From 2e681052b313ed547189d95d58d73081c028d604 Mon Sep 17 00:00:00 2001
From: Antonio Maiorano <amaiorano@google.com>
Date: Wed, 18 May 2022 19:55:18 +0000
Subject: [PATCH] tint: Fix use-after-free

Bug: chromium:1324533
Bug: chromium:1326749
Bug: oss-fuzz:47516
Change-Id: I0fd2db8997beaeaedc867bd27ee8866ace4e7cf0
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/90820
Commit-Queue: Antonio Maiorano <amaiorano@google.com>
Reviewed-by: Dan Sinclair <dsinclair@chromium.org>
Reviewed-by: Ben Clayton <bclayton@google.com>
---
 src/tint/ast/traverse_expressions.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/tint/ast/traverse_expressions.h b/src/tint/ast/traverse_expressions.h
index cd9c86c0a5..59b00e9829 100644
--- a/src/tint/ast/traverse_expressions.h
+++ b/src/tint/ast/traverse_expressions.h
@@ -94,7 +94,7 @@ bool TraverseExpressions(const ast::Expression* root, diag::List& diags, CALLBAC
     };
 
     while (!to_visit.empty()) {
-        auto& p = to_visit.back();
+        auto p = to_visit.back();
         to_visit.pop_back();
         const ast::Expression* expr = p.expr;