[Webkit-unassigned] [Bug 230548] New: Crash when rendering a non-system font with 'small-caps' font variant

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=230548

            Bug ID: 230548
           Summary: Crash when rendering a non-system font with
                    'small-caps' font variant
           Product: WebKit
           Version: Safari Technology Preview
          Hardware: iPhone / iPad
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P2
         Component: Canvas
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: paul.watkinson at entaingroup.com
                CC: dino at apple.com

When rendering a non-system font with the 'small-caps' font variant, the page crashes and reloads.

This occurs with the following devices:
    1. Simulated iPhone 13 + iOS 15.0, WebKit/605.1.15
    2. Real iPhone XR + iOS 15.0, WebKit/605.1.15


Reproduction:

Adding the following JavaScript to a HTML page; loads a font, waits 5s, and then renders the text to a canvas.

This immediately causes a crash.

```
var fontFamily = 'Luckiest Guy';
var link = document.createElement('link');
link.setAttribute('rel', 'stylesheet');
link.setAttribute('href', `https://fonts.googleapis.com/css?family=${fontFamily}`);

document.head.appendChild(link);
document.body.style.fontFamily = `'${fontFamily}'`;

var canvas = document.createElement('canvas');
document.body.appendChild(canvas);

var ctx = canvas.getContext('2d');
ctx.font = `normal small-caps normal 48px '${fontFamily}'`;

setInterval(() => {
    console.log('Drawing...');
    ctx.fillText('Hello, World!', 0, 48);
}, 5e3);
```


Actual Results:

The page crashes and is reloaded.


Expected Results:

The canvas should render the text, with the font-variant specified.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20210921/eedc60e1/attachment-0001.htm>