Slava Pestov 2a0c8d1090 GSB: Fix use-after-free error when vending ResolvedType ...

The maybeResolveEquivalenceClass() method can deallocate equivalence
classes, because it calls updateNestedTypeForConformance(), which
calls addSameTypeRequirement().

Therefore, the EquivalenceClass stored inside a ResolvedType could
become invalid across calls to maybeResolveEquivalenceClass().

This was a problem in one place in particular, when adding a new
same-type constraint between two type parameters.

Fix this by not caching the equivalence class of a PotentialArchetype
in the ResolvedType implementation. The only time an equivalence class
is now stored is when returning an unresolved type, which is acted
upon immediately.

Fixes <https://bugs.swift.org/browse/SR-12812>, <rdar://problem/63422600>.

2020-07-16 23:31:33 -04:00

2.4 KiB

Raw Blame History

View Raw