Chromium Code Reviews
DescriptionMerge 34915 - Returns an error immediately without sending IPC message when a font family name to resolve is too long.
This change is important when a site has @fontface rule like:
// http://paulirish.com/webkitfontfacehang.html
@fontface{fontfamily:testfont;src:url('data:font/ttf;base64,AA.....<<looooooooooong base64 data>>.....aQ==')}
In such a case, WebCore first calls SkFontHost::CreateTypeface() with the (possibly very long) datauri string itself, then calls SkFontHost::CreateTypefaceFromStream() with decoded byte stream. Since render_sandbox_host_linux.cc just ignores too long IPC message, the renderer process could block indefinitely waiting for a reply inside recvmsg() system call called from SkFontHost::CreateTypeface().
I'm not sure if the WebCore behavior (i.e. calling CreateTypeface with datauris) is reasonable, but I believe the Skia part is better to be fixed anyway. Non datauri font family names could be very long too:
@fontface{fontfamily:testfont;src:local('AA........AA');}
BUG=29861
TEST=First, set up your Linux SUID Sandbox binary: http://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment. Then start Chromium and visit http://paulirish.com/webkitfontfacehang.html or http://typekit.com/. Verify that the renderer does not freeze.
Review URL: http://codereview.chromium.org/507037
TBR=yusukes@google.com
Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=35343
Patch Set 1 #
Messages
Total messages: 1 (0 generated)
|
||||||||||||||||||||||||||||||||||||||||||||||