From 41083cbca455f295452141e3e759fdff867d7d38 Mon Sep 17 00:00:00 2001
From: Austin Eng <enga@chromium.org>
Date: Wed, 2 Dec 2020 16:30:38 +0000
Subject: [PATCH] spirv-reader: Fix bug with passing stack-allocated variable

When handling OpCompositeExtract, the SPIRV reader uses a
stack-allocated U32 type instead of one heap allocated by the
type manager. This causes type determination later to dereference
a garbage address.

Change-Id: I7d60b6dbf8310e53565d7db47eac4dd92b1bbfa0
Reviewed-on: https://dawn-review.googlesource.com/c/tint/+/34684
Reviewed-by: dan sinclair <dsinclair@chromium.org>
Commit-Queue: Austin Eng <enga@chromium.org>
---
 src/reader/spirv/function.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/reader/spirv/function.cc b/src/reader/spirv/function.cc
index db9625cee2..5ea523ccee 100644
--- a/src/reader/spirv/function.cc
+++ b/src/reader/spirv/function.cc
@@ -3092,9 +3092,9 @@ TypedExpression FunctionEmitter::MakeCompositeExtract(
   TypedExpression current_expr(MakeOperand(inst, 0));
 
   auto make_index = [this](uint32_t literal) {
-    ast::type::U32 u32;
+    auto* type = create<ast::type::U32>();
     return create<ast::ScalarConstructorExpression>(
-        create<ast::UintLiteral>(&u32, literal));
+        create<ast::UintLiteral>(type, literal));
   };
 
   const auto composite = inst.GetSingleWordInOperand(0);