From 12be639dfcc17a10957f79b0e650ec7455cf50f6 Mon Sep 17 00:00:00 2001 From: David Blaikie Date: Thu, 18 Oct 2012 16:57:32 +0000 Subject: [PATCH] PR14021: Copy lookup results to ensure safe iteration. Within the body of the loop the underlying map may be modified via Sema::AddOverloadCandidate -> Sema::CompareReferenceRelationship -> Sema::RequireCompleteType to avoid the use of invalid iterators the sequence is copied first. A reliable, though large, test case is available - it will be reduced and committed shortly. Patch by Robert Muth. Review by myself, Nico Weber, and Rafael Espindola. llvm-svn: 166188 --- clang/lib/Sema/SemaInit.cpp | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/clang/lib/Sema/SemaInit.cpp b/clang/lib/Sema/SemaInit.cpp index ec25d531136f..3596bbfc725a 100644 --- a/clang/lib/Sema/SemaInit.cpp +++ b/clang/lib/Sema/SemaInit.cpp @@ -3700,8 +3700,14 @@ static void TryUserDefinedConversion(Sema &S, // Try to complete the type we're converting to. if (!S.RequireCompleteType(Kind.getLocation(), DestType, 0)) { - DeclContext::lookup_iterator Con, ConEnd; - for (llvm::tie(Con, ConEnd) = S.LookupConstructors(DestRecordDecl); + DeclContext::lookup_iterator ConOrig, ConEndOrig; + llvm::tie(ConOrig, ConEndOrig) = S.LookupConstructors(DestRecordDecl); + // The container holding the constructors can under certain conditions + // be changed while iterating. To be safe we copy the lookup results + // to a new container. + SmallVector CopyOfCon(ConOrig, ConEndOrig); + for (SmallVector::iterator + Con = CopyOfCon.begin(), ConEnd = CopyOfCon.end(); Con != ConEnd; ++Con) { NamedDecl *D = *Con; DeclAccessPair FoundDecl = DeclAccessPair::make(D, D->getAccess());