Fix NameExprType returning deleted canonical type when it's in a generic parent.

fixes #339

`NamedExpressionType::CreateCanonicalType()` may return a deleted pointer. The original implementation is as follows:
```
    Type* NamedExpressionType::CreateCanonicalType()
    {
        return GetType(declRef)->GetCanonicalType();
    }
```
If `GetType()` returns a newly constructed Type (this happens when the `typedef` is defined inside a generic parent, which triggers a non-trivial substitution), the temporary type will be deleted when the function returns. The fix is to store the temporary type as a field of NamedExpressionType (`innerType`).

A relevant fix (though not the true cause of issue #339) is to have `Type::GetCanonicalType()` also hold a `RefPtr` to the constructed canonical type, when the canonical type is not `this`. This prevents a returned canonical type being assigned to a RefPtr, which makes it possible for that RefPtr to be the sole owner of the canonical type and deleteing the canonical type when that RefPtr is destroyed.

1 files changed, 5 insertions, 1 deletions

diff --git a/source/slang/syntax.cpp b/source/slang/syntax.cpp
index 9ca2dc827..ca66e2110 100644
--- a/source/slang/syntax.cpp
+++ b/source/slang/syntax.cpp
@@ -189,6 +189,8 @@ void Type::accept(IValVisitor* visitor, void* extra)
         {
             // TODO(tfoley): worry about thread safety here?
             et->canonicalType = et->CreateCanonicalType();
+            if (dynamic_cast<Type*>(et->canonicalType) != this)
+                et->canonicalTypeRefPtr = et->canonicalType;
             SLANG_ASSERT(et->canonicalType);
         }
         return et->canonicalType;
@@ -861,7 +863,9 @@ void Type::accept(IValVisitor* visitor, void* extra)
 
     Type* NamedExpressionType::CreateCanonicalType()
     {
-        return GetType(declRef)->GetCanonicalType();
+        if (!innerType)
+            innerType = GetType(declRef);
+        return innerType->GetCanonicalType();
     }
 
     int NamedExpressionType::GetHashCode()