search

movableink / webkit

Unofficial mirror of the WebKit SVN repository
http://www.webkit.org/
59 stars 11 forks source link

`WebCore::PathQt::platformPath()`: don't return a temporary object #38

Open whitslack opened 2 months ago

whitslack commented 2 months ago

WebCore::Path::platformPath() expects to be able to return the return value of WebCore::PlatformPathImpl::platformPath() as a PlatformPathPtr without creating a dangling reference. However, WebCore::PathQt::platformPath() is defined as returning a temporary QPainterPath object, which does become a dangling reference when returned by reference, leading to segfaults at runtime.

This PR changes the return type of WebCore::PathQt::platformPath() to PlatformPathPtr (paralleling the definition of WebCore::PathCG::platformPath()), so as to avoid creating a temporary QPainterPath object, thereby avoiding the creation of a dangling reference when returning from WebCore::Path::platformPath().

Fixes: https://github.com/movableink/webkit/issues/37

whitslack commented 2 months ago

Note: The other way this can be fixed is to typedef PlatformPathPtr as QPainterPath rather than as const QPainterPath&. That is the option taken by QtWebKit 5.212:

https://github.com/qtwebkit/qtwebkit/blob/756e1c8f23dc2720471298281c421c0076d02df8/Source/WebCore/platform/graphics/Path.h#L47

typedef QPainterPath PlatformPath;

https://github.com/qtwebkit/qtwebkit/blob/756e1c8f23dc2720471298281c421c0076d02df8/Source/WebCore/platform/graphics/Path.h#L70-L71

/* QPainterPath is valued based */
typedef PlatformPath PlatformPathPtr;

Curiously, it has the same typo'd comment but in a different file and with a different typedef, so I wonder whether the dangling reference bug was introduced in movableink/webkit after copying the correct code from qtwebkit/qtwebkit or was fixed in qtwebkit/qtwebkit after copying the incorrect code from movableink/webkit. I'd guess the former.

For reference, here is the related code in movableink/webkit (exclusive of this PR):

https://github.com/movableink/webkit/blob/2d2b3794dd79e0379f9dba7b653b80e4f8cbde04/Source/WebCore/platform/graphics/PlatformPath.h#L32

https://github.com/movableink/webkit/blob/2d2b3794dd79e0379f9dba7b653b80e4f8cbde04/Source/WebCore/platform/graphics/PlatformPath.h#L41-L42