279478 2024-09-10 16:53:37 -0700 Make FontProxy RefCounted 2024-10-22 09:16:13 -0700 1 1 1 Unclassified WebKit Canvas WebKit Nightly Build Unspecified Unspecified NEW https://bugs.webkit.org/show_bug.cgi?id=279348 InRadar P2 Normal --- 1 sabouhallawa webkit-unassigned sabouhallawa webkit-bug-importer oldest_to_newest 2059130 0 sabouhallawa 2024-09-10 16:53:37 -0700 CanvasRenderingContext2DBase::drawTextUnchecked() gets a reference to state().fontProxy. If before using this reference, this function changes m_stateStack by calling save() or restore() this reference may be pointing to freed memory. This will happen when Vector::append reallocates the buffer of m_stateStack. Applying filter to the canvas requires save() and restore() to be called when switching the context target. 2060892 1 webkit-bug-importer 2024-09-17 16:54:15 -0700 <rdar://problem/136185867> 2069812 2 sabouhallawa 2024-10-22 09:16:13 -0700 When fixing this bug, please remove the FIXME comment in CanvasRenderingContext2DBase::drawTextUnchecked() and change the code such that it does not refetch the FontProxy after calling CanvasFilterContextSwitcher::create().