translator: Fix builtin function emulator use-after-free.
We were calling the global pool allocator in the builtin function
emulator, which would lead to us freeing TTypes that were still
referenced. Fix this by using the TCache which was designed for
such a purpose, and locking the allocator around the builtin
function emulator to try and prevent similar bugs from creeping
in.
Eventually we would like to get rid of the global allocator and
replace it with different pools in different contexts, which are
managed more safely.
BUG=620937
Change-Id: If501ff6ea4d9bf8a2b8f89f2c94a01386f79ee3a
Reviewed-on: https://chromium-review.googlesource.com/353671
Reviewed-by: Geoff Lang <geofflang@chromium.org>
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Commit-Queue: Jamie Madill <jmadill@chromium.org>
diff --git a/src/compiler/translator/Compiler.cpp b/src/compiler/translator/Compiler.cpp
index 93062ca..3c7742a 100644
--- a/src/compiler/translator/Compiler.cpp
+++ b/src/compiler/translator/Compiler.cpp
@@ -318,7 +318,10 @@
// Built-in function emulation needs to happen after validateLimitations pass.
if (success)
{
+ // TODO(jmadill): Remove global pool allocator.
+ GetGlobalPoolAllocator()->lock();
initBuiltInFunctionEmulator(&builtInFunctionEmulator, compileOptions);
+ GetGlobalPoolAllocator()->unlock();
builtInFunctionEmulator.MarkBuiltInFunctionsForEmulation(root);
}