From 265bf42f81225febdc60f9797e51125c080331a0 Mon Sep 17 00:00:00 2001
From: rdb <git@rdb.name>
Date: Tue, 28 Jul 2015 13:41:26 +0200
Subject: [PATCH] Fix crash when copying a WeakPointerTo that was already
 deleted

---
 panda/src/express/referenceCount.I    | 6 ++++++
 panda/src/express/weakPointerTo.I     | 6 +++---
 panda/src/express/weakPointerToBase.I | 8 +++++++-
 3 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/panda/src/express/referenceCount.I b/panda/src/express/referenceCount.I
index c71886f46d..9f098b0384 100644
--- a/panda/src/express/referenceCount.I
+++ b/panda/src/express/referenceCount.I
@@ -319,6 +319,9 @@ get_weak_list() const {
 INLINE void ReferenceCount::
 weak_ref(WeakPointerToVoid *ptv) {
   TAU_PROFILE("void ReferenceCount::weak_ref()", " ", TAU_USER);
+#ifdef _DEBUG
+  nassertv(test_ref_count_integrity());
+#endif
   get_weak_list()->add_reference(ptv);
 }
 
@@ -332,6 +335,9 @@ weak_ref(WeakPointerToVoid *ptv) {
 INLINE void ReferenceCount::
 weak_unref(WeakPointerToVoid *ptv) {
   TAU_PROFILE("void ReferenceCount::weak_unref()", " ", TAU_USER);
+#ifdef _DEBUG
+  nassertv(test_ref_count_integrity());
+#endif
   nassertv(has_weak_list());
   ((WeakReferenceList *)_weak_list)->clear_reference(ptv);
 }
diff --git a/panda/src/express/weakPointerTo.I b/panda/src/express/weakPointerTo.I
index d42111bbca..797d1cf000 100644
--- a/panda/src/express/weakPointerTo.I
+++ b/panda/src/express/weakPointerTo.I
@@ -43,7 +43,7 @@ WeakPointerTo(const PointerTo<T> &copy) :
 template<class T>
 INLINE WeakPointerTo<T>::
 WeakPointerTo(const WeakPointerTo<T> &copy) :
-  WeakPointerToBase<T>(*(const PointerToBase<T> *)&copy)
+  WeakPointerToBase<T>(*(const WeakPointerToBase<T> *)&copy)
 {
 }
 
@@ -194,7 +194,7 @@ WeakConstPointerTo(const ConstPointerTo<T> &copy) :
 template<class T>
 INLINE WeakConstPointerTo<T>::
 WeakConstPointerTo(const WeakPointerTo<T> &copy) :
-  WeakPointerToBase<T>(*(const PointerToBase<T> *)&copy)
+  WeakPointerToBase<T>(*(const WeakPointerToBase<T> *)&copy)
 {
 }
 
@@ -206,7 +206,7 @@ WeakConstPointerTo(const WeakPointerTo<T> &copy) :
 template<class T>
 INLINE WeakConstPointerTo<T>::
 WeakConstPointerTo(const WeakConstPointerTo<T> &copy) :
-  WeakPointerToBase<T>(*(const PointerToBase<T> *)&copy)
+  WeakPointerToBase<T>(*(const WeakPointerToBase<T> *)&copy)
 {
 }
 
diff --git a/panda/src/express/weakPointerToBase.I b/panda/src/express/weakPointerToBase.I
index 61d454ea89..ead49a1424 100644
--- a/panda/src/express/weakPointerToBase.I
+++ b/panda/src/express/weakPointerToBase.I
@@ -43,7 +43,13 @@ WeakPointerToBase(const PointerToBase<T> &copy) {
 template<class T>
 INLINE WeakPointerToBase<T>::
 WeakPointerToBase(const WeakPointerToBase<T> &copy) {
-  reassign(copy);
+  _void_ptr = copy._void_ptr;
+  _ptr_was_deleted = copy._ptr_was_deleted;
+
+  if (is_valid_pointer()) {
+    To *ptr = (To *)_void_ptr;
+    ptr->weak_ref(this);
+  }
 }
 
 ////////////////////////////////////////////////////////////////////