WebCore:
Reviewed by Alexey Proskuryakov.
- fix https://bugs.webkit.org/show_bug.cgi?id=22454
<rdar://problem/6405550> REGRESSION (3.2-TOT): Crash below FontFallbackList::fontDataAt on jacobian.org
Test: http/tests/misc/font-face-in-multiple-segmented-faces.html
The crash happened because style recalculation was invoked by
CSSFontSelector after one CSSSegmentedFontFace had pruned its tables but
before another CSSSegmentedFontFace using the same CSSFontFace had done
so. The fix is to let all CSSSegmentedFontFaces using the CSSFontFace
prune their tables before telling the CSSFontSelector to recalc style.
* css/CSSFontFace.cpp:
(WebCore::CSSFontFace::fontLoaded):
* css/CSSFontSelector.cpp:
(WebCore::CSSFontSelector::fontLoaded):
* css/CSSFontSelector.h:
* css/CSSSegmentedFontFace.cpp:
(WebCore::CSSSegmentedFontFace::fontLoaded):
LayoutTests:
Reviewed by Alexey Proskuryakov.
- test for https://bugs.webkit.org/show_bug.cgi?id=22454
<rdar://problem/6405550> REGRESSION (3.2-TOT): Crash below FontFallbackList::fontDataAt on jacobian.org
* http/tests/misc/font-face-in-multiple-segmented-faces-expected.txt: Added.
* http/tests/misc/font-face-in-multiple-segmented-faces.html: Added.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@38843 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/http/tests/misc/font-face-in-multiple-segmented-faces.html b/LayoutTests/http/tests/misc/font-face-in-multiple-segmented-faces.html
new file mode 100644
index 0000000..e176946
--- /dev/null
+++ b/LayoutTests/http/tests/misc/font-face-in-multiple-segmented-faces.html
@@ -0,0 +1,24 @@
+<style>
+ @font-face {
+ font-family: "test";
+ font-weight: normal;
+ src: url(resources/acid3/font.ttf);
+ }
+
+ @font-face {
+ font-family: "test";
+ font-weight: bold;
+ src: local(Times);
+ }
+</style>
+<script>
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+</script>
+<p style="font-family: test; font-weight: bold;">Test for
+<a href="https://bugs.webkit.org/show_bug.cgi?id=22454">https://bugs.webkit.org/show_bug.cgi?id=22454</a>
+REGRESSION (3.2-TOT): Crash below FontFallbackList::fontDataAt on jacobian.org</p>
+<input style="font-family: test" value="PASS">
+<script>
+ document.body.offsetLeft;
+</script>
