Commit 5d896a6cc6b7127dd4db0bd386ebe33da82d7824 | zig

author	Robin Voetter <robin@voetter.nl> 2023-04-10 18:27:22+02:00
committer	Robin Voetter <robin@voetter.nl> 2023-05-11 20:31:50+02:00
log	5d896a6cc6b7127dd4db0bd386ebe33da82d7824
tree	5644af71416f1bd3a5242d1e645bd2ca4c80ad00
parent	5e62ba1347ee9b8614d5d72c60e87136a3bd7ab9
signature	Commit is signed but in an unrecognized format.

spirv: fix use-after-realloc in resolveType()

The pointer to a slot in a hash map was fetched before a recursive call.
If the hash map's size changed during the recursive call, this would write
to an invalid pointer.

The solution is to use an index instead of a pointer. Note that care must be
taken that resolved types (from the type_cahce) must not be accessed, as they
might be incomplete during this operation.

1 files changed, 5 insertions(+), 2 deletions(-)

src
- codegen
  - spirv
    Module.zig

src/codegen/spirv/Module.zig+5-2

 @@ -393,11 +393,14 @@ pub fn resolveSourceFileName(self: *Module, decl: *ZigDecl) !IdRef {
 /// be emitted at this point.
 pub fn resolveType(self: *Module, ty: Type) !Type.Ref {
     const result = try self.type_cache.getOrPut(self.gpa, ty);
+    const index = @intToEnum(Type.Ref, result.index);
     if (!result.found_existing) {
-        result.value_ptr.* = try self.emitType(ty);
+        const ref = try self.emitType(ty);
+        self.type_cache.values()[result.index] = ref;
     }
-    return @intToEnum(Type.Ref, result.index);
+    return index;
 }
 pub fn resolveTypeId(self: *Module, ty: Type) !IdResultType {