spirv: fix use-after-realloc in resolveType()
The pointer to a slot in a hash map was fetched before a recursive call. If the hash map's size changed during the recursive call, this would write to an invalid pointer. The solution is to use an index instead of a pointer. Note that care must be taken that resolved types (from the type_cahce) must not be accessed, as they might be incomplete during this operation.
This commit is contained in:
@@ -393,11 +393,14 @@ pub fn resolveSourceFileName(self: *Module, decl: *ZigDecl) !IdRef {
|
||||
/// be emitted at this point.
|
||||
pub fn resolveType(self: *Module, ty: Type) !Type.Ref {
|
||||
const result = try self.type_cache.getOrPut(self.gpa, ty);
|
||||
const index = @intToEnum(Type.Ref, result.index);
|
||||
|
||||
if (!result.found_existing) {
|
||||
result.value_ptr.* = try self.emitType(ty);
|
||||
const ref = try self.emitType(ty);
|
||||
self.type_cache.values()[result.index] = ref;
|
||||
}
|
||||
|
||||
return @intToEnum(Type.Ref, result.index);
|
||||
return index;
|
||||
}
|
||||
|
||||
pub fn resolveTypeId(self: *Module, ty: Type) !IdResultType {
|
||||
|
||||
Reference in New Issue
Block a user