← WebKit Silent-Fix Report — 2026-W34
64a55fd574c40d8fda92b4f114d2a2afb9f0ec71 CSSFontFace::setStatus should commit m_status before notifying clients
severity medium
class LogicError
confidence 0.55
WebCore CSSFontFace
Primitive: CSSFontFace::setStatus notifies clients before committing m_status (reentrancy)
Triage note: setStatus() notified clients while m_status still held the old value and set it afterward; a reentrant measureText via a `then` accessor re-enters pump() during client notification with inconsistent state (assertion/inconsistent state). Fix uses std::exchange to commit m_status before iterateClients and passes oldStatus explicitly.
Triage note: setStatus() notified clients while m_status still held the old value and set it afterward; a reentrant measureText via a `then` accessor re-enters pump() during client notification with inconsistent state (assertion/inconsistent state). Fix uses std::exchange to commit m_status before iterateClients and passes oldStatus explicitly.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…