Fix NameExprType returning deleted canonical type when it's in a generic parent.

fixes #339

`NamedExpressionType::CreateCanonicalType()` may return a deleted pointer. The original implementation is as follows:
```
    Type* NamedExpressionType::CreateCanonicalType()
    {
        return GetType(declRef)->GetCanonicalType();
    }
```
If `GetType()` returns a newly constructed Type (this happens when the `typedef` is defined inside a generic parent, which triggers a non-trivial substitution), the temporary type will be deleted when the function returns. The fix is to store the temporary type as a field of NamedExpressionType (`innerType`).

A relevant fix (though not the true cause of issue #339) is to have `Type::GetCanonicalType()` also hold a `RefPtr` to the constructed canonical type, when the canonical type is not `this`. This prevents a returned canonical type being assigned to a RefPtr, which makes it possible for that RefPtr to be the sole owner of the canonical type and deleteing the canonical type when that RefPtr is destroyed.

3 files changed, 8 insertions, 2 deletions

diff --git a/source/slang/syntax-base-defs.h b/source/slang/syntax-base-defs.h
index fdb2694a9..1853125a8 100644
--- a/source/slang/syntax-base-defs.h
+++ b/source/slang/syntax-base-defs.h
@@ -121,6 +121,7 @@ protected:
 
     virtual Type* CreateCanonicalType() = 0;
     Type* canonicalType = nullptr;
+    RefPtr<Type> canonicalTypeRefPtr;
 
     Session* session = nullptr;
     )
diff --git a/source/slang/syntax.cpp b/source/slang/syntax.cpp
index 9ca2dc827..ca66e2110 100644
--- a/source/slang/syntax.cpp
+++ b/source/slang/syntax.cpp
@@ -189,6 +189,8 @@ void Type::accept(IValVisitor* visitor, void* extra)
         {
             // TODO(tfoley): worry about thread safety here?
             et->canonicalType = et->CreateCanonicalType();
+            if (dynamic_cast<Type*>(et->canonicalType) != this)
+                et->canonicalTypeRefPtr = et->canonicalType;
             SLANG_ASSERT(et->canonicalType);
         }
         return et->canonicalType;
@@ -861,7 +863,9 @@ void Type::accept(IValVisitor* visitor, void* extra)
 
     Type* NamedExpressionType::CreateCanonicalType()
     {
-        return GetType(declRef)->GetCanonicalType();
+        if (!innerType)
+            innerType = GetType(declRef);
+        return innerType->GetCanonicalType();
     }
 
     int NamedExpressionType::GetHashCode()
diff --git a/source/slang/type-defs.h b/source/slang/type-defs.h
index d0b2ebac1..e7310768a 100644
--- a/source/slang/type-defs.h
+++ b/source/slang/type-defs.h
@@ -420,9 +420,10 @@ END_SYNTAX_CLASS()
 
 // A type alias of some kind (e.g., via `typedef`)
 SYNTAX_CLASS(NamedExpressionType, Type)
-    DECL_FIELD(DeclRef<TypeDefDecl>, declRef)
+DECL_FIELD(DeclRef<TypeDefDecl>, declRef)
 
 RAW(
+    RefPtr<Type> innerType;
     NamedExpressionType()
     {}
     NamedExpressionType(