERhdGFi
YXNlQ29yZVRleHQuY3BwCmluZGV4IDdlNTYzZThmNTRmLi5mOTBmM2JlMjZkYiAxMDA2NDQKLS0t
IGEvU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3MvY29jb2EvU3lzdGVtRm9udERhdGFi
YXNlQ29yZVRleHQuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL2Nv
Y29hL1N5c3RlbUZvbnREYXRhYmFzZUNvcmVUZXh0LmNwcApAQCAtMjQ4LDkgKzI0OCwxNiBAQCBW
ZWN0b3I8UmV0YWluUHRyPENURm9udERlc2NyaXB0b3JSZWY+PiBTeXN0ZW1Gb250RGF0YWJhc2VD
b3JlVGV4dDo6Y2FzY2FkZUxpc3QoYwogCiBzdGF0aWMgU3RyaW5nIGdlbmVyaWNGYW1pbHkoY29u
c3QgU3RyaW5nJiBsb2NhbGUsIEhhc2hNYXA8U3RyaW5nLCBTdHJpbmc+JiBtYXAsIENGU3RyaW5n
UmVmIGN0S2V5KQogewotICAgIHJldHVybiBtYXAuZW5zdXJlKGxvY2FsZSwgWyZdIHsKKyAgICBy
ZXR1cm4gbWFwLmVuc3VyZShsb2NhbGUsIFsmXSgpIC0+IFN0cmluZyB7CiAgICAgICAgIGF1dG8g
ZGVzY3JpcHRvciA9IGFkb3B0Q0YoQ1RGb250RGVzY3JpcHRvckNyZWF0ZUZvckNTU0ZhbWlseShj
dEtleSwgbG9jYWxlLmNyZWF0ZUNGU3RyaW5nKCkuZ2V0KCkpKTsKLSAgICAgICAgcmV0dXJuIGFk
b3B0Q0Yoc3RhdGljX2Nhc3Q8Q0ZTdHJpbmdSZWY+KENURm9udERlc2NyaXB0b3JDb3B5QXR0cmli
dXRlKGRlc2NyaXB0b3IuZ2V0KCksIGtDVEZvbnRGYW1pbHlOYW1lQXR0cmlidXRlKSkpLmdldCgp
OworICAgICAgICBhdXRvIHZhbHVlID0gYWRvcHRDRihDVEZvbnREZXNjcmlwdG9yQ29weUF0dHJp
YnV0ZShkZXNjcmlwdG9yLmdldCgpLCBrQ1RGb250RmFtaWx5TmFtZUF0dHJpYnV0ZSkpOworICAg
ICAgICBpZiAoIXZhbHVlKQorICAgICAgICAgICAgcmV0dXJuIHsgfTsKKyAgICAgICAgaWYgKENG
R2V0VHlwZUlEKHZhbHVlLmdldCgpKSAhPSBDRlN0cmluZ0dldFR5cGVJRCgpKSB7CisgICAgICAg
ICAgICBBU1NFUlRfTk9UX1JFQUNIRUQoKTsKKyAgICAgICAgICAgIHJldHVybiB7IH07CisgICAg
ICAgIH0KKyAgICAgICAgcmV0dXJuIHsgc3RhdGljX2Nhc3Q8Q0ZTdHJpbmdSZWY+KHZhbHVlLmdl
dCgpKSB9OwogICAgIH0pLml0ZXJhdG9yLT52YWx1ZTsKIH0KIAo=
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>397424</attachid>
            <date>2020-04-23 21:55:29 -0700</date>
            <delta_ts>2020-04-24 09:20:39 -0700</delta_ts>
            <desc>patch</desc>
            <filename>generic-family-crash-2.patch</filename>
            <type>text/plain</type>
            <size>1954</size>
            <attacher name="Antti Koivisto">koivisto</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0No
YW5nZUxvZwppbmRleCBmNDZjY2Q5YmY1Ni4uNTQ5MmNhZGQzMTYgMTAwNjQ0Ci0tLSBhL1NvdXJj
ZS9XZWJDb3JlL0NoYW5nZUxvZworKysgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKQEAgLTEs
MyArMSwxOSBAQAorMjAyMC0wNC0yMyAgQW50dGkgS29pdmlzdG8gIDxhbnR0aUBhcHBsZS5jb20+
CisKKyAgICAgICAgTnVsbHB0ciBjcmFzaCBpbiBvYmpjX21zZ1NlbmQgdW5kZXIgV2ViQ29yZTo6
Z2VuZXJpY0ZhbWlseQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5j
Z2k/aWQ9MjEwOTExCisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS82MTUxMDIwOD4KKworICAgICAg
ICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBTcGVjdWxhdGl2ZSBmaXgu
CisKKyAgICAgICAgKiBwbGF0Zm9ybS9ncmFwaGljcy9jb2NvYS9TeXN0ZW1Gb250RGF0YWJhc2VD
b3JlVGV4dC5jcHA6CisgICAgICAgIChXZWJDb3JlOjpnZW5lcmljRmFtaWx5KToKKworICAgICAg
ICBUZXN0IHRoYXQgQ1RGb250RGVzY3JpcHRvckNvcHlBdHRyaWJ1dGUgaXMgcmVhbGx5IHJldHVy
bmluZyBDRlN0cmluZ1JlZi4KKyAgICAgICAgQWxzbyBleHBsaWNpdGx5IHJldHVybiBTdHJpbmcg
ZnJvbSBsYW1iZGEgdG8gY2xhcmlmeSBsaWZldGltZXMuCisKIDIwMjAtMDQtMjMgIFlvdWVubiBG
YWJsZXQgIDx5b3Vlbm5AYXBwbGUuY29tPgogCiAgICAgICAgIGdldERpc3BsYXlNZWRpYSBpcyBu
b3QgcmVzcGVjdGluZyBhc3BlY3QgcmF0aW8gd2l0aCBtYXggY29uc3RyYWludHMKZGlmZiAtLWdp
dCBhL1NvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL2NvY29hL1N5c3RlbUZvbnREYXRh
YmFzZUNvcmVUZXh0LmNwcCBiL1NvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL2NvY29h
L1N5c3RlbUZvbnREYXRhYmFzZUNvcmVUZXh0LmNwcAppbmRleCA3ZTU2M2U4ZjU0Zi4uY2M0ZTJi
YzQ0NmYgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL2NvY29h
L1N5c3RlbUZvbnREYXRhYmFzZUNvcmVUZXh0LmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9wbGF0
Zm9ybS9ncmFwaGljcy9jb2NvYS9TeXN0ZW1Gb250RGF0YWJhc2VDb3JlVGV4dC5jcHAKQEAgLTI4
LDYgKzI4LDcgQEAKIAogI2luY2x1ZGUgIkZvbnRDYWNoZS5oIgogI2luY2x1ZGUgIkZvbnRDYXNj
YWRlRGVzY3JpcHRpb24uaCIKKyNpbmNsdWRlIDx3dGYvY2YvVHlwZUNhc3RzQ0YuaD4KIAogI2lm
IFBMQVRGT1JNKElPU19GQU1JTFkpCiAjaW5jbHVkZSAiUmVuZGVyVGhlbWVJT1MuaCIKQEAgLTI1
MCw3ICsyNTEsOCBAQCBzdGF0aWMgU3RyaW5nIGdlbmVyaWNGYW1pbHkoY29uc3QgU3RyaW5nJiBs
b2NhbGUsIEhhc2hNYXA8U3RyaW5nLCBTdHJpbmc+JiBtYXAsCiB7CiAgICAgcmV0dXJuIG1hcC5l
bnN1cmUobG9jYWxlLCBbJl0gewogICAgICAgICBhdXRvIGRlc2NyaXB0b3IgPSBhZG9wdENGKENU
Rm9udERlc2NyaXB0b3JDcmVhdGVGb3JDU1NGYW1pbHkoY3RLZXksIGxvY2FsZS5jcmVhdGVDRlN0
cmluZygpLmdldCgpKSk7Ci0gICAgICAgIHJldHVybiBhZG9wdENGKHN0YXRpY19jYXN0PENGU3Ry
aW5nUmVmPihDVEZvbnREZXNjcmlwdG9yQ29weUF0dHJpYnV0ZShkZXNjcmlwdG9yLmdldCgpLCBr
Q1RGb250RmFtaWx5TmFtZUF0dHJpYnV0ZSkpKS5nZXQoKTsKKyAgICAgICAgYXV0byB2YWx1ZSA9
IGFkb3B0Q0YoZHluYW1pY19jZl9jYXN0PENGU3RyaW5nUmVmPihDVEZvbnREZXNjcmlwdG9yQ29w
eUF0dHJpYnV0ZShkZXNjcmlwdG9yLmdldCgpLCBrQ1RGb250RmFtaWx5TmFtZUF0dHJpYnV0ZSkp
KTsKKyAgICAgICAgcmV0dXJuIFN0cmluZyB7IHZhbHVlLmdldCgpIH07CiAgICAgfSkuaXRlcmF0
b3ItPnZhbHVlOwogfQogCg==
</data>

          </attachment>
      

    </bug>

</bugzilla>