FontFaceSet::Load builds a local promises array by looping over faces, calling each face’s load routine (which sets aRv and yields a Promise), and then appending that promise to promises with the fallible AppendElement(promise, fallible). The patch makes two coupled changes: before the loop it now also pre-reserves the promises buffer with promises.SetCapacity(weakFaces.Length(), fallible), and inside the loop it replaces the fallible append-and-bail with an infallible promises.AppendElement(promise). The net effect is that promises is sized once up front and its backing buffer is never reallocated while the loop is running.

The violated invariant is that the backing storage used by the loop must remain stable across each iteration. Producing a per-face Promise runs through the Promise/JS machinery and is reachable from author-observable state, so an iteration can re-enter and perturb the set during the loop (the diff does not show the body of the face-loading call, so the precise re-entrancy path is inferred). With the old incremental fallible append, each iteration could grow and reallocate promises, and a mid-loop failure path returned nullptr while partially-populated; the reservation + infallible append removes the reallocation entirely so no stale pointer into the moved buffer can be dereferenced. The advisory labels this a use-after-free (CWE-416); the diff substantiates a reallocation/ordering hardening around the promise accumulation rather than showing the freed object directly — the freed-memory step itself is (inferred) and not shown by the diff.

This executes in the content/renderer process and needs no special privilege — any web page using the CSS Font Loading API can reach FontFaceSet.load(). The achieved primitive is a use-after-free (advisory) manifesting as a potentially exploitable crash; the diff concretely substantiates only the reallocation/ordering hazard in promises accumulation, so the step from crash to controlled corruption and RCE is (inferred), not proven by this diff. There is no additional user interaction or gating beyond loading attacker content.