[Webkit-unassigned] [Bug 54758] New: Crash when laying out page with loaded fonts (intermittent)

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=54758

           Summary: Crash when laying out page with loaded fonts
                    (intermittent)
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Android
        OS/Version: Android
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: Layout and Rendering
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: russell at android.com
                CC: benm at google.com


When laying out a page that uses a downloaded font, preliminary layout is performed using the appropriate fallback font (default serif, sans, or monotype). The download does not start until the first use of the font.

When the download completes, CSSFontSelector::fontLoaded() calls Document::scheduleForcedStyleRecalc() to notify of the switch from the fallback to the actual font. Also upon completion of the download, CSSFontFaceSource::fontLoaded() and CSSSegmentedFontFace::fontLoaded() have been calling pruneTable(), which immediately wipes out associated GlyphPageTreeNodes.

The problem is that those GlyphPageTreeNodes, the ones associated with the fallback font, may still be in use on the UI thread, frequently by Font::glyphDataForCharacter(), causing a segfault.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.