Explorar el Código

LibThreading: Fix BackgroundAction result use-after-free

We need to move the result out of the BackgroundAction object before
posting the completion callback as there is a chance the
BackgroundAction instance gets freed before the event loop runs our
callback.

Fixes #7641
Tom hace 4 años
padre
commit
b2e6088bff
Se han modificado 1 ficheros con 2 adiciones y 2 borrados
  1. 2 2
      Userland/Libraries/LibThreading/BackgroundAction.h

+ 2 - 2
Userland/Libraries/LibThreading/BackgroundAction.h

@@ -66,8 +66,8 @@ private:
         enqueue_work([this] {
         enqueue_work([this] {
             m_result = m_action(*this);
             m_result = m_action(*this);
             if (m_on_complete) {
             if (m_on_complete) {
-                Core::EventLoop::current().post_event(*this, make<Core::DeferredInvocationEvent>([this](auto&) {
-                    m_on_complete(m_result.release_value());
+                Core::EventLoop::current().post_event(*this, make<Core::DeferredInvocationEvent>([this, result = m_result.release_value()](auto&) {
+                    m_on_complete(result);
                     this->remove_from_parent();
                     this->remove_from_parent();
                 }));
                 }));
                 Core::EventLoop::wake();
                 Core::EventLoop::wake();