commit 89bdea0f77de017e5e1e07f13afaa7543dd151b9
author Ben Clayton <bclayton@google.com> Thu Jul 07 16:56:21 2022 +0000
committer Dawn LUCI CQ <dawn-scoped@luci-project-accounts.iam.gserviceaccount.com> Thu Jul 07 16:56:21 2022 +0000
tree 4164e645d0590e316f2df660714f1fe0e5399065
parent 808f6167622ff7aae339d17ddb90ff9b7eb17619

tint/resolver: Fix null-deref

Materialize() can return nullptr, if there's an error.
Check the returned pointer for nullptr, before continuing on to using the pointer.

Bug: chromium:1341313
Change-Id: Ib7c9e593fbf2bb4374305c341c2b04e34e7487e9
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/95761
Commit-Queue: Ben Clayton <bclayton@google.com>
Kokoro: Kokoro <noreply+kokoro@google.com>
Reviewed-by: Dan Sinclair <dsinclair@chromium.org>

src/tint/resolver/resolver.cc

diff --git a/src/tint/resolver/resolver.cc b/src/tint/resolver/resolver.cc
index 9ef9a30..81ff6ee 100644
--- a/src/tint/resolver/resolver.cc
+++ b/src/tint/resolver/resolver.cc
@@ -456,6 +456,9 @@
     if (ty) {
         // If an explicit type was specified, materialize to that type
         rhs = Materialize(rhs, ty);
+        if (!rhs) {
+            return nullptr;
+        }
     } else {
         // If no type was specified, infer it from the RHS
         ty = rhs->Type();