diff options
| author | Ignacio Etcheverry <ignalfonsore@gmail.com> | 2020-01-24 18:27:45 +0100 |
|---|---|---|
| committer | Ignacio Etcheverry <ignalfonsore@gmail.com> | 2020-01-24 18:28:40 +0100 |
| commit | 966a1261866142001d6f5c447c4a665da870b518 (patch) | |
| tree | 5fe69ff024748e1b065511e1edade4e5c6ee8498 /modules/mono/csharp_script.cpp | |
| parent | 1c0995d4509acd0a750f32517b14c01842220cca (diff) | |
| download | redot-engine-966a1261866142001d6f5c447c4a665da870b518.tar.gz | |
Mono/C#: Fix _update_exports possible crash with Reference types
The code was attempting to dynamic cast the native instance to Reference after
the managed instance was disposed. As the managed instance acts as a Ref,
the native instance was freed during that disposal.
This made the dynamic cast fail and we attempted to memdelete a second time.
The fix is to make the dynamic cast before disposal.
Diffstat (limited to 'modules/mono/csharp_script.cpp')
| -rw-r--r-- | modules/mono/csharp_script.cpp | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/modules/mono/csharp_script.cpp b/modules/mono/csharp_script.cpp index 210267e681..5d7c1fdd2c 100644 --- a/modules/mono/csharp_script.cpp +++ b/modules/mono/csharp_script.cpp @@ -2408,6 +2408,9 @@ bool CSharpScript::_update_exports() { top = top->get_parent_class(); } + // Need to check this here, before disposal + bool base_ref = Object::cast_to<Reference>(tmp_native) != NULL; + // Dispose the temporary managed instance MonoException *exc = NULL; @@ -2421,7 +2424,7 @@ bool CSharpScript::_update_exports() { MonoGCHandle::free_handle(tmp_pinned_gchandle); tmp_object = NULL; - if (tmp_native && !Object::cast_to<Reference>(tmp_native)) { + if (tmp_native && !base_ref) { Node *node = Object::cast_to<Node>(tmp_native); if (node && node->is_inside_tree()) { ERR_PRINTS("Temporary instance was added to the scene tree."); |