[webkit-reviews] review denied: [Bug 125477] Allow ImageBuffer to re-use IOSurfaces : [Attachment 219732] Patch

[bugzilla-daemon at webkit.org]

Geoffrey Garen <ggaren at apple.com> has denied Myles C. Maxfield
<mmaxfield at apple.com>'s request for review:
Bug 125477: Allow ImageBuffer to re-use IOSurfaces
https://bugs.webkit.org/show_bug.cgi?id=125477

Attachment 219732: Patch
https://bugs.webkit.org/attachment.cgi?id=219732&action=review

------- Additional Comments from Geoffrey Garen <ggaren at apple.com>
View in context: https://bugs.webkit.org/attachment.cgi?id=219732&action=review


> Source/WebCore/platform/graphics/cg/ImageBufferBackingStoreCache.cpp:78
> +bool
ImageBufferBackingStoreCache::isAcceptableSurface(IOSurfaceAndContextWithCreati
onParams& info, IntSize& requestedSize, CGColorSpaceRef colorSpace, bool
needExactSize)

These arguments should be const&.

> Source/WebCore/platform/graphics/cg/ImageBufferBackingStoreCache.cpp:126
> +	       outInfo = std::move(*info);
> +	       deleteFromCache(i, info);

This is basically use after free, since deletedFromCache will use info after it
has been moved.