`SkCachedData`

Skia reference-counted object that owns an embedded mutex guarding its cache-tracking state during internalUnref.

`AutoMutexWritable`

RAII helper whose constructor locks this’s mutex and whose destructor unlocks it; as a temporary it lives until the end of the full statement.

Use-after-free (UAF)

accessing memory after it has been freed, here writing to a mutex embedded in a SkCachedData already released by delete this.

MiraclePtr

Chrome’s raw_ptr heap-safety mechanism whose rewrite pass surfaced this latent lifetime bug.

1. Allocate cached data Drive Skia to create an SkCachedData and raise its refcount via cached image/bitmap or pixel-ref paths reachable from web content.
2. Drop the last reference Trigger the final internalUnref so inMutexUnref returns true and control enters the delete this branch.
3. Free while locked delete this frees the object while the temporary AutoMutexWritable is still pending destruction at the end of the statement.
4. Unlock into freed memory The temporary’s destructor unlocks the mutex embedded in the freed allocation; with heap grooming the attacker has already reoccupied that memory.
5. Corrupt state The unlock write lands in attacker-controlled memory, providing a primitive toward further exploitation.

• src/core/SkCachedData.cpp

• Unlock-after-delete / temporary-lifetime
  audit any delete this or object-freeing branch that runs while an RAII lock guard, especially an unnamed temporary constructed in an if/expression, is still in scope; require the guard be explicitly scoped and destroyed before the free.
• Self-owned synchronization primitives
  flag mutexes or raw_ptr/AutoMutex-style helpers embedded in the object they guard, since their teardown after delete this reliably touches freed memory.
• MiraclePtr as mitigation
  treat the raw_ptr/MiraclePtr rewrite as both a detector and a defense: it surfaced this latent UAF and can quarantine freed allocations, so prioritize enabling it across similar refcounted teardown paths.

Use-After-Free in `SkCachedData::internalUnref()`

void SkCachedData::internalUnref(bool fromCache) const {
    if (AutoMutexWritable(this)->inMutexUnref(fromCache)) {
        delete this;
    }
}

void SkCachedData::internalUnref(bool fromCache) const {
    bool shouldDelete = false;
    {
        AutoMutexWritable amw(this);
        shouldDelete = amw->inMutexUnref(fromCache);
    }
    if (shouldDelete) {
        delete this;
    }
}