Bug 230548 - Crash when rendering a non-system font with 'small-caps' font variant
Summary: Crash when rendering a non-system font with 'small-caps' font variant
Status: RESOLVED DUPLICATE of bug 229401
Alias: None
Product: WebKit
Classification: Unclassified
Component: Canvas (show other bugs)
Version: Safari Technology Preview
Hardware: iPhone / iPad Other
: P2 Major
Assignee: Myles C. Maxfield
Keywords: InRadar
Depends on:
Reported: 2021-09-21 04:31 PDT by paul.watkinson
Modified: 2021-09-21 10:13 PDT (History)
7 users (show)

See Also:

test case (594 bytes, text/html)
2021-09-21 09:14 PDT, Alexey Proskuryakov
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description paul.watkinson 2021-09-21 04:31:35 PDT
When rendering a non-system font with the 'small-caps' font variant, the page crashes and reloads.

This occurs with the following devices:
    1. Simulated iPhone 13 + iOS 15.0, WebKit/605.1.15
    2. Real iPhone XR + iOS 15.0, WebKit/605.1.15


Adding the following JavaScript to a HTML page; loads a font, waits 5s, and then renders the text to a canvas.

This immediately causes a crash.

var fontFamily = 'Luckiest Guy';
var link = document.createElement('link');
link.setAttribute('rel', 'stylesheet');
link.setAttribute('href', `https://fonts.googleapis.com/css?family=${fontFamily}`);

document.body.style.fontFamily = `'${fontFamily}'`;

var canvas = document.createElement('canvas');

var ctx = canvas.getContext('2d');
ctx.font = `normal small-caps normal 48px '${fontFamily}'`;

setInterval(() => {
    ctx.fillText('Hello, World!', 0, 48);
}, 5e3);

Actual Results:

The page crashes and is reloaded.

Expected Results:

The canvas should render the text, with the font-variant specified.
Comment 1 Alexey Proskuryakov 2021-09-21 09:14:19 PDT
Created attachment 438828 [details]
test case

Same test as an attachment.
Comment 2 Alexey Proskuryakov 2021-09-21 09:31:15 PDT
I can reproduce this with 19B50, cannot reproduce with 18F72.

There are several simulated crashes in WebContent and GPU processes when opening this test, but I am not seeing any actual crashes. So maybe we are killing the process, I didn't analyze the logs.
Comment 3 Radar WebKit Bug Importer 2021-09-21 09:31:29 PDT
Comment 4 Simon Fraser (smfr) 2021-09-21 09:32:23 PDT
Pretty sure this has been fixed.
Comment 5 Alexey Proskuryakov 2021-09-21 09:34:40 PDT
Actually, one of the simulated crash logs says:

Requesting termination of web process 1156 for reason: "Resource is being released before being cached."
Comment 6 Simon Fraser (smfr) 2021-09-21 10:13:56 PDT

*** This bug has been marked as a duplicate of bug 229401 ***