Fix completed flag use after free (#114)

macro-inc · Dec 21, 2023 · 2fbcff3 · 2fbcff3
2 parents 37c6356 + fbf20b1
commit 2fbcff3
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 6 deletions.
diff --git a/src/electron/ELECTRON_VERSION b/src/electron/ELECTRON_VERSION
@@ -1 +1 @@
-20.3.0-rc14
+20.3.0-rc15
diff --git a/src/electron/office/paint_manager.cc b/src/electron/office/paint_manager.cc
@@ -224,7 +224,7 @@ void PaintManager::PostCurrentTask() {
         FROM_HERE,
         base::BindOnce(&PaintManager::PaintTileRange, client_->GetTileBuffer(),
                        current_task_->skip_paint_flag_,
-                       current_task_->document_, it, hash, std::move(completed)));
+                       current_task_->document_, it, hash, completed));
   }
 }
 
@@ -233,7 +233,7 @@ void PaintManager::PaintTileRange(scoped_refptr<office::TileBuffer> tile_buffer,
                                   DocumentHolderWithView document,
                                   TileRange it,
                                   std::size_t context_hash,
-                                  base::RepeatingClosure completed) {
+                                  const base::RepeatingClosure& completed) {
 #ifdef DEBUG_PAINT_MANAGER
   LOG(ERROR) << "PTR " << it.index_start << " - " << it.index_end
              << " CH: " << std::hex << context_hash;
@@ -252,7 +252,7 @@ bool PaintManager::PaintTile(scoped_refptr<office::TileBuffer> tile_buffer,
                              DocumentHolderWithView document,
                              unsigned int tile_index,
                              std::size_t context_hash,
-                             base::RepeatingClosure completed) {
+                             const base::RepeatingClosure& completed) {
   bool res =
       tile_buffer->PaintTile(cancel_flag, document, tile_index, context_hash);
   completed.Run();

diff --git a/src/electron/office/paint_manager.h b/src/electron/office/paint_manager.h
@@ -98,13 +98,13 @@ class PaintManager {
                         DocumentHolderWithView document,
                         unsigned int tile_index,
                         std::size_t context_hash,
-                        base::RepeatingClosure completed);
+                        const base::RepeatingClosure& completed);
   static void PaintTileRange(scoped_refptr<office::TileBuffer> tile_buffer,
                              CancelFlagPtr cancel_flag,
                              DocumentHolderWithView document,
                              TileRange range,
                              std::size_t context_hash,
-                             base::RepeatingClosure completed);
+                             const base::RepeatingClosure& completed);
 
   const scoped_refptr<base::TaskRunner> task_runner_;
   Client* client_;