Bug 44191 - WebKit crash when combining text-rendering and ex units
Summary: WebKit crash when combining text-rendering and ex units
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit Misc. (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P1 Critical
Assignee: Nobody
URL: http://jsfiddle.net/tMq3j/
Depends on:
Reported: 2010-08-18 11:34 PDT by gonchuki
Modified: 2014-02-25 21:27 PST (History)
5 users (show)

See Also:


Note You need to log in before you can comment on or make changes to this bug.
Description gonchuki 2010-08-18 11:34:16 PDT
simply use this: <span style="text-rendering: optimizeLegibility; margin-bottom: 1ex;">crash!</span> and any WebKit based browser will crash. 

I tested and confirmed that this happens with any property that modifies the element box, so it applies to border, padding, margin and outline. Notice that it only happens when using ex units (as far as I confirmed), using em instead of ex does not reproduce the crash.

This is a non-exhaustive list of the browsers/platforms where the bug is reproducible:

- Safari 5, Windows 7
- WebKit Nightly r65225 - Windows 7
- Google Chrome 5.0.375.126, Windows 7
- Google Chrome 5.0.375.126, Mac OS X 10.6
- Google Chrome 5.0.375.126, Ubuntu Linux 10.04
- Apple iPad, iPhoneOS 3.2

I also noticed that Google Chrome Beta (build 6.0.472.36) is immune to this issue, so there's probably some compile parameter or a very recent patch that was not integrated back into WebKit that fixes this crash (there is no ticket on Chrome's tracker relating to this, so it might be an accidental fix.)

Also notice that current status for WebKit implementations used in iOS4, WebOS and Android is unknown as I don't have access to those, but being that I confirmed it on the iPad I can quickly conclude that the bug is architecture independent and will crash in any ARM CPU too.

here's an URL to jsfiddle so you can see this in action: http://jsfiddle.net/tMq3j/
Comment 1 zaheer 2010-08-19 01:18:56 PDT
It looks like m_fontList is not initialzed in certain cases and that font object gets accessed by the CSS

Setting the fontlist fixes the problem but iam sure there's a better fix

Index: WebCore/platform/graphics/Font.cpp
--- WebCore/platform/graphics/Font.cpp	(revision 65654)
+++ WebCore/platform/graphics/Font.cpp	(working copy)
@@ -65,6 +65,7 @@
 Font::Font(const FontDescription& fd, short letterSpacing, short wordSpacing) 
     : m_fontDescription(fd)
+    , m_fontList(FontFallbackList::create())
     , m_letterSpacing(letterSpacing)
     , m_wordSpacing(wordSpacing)
     , m_isPlatformFont(false)
Comment 2 mitz 2010-08-20 10:54:27 PDT
Did you test this with a recent WebKit nightly build? This appears to be a duplicate of bug 41585.

*** This bug has been marked as a duplicate of bug 41585 ***
Comment 3 mitz 2010-08-20 16:42:28 PDT
I overlooked this line from the description.
> - WebKit Nightly r65225 - Windows 7
Comment 4 Alexey Proskuryakov 2010-08-23 17:48:12 PDT
FWIW, this doesn't crash for me with a local debug build of r65841 on Windows Vista.
Comment 5 Deepak Mittal 2014-02-09 21:22:55 PST
It is not crashing for me on the FF and latest webkit build, Please verify once and resolve this issue..