mirror of
https://github.com/ChaiScript/ChaiScript.git
synced 2026-07-31 00:37:02 +08:00
6dc28ca1ba
Two bugs combined to cause the crash: 1. The optimized for loop (chaiscript_optimizer.hpp) stored the loop counter as a stack-local `int` and exposed it to ChaiScript via `var(&i)`, creating a reference-type Boxed_Value pointing to the stack frame. 2. The `:=` operator's `Data::operator=` performed a shallow clone of the Any (copying the reference_wrapper, not the value), so `ret := i` made `ret` alias the stack-local `int`. When the optimized loop's frame unwound, `ret` held a dangling pointer. Fix 1: The optimizer now heap-allocates the loop counter via `Boxed_Value(start_int)` and obtains a reference to the heap-allocated int for the native C++ loop. The Boxed_Value's shared_ptr ensures the storage outlives any copies. Fix 2: The `:=` operator now deep-copies arithmetic values via `Boxed_Number::clone` instead of the shallow `assign()`, ensuring value semantics. This also fixes a pre-existing aliasing bug where `a := b; ++b` would incorrectly mutate `a`. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| chaiscript_algebraic.hpp | ||
| chaiscript_common.hpp | ||
| chaiscript_engine.hpp | ||
| chaiscript_eval.hpp | ||
| chaiscript_optimizer.hpp | ||
| chaiscript_parser.hpp | ||
| chaiscript_posix.hpp | ||
| chaiscript_prelude_docs.hpp | ||
| chaiscript_prelude.hpp | ||
| chaiscript_tracer.hpp | ||
| chaiscript_unknown.hpp | ||
| chaiscript_windows.hpp | ||