commit 056e1dd4be60b6b35fca042d4e6d7cb053c2d60d
author Frédéric Wang <fwang@igalia.com> Tue Feb 15 09:35:36 2022
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> Tue Feb 15 09:35:36 2022
tree 53b3a90c0de8556302a0d581319852a5060f217f
parent d73fab72c66a5b9802c2a7cff460dc1beae3f703

Fix nullptr crash when rendering text to an offscreenCanvas with BlinkMacSystemFont or -webkit-body

FontDescription::FamilyDescription ConvertFontFamily(const CSSValue&,
FontBuilder*, const Document*) is called at two places:

- In FontStyleResolver::ComputeFont(), where document_for_count is
always null and additionally FontBuilder's document_ is null.
- In StyleBuilderConverter::ConvertFontFamily(), where
document_for_count is always non-null ; and builder is null if and
only if document's setting is null.

This means that for FontStyleResolver::ComputeFont():
- ConvertFontFamily() and ConvertFontFamilyName() must null-check
document_for_count when counting for -webkit-body and
BlinkMacSystemFont.
- FontBuilder::StandardFontFamilyName() should null-check document_
when it's called via FontBuilder::GenericFontFamilyName().

This CL performs the above changes and adds a crash test.

Note that the above problems don't show up from
StyleBuilderConverter::ConvertFontFamily().

Bug: 1056386
Change-Id: I18a0b19756d5827a30d70a348475702ce4db47c1
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3460590
Reviewed-by: Dominik Röttsches <drott@chromium.org>
Commit-Queue: Frédéric Wang <fwang@igalia.com>
Cr-Commit-Position: refs/heads/main@{#971131}