[bugfix] Fix crash in basic::subs().

A regression in 1.7.0 was introduced with 1b8bcb06 in function
basic::subs_one_level(): implicitly casting *this to an ex first for
finding *this in m and later in the function's return statement caused
a crash in the second cast because *this was deleted in the first one.
After all, *this was dynamically allocated in basic::subs().

This bug was reported and hunted down by Mario Prausa.

diff --git a/ginac/basic.cpp b/ginac/basic.cpp
index 1a3438e753c7627f03cfc902107d90c67a32a21a..59e7dbd97be7447cf2a3c4b1c020adc3fb4de6b5 100644 (file)
--- a/ginac/basic.cpp
+++ b/ginac/basic.cpp
@@ -585,10 +585,11 @@ bool basic::match(const ex & pattern, exmap& repl_lst) const
 ex basic::subs_one_level(const exmap & m, unsigned options) const
 {
        if (options & subs_options::no_pattern) {
 ex basic::subs_one_level(const exmap & m, unsigned options) const
 {
        if (options & subs_options::no_pattern) {

-               auto it = m.find(*this);
+               ex thisex = *this;  // NB: *this may be deleted here.
+               auto it = m.find(thisex);

                if (it != m.end())
                        return it->second;
                if (it != m.end())
                        return it->second;

-               return *this;
+               return thisex;

        } else {
                for (auto & it : m) {
                        exmap repl_lst;
        } else {
                for (auto & it : m) {
                        exmap repl_lst;