Bug 44191 – WebKit crash when combining text-rendering and ex units

• Status: RESOLVED
• Resolution: WORKSFORME
• Component: WebKit Misc.

[gonchuki]

simply use this: <span style="text-rendering: optimizeLegibility; margin-bottom: 1ex;">crash!</span> and any WebKit based browser will crash. 

I tested and confirmed that this happens with any property that modifies the element box, so it applies to border, padding, margin and outline. Notice that it only happens when using ex units (as far as I confirmed), using em instead of ex does not reproduce the crash.


This is a non-exhaustive list of the browsers/platforms where the bug is reproducible:

- Safari 5, Windows 7
- WebKit Nightly r65225 - Windows 7
- Google Chrome 5.0.375.126, Windows 7
- Google Chrome 5.0.375.126, Mac OS X 10.6
- Google Chrome 5.0.375.126, Ubuntu Linux 10.04
- Apple iPad, iPhoneOS 3.2

I also noticed that Google Chrome Beta (build 6.0.472.36) is immune to this issue, so there's probably some compile parameter or a very recent patch that was not integrated back into WebKit that fixes this crash (there is no ticket on Chrome's tracker relating to this, so it might be an accidental fix.)

Also notice that current status for WebKit implementations used in iOS4, WebOS and Android is unknown as I don't have access to those, but being that I confirmed it on the iPad I can quickly conclude that the bug is architecture independent and will crash in any ARM CPU too.


here's an URL to jsfiddle so you can see this in action: http://jsfiddle.net/tMq3j/

[zaheer]

It looks like m_fontList is not initialzed in certain cases and that font object gets accessed by the CSS

Setting the fontlist fixes the problem but iam sure there's a better fix


Index: WebCore/platform/graphics/Font.cpp
===================================================================
--- WebCore/platform/graphics/Font.cpp	(revision 65654)
+++ WebCore/platform/graphics/Font.cpp	(working copy)
@@ -65,6 +65,7 @@
 
 Font::Font(const FontDescription& fd, short letterSpacing, short wordSpacing) 
     : m_fontDescription(fd)
+    , m_fontList(FontFallbackList::create())
     , m_letterSpacing(letterSpacing)
     , m_wordSpacing(wordSpacing)
     , m_isPlatformFont(false)

Did you test this with a recent WebKit nightly build? This appears to be a duplicate of bug 41585.

*** This bug has been marked as a duplicate of bug 41585 ***

I overlooked this line from the description.
> - WebKit Nightly r65225 - Windows 7

[Alexey Proskuryakov]

FWIW, this doesn't crash for me with a local debug build of r65841 on Windows Vista.

[Deepak Mittal]

It is not crashing for me on the FF and latest webkit build, Please verify once and resolve this issue..