From 0e9c3a3e2b4f3eeaa9af8e3518b1392ac1d12f5d Mon Sep 17 00:00:00 2001
From: Christoph Oelckers <coelckers@zdoom.fake>
Date: Tue, 28 Oct 2008 15:58:00 +0000
Subject: [PATCH] - Fixed: FStateExpressions could copy unresolved default
 parameter expressions.   When these were resolved and changed later all
 copied pointers pointed to   invalid data.

SVN r1279 (trunk)
---
 docs/rh-log.txt                      |  5 +++++
 src/thingdef/thingdef_expression.cpp | 11 +++++++++--
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/docs/rh-log.txt b/docs/rh-log.txt
index f14ae98541..6797680f44 100644
--- a/docs/rh-log.txt
+++ b/docs/rh-log.txt
@@ -1,3 +1,8 @@
+October 28, 2008  (Changes by Graf Zahl)
+- Fixed: FStateExpressions could copy unresolved default parameter expressions.
+  When these were resolved and changed later all copied pointers pointed to
+  invalid data.
+
 October 26, 2008  (Changes by Graf Zahl)
 - Added read and write barriers to the actor pointer in the sound channel
   structure.
diff --git a/src/thingdef/thingdef_expression.cpp b/src/thingdef/thingdef_expression.cpp
index 44e10cba94..e199faa5a3 100644
--- a/src/thingdef/thingdef_expression.cpp
+++ b/src/thingdef/thingdef_expression.cpp
@@ -2763,7 +2763,8 @@ void FStateExpressions::Copy(int dest, int src, int cnt)
 {
 	for(int i=0; i<cnt; i++)
 	{
-		expressions[dest+i].expr = expressions[src+i].expr;
+		// For now set only a reference because these expressions may change when being resolved
+		expressions[dest+i].expr = (FxExpression*)(src+i);
 		expressions[dest+i].cloned = true;
 	}
 }
@@ -2782,7 +2783,13 @@ int FStateExpressions::ResolveAll()
 	ctx.lax = true;
 	for(unsigned i=0; i<Size(); i++)
 	{
-		if (expressions[i].expr != NULL && !expressions[i].cloned)
+		if (expressions[i].cloned)
+		{
+			// Now that everything coming before has been resolved we may copy the actual pointer.
+			intptr_t ii = ((intptr_t)expressions[i].expr)-1;
+			expressions[i].expr = expressions[ii].expr;
+		}
+		else if (expressions[i].expr != NULL)
 		{
 			ctx.cls = expressions[i].owner;
 			ctx.isconst = expressions[i].constant;