From 0c74fc93d993b37cfd2c3307a03ab889647c2a01 Mon Sep 17 00:00:00 2001 From: Adam Barth Date: Thu, 12 Apr 2018 14:25:40 -0700 Subject: [PATCH] [fuchsia] Fix use-after-free (#4987) We were trying to re-establish the wait after calling Reset(), but Reset() can result in the surface being destroyed. Now we re-establish the wait inside the Reset() machinery. --- content_handler/vulkan_surface.cc | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/content_handler/vulkan_surface.cc b/content_handler/vulkan_surface.cc index 466f0a6e8d6..bebbc84e899 100644 --- a/content_handler/vulkan_surface.cc +++ b/content_handler/vulkan_surface.cc @@ -44,10 +44,6 @@ VulkanSurface::VulkanSurface(vulkan::VulkanProvider& vulkan_provider, wait_.set_object(release_event_.get()); wait_.set_trigger(ZX_EVENT_SIGNALED); - wait_.Begin(async_get_default()); - - // Probably not necessary as the events should be in the unsignalled state - // already. Reset(); valid_ = true; @@ -398,6 +394,8 @@ void VulkanSurface::Reset() { FXL_DLOG(ERROR) << "failed to create acquire semaphore"; } + wait_.Begin(async_get_default()); + // It is safe for the caller to collect the surface in the callback. auto callback = pending_on_writes_committed_; pending_on_writes_committed_ = nullptr; @@ -415,7 +413,6 @@ void VulkanSurface::OnHandleReady(async_t* async, return; FXL_DCHECK(signal->observed & ZX_EVENT_SIGNALED); Reset(); - wait->Begin(async); } } // namespace flutter_runner