Skip to content

Fix a shape use-after-move in the glass geometry readback - #1607

Merged
Hparty merged 1 commit into
mainfrom
fix/glass-shape-move-order
Oct 29, 2026
Merged

Hparty merged 1 commit into
mainfrom
fix/glass-shape-move-order

Conversation

@skyrimHuang

Copy link
Copy Markdown
Collaborator

背景

#1598 引入的玻璃几何回读(GeometryShapeContext)有两处写成:

addPath(shape->getPath(), matrix, std::move(shape));

addPath 第三个参数按值接收 std::shared_ptr<Shape>,而 C++17 不保证实参求值顺序。若移动构造先完成,局部 shape 已为空,随后的 shape->getPath() 就是空指针访问。

触发条件

玻璃遮罩从录制回读矢量轮廓,且该绘制是文字轮廓或非简化 Shape(drawShape / drawTextBlob 两个入口)。

实际影响

在 GCC 10.3.1 上用同构最小程序复现:-O0、-O2 均 SIGSEGV。macOS 的 Apple Clang 恰好先读后移,所以现有测试全绿——这也是它随 #1598 合入而未被发现的原因。

修复

先把路径取到局部变量,再移动 shape:

auto path = shape->getPath();
addPath(std::move(path), matrix, std::move(shape));

行为不变,只是不再依赖求值顺序。

验证

  • GCC 最小复现:修复前两档崩溃,修复后两档正常;Apple Clang 前后均正常。

关联

修复 #1598 合入版本(c751f75f)中的缺陷,属后续跟进。

addPath takes the Shape by value, so the move is part of evaluating the
third argument. C++17 leaves the argument evaluation order unspecified, and
reading shape->getPath() in the same call therefore depends on that order:
a compiler that sequences the move first reads the path through an empty
pointer.

Take the path into a local first, so the call no longer depends on it.
@Hparty
Hparty merged commit 6bd4550 into main Oct 29, 2026
15 checks passed
@Hparty
Hparty deleted the fix/glass-shape-move-order branch October 29, 2026 07:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants