Skip to content

Commit 020f2b5

Browse files
committed
[Completion] ~ExpectedTypeContext must be called after ~CCResultBuilder
There's a subtle stack UAF here - `~CodeCompletionResultBuilder` would be called *after* `~ExpectedTypeContext` as `ExpectedTypeContext` was defined after `CodeCompletionResultBuilder`. Fix the order they're created to prevent this.
1 parent 2b6b3fd commit 020f2b5

File tree

1 file changed

+9
-4
lines changed

1 file changed

+9
-4
lines changed

lib/IDE/CodeCompletion.cpp

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -896,14 +896,19 @@ static void addKeywordsAfterReturn(CodeCompletionResultSink &Sink, DeclContext *
896896
// using the solver-based implementation. Add the result manually.
897897
if (auto ctor = dyn_cast_or_null<ConstructorDecl>(DC->getAsDecl())) {
898898
if (ctor->isFailable()) {
899+
Type resultType = ctor->getResultInterfaceType();
900+
901+
// Note that `TypeContext` must stay alive for the duration of
902+
// `~CodeCodeCompletionResultBuilder()`.
903+
ExpectedTypeContext TypeContext;
904+
TypeContext.setPossibleTypes({resultType});
905+
899906
CodeCompletionResultBuilder Builder(Sink, CodeCompletionResultKind::Literal,
900907
SemanticContextKind::None);
901908
Builder.setLiteralKind(CodeCompletionLiteralKind::NilLiteral);
902909
Builder.addKeyword("nil");
903-
Builder.addTypeAnnotation(ctor->getResultInterfaceType(), {});
904-
Builder.setResultTypes(ctor->getResultInterfaceType());
905-
ExpectedTypeContext TypeContext;
906-
TypeContext.setPossibleTypes({ctor->getResultInterfaceType()});
910+
Builder.addTypeAnnotation(resultType, {});
911+
Builder.setResultTypes(resultType);
907912
Builder.setTypeContext(TypeContext, DC);
908913
}
909914
}

0 commit comments

Comments
 (0)