commit 1a4b1b3c716336174c184173f23fb03ea174fa65
author Jamie Madill <jmadill@chromium.org> Thu Jul 23 18:27:13 2015 -0400
committer Jamie Madill <jmadill@chromium.org> Fri Jul 24 17:39:08 2015 +0000
tree 4086c4011b59f9a041a04d82bd59b784af4532a5
parent 73a5b648375b29d9e2021b34f9a4f432e3297813

Fix use-after-delete in ParseContext.cpp.

This bug was exposed after a refactoring from the translator.

BUG=None
TEST=angle_unittests,angle_end2end_tests

Change-Id: I13fddcbe84f87826068a557f139f6e35c674571e
Reviewed-on: https://chromium-review.googlesource.com/287832
Reviewed-by: Zhenyao Mo <zmo@chromium.org>
Tested-by: Jamie Madill <jmadill@chromium.org>

src/compiler/translator/ParseContext.cpp

diff --git a/src/compiler/translator/ParseContext.cpp b/src/compiler/translator/ParseContext.cpp
index 46701df..a3d5646 100644
--- a/src/compiler/translator/ParseContext.cpp
+++ b/src/compiler/translator/ParseContext.cpp
@@ -930,8 +930,7 @@
     if (!symbolTable.declare(*variable))
     {
         error(line, "redefinition", identifier.c_str());
-        delete (*variable);
-        (*variable) = nullptr;
+        *variable = nullptr;
         return false;
     }
 
@@ -1884,10 +1883,13 @@
             //
             // Insert the parameters with name in the symbol table.
             //
-            if (!symbolTable.declare(variable)) {
+            if (!symbolTable.declare(variable))
+            {
                 error(location, "redefinition", variable->getName().c_str());
                 recover();
-                delete variable;
+                paramNodes = intermediate.growAggregate(
+                    paramNodes, intermediate.addSymbol(0, "", *param.type, location), location);
+                continue;
             }
 
             //
@@ -3758,7 +3760,6 @@
             recover();
         }
     }
-    delete fnCall;
     return callNode;
 }