From d46aeb030fa76854d2e7e64a25849b887defe4da Mon Sep 17 00:00:00 2001 From: Yong He Date: Thu, 28 Dec 2017 06:53:19 -0500 Subject: Fix NameExprType returning deleted canonical type when it's in a generic parent. fixes #339 `NamedExpressionType::CreateCanonicalType()` may return a deleted pointer. The original implementation is as follows: ``` Type* NamedExpressionType::CreateCanonicalType() { return GetType(declRef)->GetCanonicalType(); } ``` If `GetType()` returns a newly constructed Type (this happens when the `typedef` is defined inside a generic parent, which triggers a non-trivial substitution), the temporary type will be deleted when the function returns. The fix is to store the temporary type as a field of NamedExpressionType (`innerType`). A relevant fix (though not the true cause of issue #339) is to have `Type::GetCanonicalType()` also hold a `RefPtr` to the constructed canonical type, when the canonical type is not `this`. This prevents a returned canonical type being assigned to a RefPtr, which makes it possible for that RefPtr to be the sole owner of the canonical type and deleteing the canonical type when that RefPtr is destroyed. --- source/slang/syntax-base-defs.h | 1 + 1 file changed, 1 insertion(+) (limited to 'source/slang/syntax-base-defs.h') diff --git a/source/slang/syntax-base-defs.h b/source/slang/syntax-base-defs.h index fdb2694a9..1853125a8 100644 --- a/source/slang/syntax-base-defs.h +++ b/source/slang/syntax-base-defs.h @@ -121,6 +121,7 @@ protected: virtual Type* CreateCanonicalType() = 0; Type* canonicalType = nullptr; + RefPtr canonicalTypeRefPtr; Session* session = nullptr; ) -- cgit v1.2.3