Bug 1417312 - Use copy instead of reference to avoid UAF in ASSERT. - r=daoshengmu draft
authorJeff Gilbert <jgilbert@mozilla.com>
Wed, 15 Nov 2017 18:44:17 -0800
changeset 699250 55976f7d863b14f7eb09f1263301773556e2a5c3
parent 693830 c2fe4b3b1b930b3e7fdb84eae44cec165394f322
child 699251 d34d44297dd8c6f26894ed51321f7eaba4ad4133
push id89512
push userbmo:jgilbert@mozilla.com
push dateThu, 16 Nov 2017 21:53:25 +0000
reviewersdaoshengmu
bugs1417312
milestone58.0a1
Bug 1417312 - Use copy instead of reference to avoid UAF in ASSERT. - r=daoshengmu MozReview-Commit-ID: BWr9rkVhIHG
dom/canvas/CacheMap.cpp
--- a/dom/canvas/CacheMap.cpp
+++ b/dom/canvas/CacheMap.cpp
@@ -7,19 +7,19 @@
 #include "CacheMap.h"
 
 namespace mozilla {
 
 void
 CacheMapInvalidator::InvalidateCaches() const
 {
     while (mCacheEntries.size()) {
-        const auto& entry = *(mCacheEntries.begin());
-        entry->Invalidate();
-        MOZ_ASSERT(mCacheEntries.find(entry) == mCacheEntries.end());
+        const auto pEntry = *(mCacheEntries.begin());
+        pEntry->Invalidate();
+        MOZ_ASSERT(mCacheEntries.find(pEntry) == mCacheEntries.end());
     }
 }
 
 namespace detail {
 
 CacheMapUntypedEntry::CacheMapUntypedEntry(std::vector<const CacheMapInvalidator*>&& invalidators)
     : mInvalidators(Move(invalidators))
 {