249061 2022-12-09 18:36:02 -0800 Fix use-after-move in WebCore::StyleGradientImage constructor 2022-12-11 09:01:39 -0800 1 1 1 Unclassified WebKit SVG WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 246927 1 ddkilzer ddkilzer sabouhallawa webkit-bug-importer zimmermann oldest_to_newest 1918120 0 ddkilzer 2022-12-09 18:36:02 -0800 Fix use-after-free in WebCore::StyleGradientImage() constructor in Source/WebCore/rendering/style/StyleGradientImage.cpp. ``` StyleGradientImage::StyleGradientImage(Data&& data, CSSGradientColorInterpolationMethod colorInterpolationMethod, Vector <StyleGradientImageStop>&& stops) : StyleGeneratedImage { Type::GradientImage, StyleGradientImage::isFixedSize } , m_data { WTFMove(data) } , m_colorInterpolationMethod { colorInterpolationMethod } , m_stops { WTFMove(stops) } , m_knownCacheableBarringFilter { stopsAreCacheable(stops) } // FIXME: Use-after-move of `stops`. { } ``` 1918121 1 webkit-bug-importer 2022-12-09 18:36:24 -0800 <rdar://problem/103202572> 1918122 2 ddkilzer 2022-12-09 18:45:45 -0800 Pull request: https://github.com/WebKit/WebKit/pull/7427 1918213 3 ews-feeder 2022-12-10 13:41:22 -0800 Committed 257686@main (40f4e5e1face): <https://commits.webkit.org/257686@main> Reviewed commits have been landed. Closing PR #7427 and removing active labels. 1918283 4 ddkilzer 2022-12-11 09:01:39 -0800 This was a use-after-move, not a use-after-free.