A regression in 1.7.0 was introduced with
1b8bcb06 in function
basic::subs_one_level(): implicitly casting *this to an ex first for
finding *this in m and later in the function's return statement caused
a crash in the second cast because *this was deleted in the first one.
After all, *this was dynamically allocated in basic::subs().
This bug was reported and hunted down by Mario Prausa.
ex basic::subs_one_level(const exmap & m, unsigned options) const
{
if (options & subs_options::no_pattern) {
- auto it = m.find(*this);
+ ex thisex = *this; // NB: *this may be deleted here.
+ auto it = m.find(thisex);
if (it != m.end())
return it->second;
- return *this;
+ return thisex;
} else {
for (auto & it : m) {
exmap repl_lst;