firefox/CVE-2020-15675.patch
2024-07-15 14:00:31 +08:00

53 lines
1.9 KiB
Diff

From 9a2c51887bff5742c072bf4f3c3794b349f51545 Mon Sep 17 00:00:00 2001
From: Jeff Gilbert <jgilbert@mozilla.com>
Date: Fri, 12 Jul 2024 10:27:35 +0800
Subject: [PATCH] Bug 1654211 - Hold WeakPtr to PresistentBufferProvider in BorrowedSourceSurface. r=gfx-reviewers,nical
Reference:https://hg.mozilla.org/mozilla-central/rev/0ec8df5bd92b
---
gfx/layers/CanvasRenderer.h | 2 +-
gfx/layers/PersistentBufferProvider.h | 6 +++++-
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/gfx/layers/CanvasRenderer.h b/gfx/layers/CanvasRenderer.h
index 7e03e295b0..ca3ae088cc 100644
--- a/gfx/layers/CanvasRenderer.h
+++ b/gfx/layers/CanvasRenderer.h
@@ -95,7 +95,7 @@ struct CanvasRendererData final {
class BorrowedSourceSurface final {
public:
- PersistentBufferProvider* const mReturnTo;
+ const WeakPtr<PersistentBufferProvider> mReturnTo;
const RefPtr<gfx::SourceSurface> mSurf; /// non-null
BorrowedSourceSurface(PersistentBufferProvider*, RefPtr<gfx::SourceSurface>);
diff --git a/gfx/layers/PersistentBufferProvider.h b/gfx/layers/PersistentBufferProvider.h
index f0d8aeccb9..85cfee8805 100644
--- a/gfx/layers/PersistentBufferProvider.h
+++ b/gfx/layers/PersistentBufferProvider.h
@@ -14,6 +14,8 @@
#include "mozilla/RefCounted.h"
#include "mozilla/gfx/Types.h"
#include "mozilla/Vector.h"
+#include "mozilla/WeakPtr.h"
+
namespace mozilla {
@@ -34,7 +36,9 @@ class TextureClient;
* from the provider again, the provider will guarantee the contents of the
* previously returned DrawTarget is persisted into the one newly returned.
*/
-class PersistentBufferProvider : public RefCounted<PersistentBufferProvider> {
+class PersistentBufferProvider : public RefCounted<PersistentBufferProvider>,
+ public SupportsWeakPtr<PersistentBufferProvider> {
+
public:
MOZ_DECLARE_REFCOUNTED_VIRTUAL_TYPENAME(PersistentBufferProvider)
--
2.27.0