Fix use-after-move in WebCore::LineBuilder::tryPlacingFloatBox() in Source/WebCore/layout/formattingContexts/inline/InlineLineBuilder.cpp. The `floatBoxItem` variable is involved in the use-after-move below. ``` bool LineBuilder::tryPlacingFloatBox(const InlineItem& floatItem, LineBoxConstraintApplies lineBoxConstraintApplies) { [...] auto floatBoxItem = floatingContext.toFloatItem(floatBox); auto isLogicalLeftPositionedInFloatingState = floatBoxItem.isLeftPositioned(); floatingState()->append(WTFMove(floatBoxItem)); // Move. [...] // FIXME: In quirks mode some content may sneak above this float. if (shouldAdjustLineLogicalLeft()) { auto floatLogicalRight = InlineLayoutUnit { floatBoxItem.rectWithMargin().right() }; // Use-after-move. [...] } [...] } ``` Not sure what the default move constructor for `WebCore::FloatingState::FloatItem` will do to the moved-from object, but this should be avoided if possible.
(In reply to David Kilzer (:ddkilzer) from comment #0) > Fix use-after-move in WebCore::LineBuilder::tryPlacingFloatBox() in > Source/WebCore/layout/formattingContexts/inline/InlineLineBuilder.cpp. > > The `floatBoxItem` variable is involved in the use-after-move below. > > ``` > bool LineBuilder::tryPlacingFloatBox(const InlineItem& floatItem, > LineBoxConstraintApplies lineBoxConstraintApplies) > { > [...] > auto floatBoxItem = floatingContext.toFloatItem(floatBox); > auto isLogicalLeftPositionedInFloatingState = > floatBoxItem.isLeftPositioned(); > floatingState()->append(WTFMove(floatBoxItem)); // Move. > [...] > // FIXME: In quirks mode some content may sneak above this float. > if (shouldAdjustLineLogicalLeft()) { > auto floatLogicalRight = InlineLayoutUnit { > floatBoxItem.rectWithMargin().right() }; // Use-after-move. > [...] > } > [...] > } > ``` > > Not sure what the default move constructor for > `WebCore::FloatingState::FloatItem` will do to the moved-from object, but > this should be avoided if possible. Yeah, good catch. Fortunately it's safe, nothing gets moved here. -will nevertheless.
"-will nevertheless." should read "will fix nevertheless"
Created attachment 463977 [details] [fast-cq]Patch
Committed 257688@main (59efc6d73de9): <https://commits.webkit.org/257688@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 463977 [details].
<rdar://problem/103218248>