Преглед на файлове

Mono/C#: Fix _update_exports possible crash with Reference types

The code was attempting to dynamic cast the native instance to Reference after
the managed instance was disposed. As the managed instance acts as a Ref,
the native instance was freed during that disposal.
This made the dynamic cast fail and we attempted to memdelete a second time.

The fix is to make the dynamic cast before disposal.
Ignacio Etcheverry преди 5 години
родител
ревизия
966a126186
променени са 1 файла, в които са добавени 4 реда и са изтрити 1 реда
  1. 4 1
      modules/mono/csharp_script.cpp

+ 4 - 1
modules/mono/csharp_script.cpp

@@ -2408,6 +2408,9 @@ bool CSharpScript::_update_exports() {
 			top = top->get_parent_class();
 		}
 
+		// Need to check this here, before disposal
+		bool base_ref = Object::cast_to<Reference>(tmp_native) != NULL;
+
 		// Dispose the temporary managed instance
 
 		MonoException *exc = NULL;
@@ -2421,7 +2424,7 @@ bool CSharpScript::_update_exports() {
 		MonoGCHandle::free_handle(tmp_pinned_gchandle);
 		tmp_object = NULL;
 
-		if (tmp_native && !Object::cast_to<Reference>(tmp_native)) {
+		if (tmp_native && !base_ref) {
 			Node *node = Object::cast_to<Node>(tmp_native);
 			if (node && node->is_inside_tree()) {
 				ERR_PRINTS("Temporary instance was added to the scene tree.");