From d46aeb030fa76854d2e7e64a25849b887defe4da Mon Sep 17 00:00:00 2001 From: Yong He Date: Thu, 28 Dec 2017 06:53:19 -0500 Subject: Fix NameExprType returning deleted canonical type when it's in a generic parent. fixes #339 `NamedExpressionType::CreateCanonicalType()` may return a deleted pointer. The original implementation is as follows: ``` Type* NamedExpressionType::CreateCanonicalType() { return GetType(declRef)->GetCanonicalType(); } ``` If `GetType()` returns a newly constructed Type (this happens when the `typedef` is defined inside a generic parent, which triggers a non-trivial substitution), the temporary type will be deleted when the function returns. The fix is to store the temporary type as a field of NamedExpressionType (`innerType`). A relevant fix (though not the true cause of issue #339) is to have `Type::GetCanonicalType()` also hold a `RefPtr` to the constructed canonical type, when the canonical type is not `this`. This prevents a returned canonical type being assigned to a RefPtr, which makes it possible for that RefPtr to be the sole owner of the canonical type and deleteing the canonical type when that RefPtr is destroyed. --- source/slang/syntax.cpp | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'source/slang/syntax.cpp') diff --git a/source/slang/syntax.cpp b/source/slang/syntax.cpp index 9ca2dc827..ca66e2110 100644 --- a/source/slang/syntax.cpp +++ b/source/slang/syntax.cpp @@ -189,6 +189,8 @@ void Type::accept(IValVisitor* visitor, void* extra) { // TODO(tfoley): worry about thread safety here? et->canonicalType = et->CreateCanonicalType(); + if (dynamic_cast(et->canonicalType) != this) + et->canonicalTypeRefPtr = et->canonicalType; SLANG_ASSERT(et->canonicalType); } return et->canonicalType; @@ -861,7 +863,9 @@ void Type::accept(IValVisitor* visitor, void* extra) Type* NamedExpressionType::CreateCanonicalType() { - return GetType(declRef)->GetCanonicalType(); + if (!innerType) + innerType = GetType(declRef); + return innerType->GetCanonicalType(); } int NamedExpressionType::GetHashCode() -- cgit v1.2.3