Repository navigation
Cherry-pick(s) dcc59c29504a. rdar://191059662 - #78736
Open
webkit-opensource-integration wants to merge 1 commit into
Open
webkit-opensource-integration wants to merge 1 commit into
webkit-opensource-integration wants to merge 1 commit into
Conversation
rdar://186024085 Reviewed by Chris Dumez. Resolving a promise with an object performs a synchronous get(resolution, "then"). FontFace.loaded and FontFaceSet's promises resolve with such an object from inside CSSFontFace::setStatus's client notification, so an author then getter can run synchronous script there and mutate font data that a suspended caller is still using. This is the shared cause behind rdar://182680798, rdar://183298366, and rdar://185867407 in addition to this radar, on both the main thread and workers. DeferredPromise::callFunction already deferred a resolution on the main thread when ScriptDisallowedScope::isScriptAllowedInMainThread() was false, but nothing in font code entered that scope. Workers had no equivalent at all. The check returns true for any thread that is not the main one, regardless of any scope. FontFace and FontFaceSet are exposed to workers, so CSSFontFace::setStatus and its client notification run on the worker thread that owns them. * Source/WebCore/css/CSSFontFace.cpp: (WebCore::iterateClients): * Source/WebCore/dom/ContainerNode.cpp: * Source/WebCore/dom/ScriptDisallowedScope.h: (WebCore::ScriptDisallowedScope::ScriptDisallowedScope): (WebCore::ScriptDisallowedScope::~ScriptDisallowedScope): (WebCore::ScriptDisallowedScope::isScriptAllowedInCurrentThread): * Source/WebCore/bindings/js/JSDOMPromiseDeferred.cpp: (WebCore::DeferredPromise::callFunction): * LayoutTests/sar3/fast/text/font-face/font-cascade-width-glyph-geometry-cache-reentrancy-crash.html: Added. * LayoutTests/sar3/fast/text/font-face/font-cascade-width-glyph-geometry-cache-reentrancy-crash-expected.txt: Added. * LayoutTests/sar3/fast/text/font-face/font-face-loaded-resolution-deferred-in-worker.html: Added. * LayoutTests/sar3/fast/text/font-face/font-face-loaded-resolution-deferred-in-worker-expected.txt: Added. Originally-landed-as: 316606.620@safari-7625-branch (dcc59c2). rdar://191059662
Author
Author
|
At the time this pull request was created the following files were in conflict and need to be resolved:
|
Collaborator
|
EWS run on current version of this PR (hash 49a7183) Details |
🧪 wpe-wk2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Integration has hit a merge conflict while cherry-picking rdar://191059662 to main. [dcc59c2] caused a merge conflict.
ℹ️ Info
RC_REMOVE_SEC_ACCEL_*guards were removed with unifdef before cherry-picking, keeping only the code built when the macro is not defined.49a7183