Repository navigation
Fix a shape use-after-move in the glass geometry readback - #1607
Merged
Merged
Conversation
addPath takes the Shape by value, so the move is part of evaluating the third argument. C++17 leaves the argument evaluation order unspecified, and reading shape->getPath() in the same call therefore depends on that order: a compiler that sequences the move first reads the path through an empty pointer. Take the path into a local first, so the call no longer depends on it.
skyrimHuang
requested review from
Hparty,
domchen,
richardshan0614 and
shlzxjp
as code owners
October 29, 2026 07:28
Hparty
approved these changes
Oct 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
背景
#1598 引入的玻璃几何回读(
GeometryShapeContext)有两处写成:addPath第三个参数按值接收std::shared_ptr<Shape>,而 C++17 不保证实参求值顺序。若移动构造先完成,局部shape已为空,随后的shape->getPath()就是空指针访问。触发条件
玻璃遮罩从录制回读矢量轮廓,且该绘制是文字轮廓或非简化
Shape(drawShape/drawTextBlob两个入口)。实际影响
在 GCC 10.3.1 上用同构最小程序复现:
-O0、-O2均 SIGSEGV。macOS 的 Apple Clang 恰好先读后移,所以现有测试全绿——这也是它随 #1598 合入而未被发现的原因。修复
先把路径取到局部变量,再移动
shape:行为不变,只是不再依赖求值顺序。
验证
关联
修复 #1598 合入版本(
c751f75f)中的缺陷,属后续跟进。