Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e57f9072af0d65bc0f80777f1ba672b06eb16e43
https://github.com/WebKit/WebKit/commit/e57f9072af0d65bc0f80777f1ba672b06eb16e43
Author: Kristian Monsen <[email protected]>
Date: 2026-05-29 (Fri, 29 May 2026)
Changed paths:
A LayoutTests/ipc/cache-font-null-palette-colors-crash-expected.txt
A LayoutTests/ipc/cache-font-null-palette-colors-crash.html
M Source/WebCore/platform/graphics/coretext/FontPlatformDataCoreText.cpp
Log Message:
-----------
FontPlatformSerializedAttributes::toCFDictionary should skip null key/value
pairs in paletteColors and variations
https://bugs.webkit.org/show_bug.cgi?id=315820
rdar://177612731
Reviewed by Vitor Roriz.
FontPlatformSerializedAttributes deserializes font attributes from IPC and
converts them to a CFDictionaryRef via toCFDictionary(). The
paletteColors and variations fields are vectors of key/value pairs where both
key (RetainPtr<CFNumberRef>) and value (RetainPtr<CGColorRef> or
RetainPtr<CFNumberRef>) are encoded as optionals in IPC — a false prefix yields
a null RetainPtr. The PAIR_VECTOR_TO_DICTIONARY macro did not check
for null before calling CFDictionaryAddValue, so a crafted CacheFont IPC
message with null keys or values would pass NULL to CoreFoundation,
triggering an NSInvalidArgumentException that propagates uncaught and crashes
the GPU process.
Fix: skip any pair where either the key or value is null.
Add an IPC layout test that sends CacheFont with null palette color entries and
then uses a FinalizeRenderingUpdate round-trip to verify the GPU
process is still alive. Without the fix the round-trip times out (GPU crashed);
with the fix it completes successfully.
Test: ipc/cache-font-null-palette-colors-crash.html
* LayoutTests/ipc/cache-font-null-palette-colors-crash-expected.txt: Added.
* LayoutTests/ipc/cache-font-null-palette-colors-crash.html: Added.
* Source/WebCore/platform/graphics/coretext/FontPlatformDataCoreText.cpp:
Canonical link: https://commits.webkit.org/314182@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
