55597 2011-03-02 11:43:49 -0800 Arbitrary script execution during style recalc due to SVG font instantiation firing pending image load events 2018-11-19 21:45:47 -0800 1 1 1 Unclassified WebKit New Bugs 528+ (Nightly build) All All NEW https://bugs.webkit.org/show_bug.cgi?id=136269 InRadar P2 Normal --- 1 mitz webkit-unassigned ap rniwa simon.fraser zalan oldest_to_newest 360947 0 mitz 2011-03-02 11:43:49 -0800 During style recalc (or attach()), CachedFont::ensureSVGFontData() can be called, and in turn call into Document::setContent(). That does an implicitClose() which calls ImageLoader::dispatchPendingLoadEvents(), which dispatches an arbitrary set of event and can cause arbitrary script execution and re-entry into style and layout code. 360950 1 mitz 2011-03-02 11:45:09 -0800 <rdar://problem/9076006> 1480374 2 rniwa 2018-11-19 21:45:47 -0800 Some aspect of this bug has been mitigated by https://trac.webkit.org/changeset/173028.