From 58b8c2771e96465fdcfaab4c4002d500afc55f59 Mon Sep 17 00:00:00 2001
From: krangelov <kr.angelov@gmail.com>
Date: Wed, 22 Sep 2021 11:16:29 +0200
Subject: [PATCH] fix double release for stable pointers

---
 src/runtime/c/pgf/expr.cxx | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/src/runtime/c/pgf/expr.cxx b/src/runtime/c/pgf/expr.cxx
index 3b7cf56bb..fbcbd2810 100644
--- a/src/runtime/c/pgf/expr.cxx
+++ b/src/runtime/c/pgf/expr.cxx
@@ -812,6 +812,9 @@ PgfType PgfExprParser::parse_type()
     size_t n_hypos = 0;
     PgfTypeHypo *hypos = NULL;
 
+    size_t n_types = 0;
+    PgfType *types = NULL;
+
     PgfText *cat = NULL;
 
     size_t n_args = 0;
@@ -851,6 +854,9 @@ PgfType PgfExprParser::parse_type()
 			if (type == 0)
 				goto exit;
 
+            types = (PgfType*) realloc(types, sizeof(PgfType)*(n_types+1));
+            types[n_types++] = type;
+
 			if (token_tag != PGF_TOKEN_RPAR)
 				goto exit;
 
@@ -891,6 +897,9 @@ PgfType PgfExprParser::parse_type()
             bt->type = u->dtyp(0,NULL,cat,n_args,args);
             n_hypos++;
 
+            types = (PgfType*) realloc(types, sizeof(PgfType)*(n_types+1));
+            types[n_types++] = bt->type;
+
             while (n_args > 0) {
                 u->free_ref(args[--n_args]);
             }
@@ -909,11 +918,16 @@ PgfType PgfExprParser::parse_type()
 exit:
     while (n_hypos > 0) {
         PgfTypeHypo *hypo = &hypos[--n_hypos];
-        u->free_ref(hypo->type);
         free(hypo->cid);
     }
     free(hypos);
 
+    while (n_types > 0) {
+        PgfType type = types[--n_types];
+        u->free_ref(type);
+    }
+    free(types);
+
     free(cat);
 
     while (n_args > 0) {