feedc0de/qt-creator
1
0
Fork 0
forked from qt-creator/qt-creator
Code Pull Requests Activity

C++: Fix crash due to dangling pointer

Browse Source 
ResolveExpression used the wrong Control object, which was deleted by
~LookupContext() in TypeOfExpression::operator()). ~Control() led to the
dangling pointer.

Task-number: QTCREATORBUG-8890
Done-with: Erik Verbruggen <erik.verbruggen@digia.com>

Change-Id: Ic07947ee54087446b730e4d3ec4bef29defa4495
Reviewed-by: Erik Verbruggen <erik.verbruggen@digia.com>
This commit is contained in:
Nikolai Kosjar
2013-03-07 15:21:04 +01:00
parent de489ad4cf
commit 29055f9f43
2 changed files with 56 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/libs/cplusplus/ResolveExpression.cpp
View File

@@ -548,7 +548,7 @@ bool ResolveExpression::visit(SimpleNameAST *ast)
if (typeItems.empty())
continue;
CPlusPlus::Clone cloner(_context.control().data());
CPlusPlus::Clone cloner(_context.bindings()->control().data());
for (int n = 0; n < typeItems.size(); ++ n) {
FullySpecifiedType newType = cloner.type(typeItems[n].type(), 0);
@@ -1061,7 +1061,8 @@ ClassOrNamespace *ResolveExpression::baseExpression(const QList<LookupItem> &bas
FullySpecifiedType ResolveExpression::instantiate(const Name *className, Symbol *candidate) const
{
return DeprecatedGenTemplateInstance::instantiate(className, candidate, _context.control());
return DeprecatedGenTemplateInstance::instantiate(className, candidate,
_context.bindings()->control());
}
bool ResolveExpression::visit(PostIncrDecrAST *ast)