[webkit-changes] [WebKit/WebKit] 3ce91b: Nullptr crash accessing font under CSSPropertyPars...

[Antti Koivisto]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 3ce91b574a8617f1d0ab72ab364f5ef26c14128e
      https://github.com/WebKit/WebKit/commit/3ce91b574a8617f1d0ab72ab364f5ef26c14128e
  Author: Antti Koivisto <antti at apple.com>
  Date:   2023-01-22 (Sun, 22 Jan 2023)

  Changed paths:
    R LayoutTests/fast/css/at-property-registration-crash-expected.txt
    R LayoutTests/fast/css/at-property-registration-crash.html
    A LayoutTests/fast/css/custom-properties/at-property-dirty-font-crash-expected.txt
    A LayoutTests/fast/css/custom-properties/at-property-dirty-font-crash.html
    A LayoutTests/fast/css/custom-properties/at-property-registration-crash-expected.txt
    A LayoutTests/fast/css/custom-properties/at-property-registration-crash.html
    M Source/WebCore/style/StyleBuilder.cpp

  Log Message:
  -----------
  Nullptr crash accessing font under CSSPropertyParser::parseTypedCustomPropertyValue
https://bugs.webkit.org/show_bug.cgi?id=250984
rdar://104474407

Reviewed by Alan Baradlay.

* LayoutTests/fast/css/custom-properties/at-property-dirty-font-crash-expected.txt: Copied from LayoutTests/fast/css/at-property-registration-crash-expected.txt.
* LayoutTests/fast/css/custom-properties/at-property-dirty-font-crash.html: Added.
* LayoutTests/fast/css/custom-properties/at-property-registration-crash-expected.txt: Renamed from LayoutTests/fast/css/at-property-registration-crash-expected.txt.
* LayoutTests/fast/css/custom-properties/at-property-registration-crash.html: Renamed from LayoutTests/fast/css/at-property-registration-crash.html.
* Source/WebCore/style/StyleBuilder.cpp:
(WebCore::Style::Builder::resolveCustomPropertyValueWithVariableReferences):

Update the font before resolving a property if the property is font-dependent.

Canonical link: https://commits.webkit.org/259195@main