Pass retained arguments to CFX_ClipRgn::IntersectMaskF().

In turn, pass retained arguments to IntersectMaskRect(). Doing so
avoids the need for a "stack protector" when re-assigning on top
of the original holder of the object itself.

Bug: pdfium:1843
Change-Id: Ifb649ab8edb3118faff5c297b51c4dc949c4dba3
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/95510
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>

core/fxge/agg/fx_agg_driver.cpp

diff --git a/core/fxge/agg/fx_agg_driver.cpp b/core/fxge/agg/fx_agg_driver.cpp
index 6e9e5d0..4f8028e 100644
--- a/core/fxge/agg/fx_agg_driver.cpp
+++ b/core/fxge/agg/fx_agg_driver.cpp
@@ -1120,7 +1120,8 @@
   agg::scanline_u8 scanline;
   agg::render_scanlines(rasterizer, scanline, final_render,
                         m_FillOptions.aliased_path);
-  m_pClipRgn->IntersectMaskF(path_rect.left, path_rect.top, pThisLayer);
+  m_pClipRgn->IntersectMaskF(path_rect.left, path_rect.top,
+                             std::move(pThisLayer));
 }
 
 bool CFX_AggDeviceDriver::SetClip_PathFill(

core/fxge/cfx_cliprgn.cpp

diff --git a/core/fxge/cfx_cliprgn.cpp b/core/fxge/cfx_cliprgn.cpp
index 79555d8..92c2dc5 100644
--- a/core/fxge/cfx_cliprgn.cpp
+++ b/core/fxge/cfx_cliprgn.cpp
@@ -31,7 +31,7 @@
 
 void CFX_ClipRgn::IntersectMaskRect(FX_RECT rect,
                                     FX_RECT mask_rect,
-                                    const RetainPtr<CFX_DIBitmap>& pMask) {
+                                    RetainPtr<CFX_DIBitmap> pOldMask) {
   m_Type = kMaskF;
   m_Box = rect;
   m_Box.Intersect(mask_rect);
@@ -40,10 +40,9 @@
     return;
   }
   if (m_Box == mask_rect) {
-    m_Mask = pMask;
+    m_Mask = std::move(pOldMask);
     return;
   }
-  RetainPtr<CFX_DIBitmap> pOldMask(pMask);
   m_Mask = pdfium::MakeRetain<CFX_DIBitmap>();
   m_Mask->Create(m_Box.Width(), m_Box.Height(), FXDIB_Format::k8bppMask);
   const int offset = m_Box.left - mask_rect.left;
@@ -58,12 +57,12 @@
 
 void CFX_ClipRgn::IntersectMaskF(int left,
                                  int top,
-                                 const RetainPtr<CFX_DIBitmap>& pMask) {
+                                 RetainPtr<CFX_DIBitmap> pMask) {
   DCHECK_EQ(pMask->GetFormat(), FXDIB_Format::k8bppMask);
   FX_RECT mask_box(left, top, left + pMask->GetWidth(),
                    top + pMask->GetHeight());
   if (m_Type == kRectI) {
-    IntersectMaskRect(m_Box, mask_box, pMask);
+    IntersectMaskRect(m_Box, mask_box, std::move(pMask));
     return;
   }
 

core/fxge/cfx_cliprgn.h

diff --git a/core/fxge/cfx_cliprgn.h b/core/fxge/cfx_cliprgn.h
index 5738a88..b176765 100644
--- a/core/fxge/cfx_cliprgn.h
+++ b/core/fxge/cfx_cliprgn.h
@@ -25,12 +25,12 @@
   RetainPtr<CFX_DIBitmap> GetMask() const { return m_Mask; }
 
   void IntersectRect(const FX_RECT& rect);
-  void IntersectMaskF(int left, int top, const RetainPtr<CFX_DIBitmap>& Mask);
+  void IntersectMaskF(int left, int top, RetainPtr<CFX_DIBitmap> Mask);
 
  private:
   void IntersectMaskRect(FX_RECT rect,
                          FX_RECT mask_rect,
-                         const RetainPtr<CFX_DIBitmap>& Mask);
+                         RetainPtr<CFX_DIBitmap> pOldMask);
 
   ClipType m_Type = kRectI;
   FX_RECT m_Box;

core/fxge/skia/fx_skia_device.cpp

diff --git a/core/fxge/skia/fx_skia_device.cpp b/core/fxge/skia/fx_skia_device.cpp
index 3d5cfbc..95fd036 100644
--- a/core/fxge/skia/fx_skia_device.cpp
+++ b/core/fxge/skia/fx_skia_device.cpp
@@ -1981,7 +1981,8 @@
   SkPaint paint;
   paint.setAntiAlias(!m_FillOptions.aliased_path);
   canvas->drawPath(path, paint);
-  m_pClipRgn->IntersectMaskF(path_rect.left, path_rect.top, pThisLayer);
+  m_pClipRgn->IntersectMaskF(path_rect.left, path_rect.top,
+                             std::move(pThisLayer));
 }
 #endif  // defined(_SKIA_SUPPORT_PATHS_)