From d0a9f6803b662ad1c9b20bf5dff1d461b1d71548 Mon Sep 17 00:00:00 2001
From: Michael Lotz <mmlr@mlotz.ch>
Date: Sat, 4 Apr 2015 10:51:24 +0200
Subject: [PATCH] Tracker: Fix use-after-free on destruction of the icon
 caches.

The hash table member still uses the element array memeber to clear
itself on destruction. We must therefore ensure that the element array
isn't destroyed before the hash table. Since the destruction order of
memebers is the reverse order of their declaration, reordering them
is enough.
---
 src/kits/tracker/IconCache.cpp | 12 ++++++------
 src/kits/tracker/IconCache.h   |  4 ++--
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/src/kits/tracker/IconCache.cpp b/src/kits/tracker/IconCache.cpp
index 0ce95cee9f..e09980f96a 100644
--- a/src/kits/tracker/IconCache.cpp
+++ b/src/kits/tracker/IconCache.cpp
@@ -1408,13 +1408,13 @@ SharedIconCache::SharedIconCache()
 	:
 #if DEBUG
 	SimpleIconCache("Shared icon cache aka \"The Dead-Locker\""),
-	fHashTable(20),
 	fElementArray(20),
+	fHashTable(20),
 	fRetiredBitmaps(20, true)
 #else
 	SimpleIconCache("Tracker shared icon cache"),
-	fHashTable(1000),
 	fElementArray(1024),
+	fHashTable(1000),
 	fRetiredBitmaps(256, true)
 #endif
 {
@@ -1765,12 +1765,12 @@ NodeIconCache::NodeIconCache()
 	:
 #if DEBUG
 	SimpleIconCache("Node icon cache aka \"The Dead-Locker\""),
-	fHashTable(20),
-	fElementArray(20)
+	fElementArray(20),
+	fHashTable(20)
 #else
 	SimpleIconCache("Tracker node icon cache"),
-	fHashTable(100),
-	fElementArray(100)
+	fElementArray(100),
+	fHashTable(100)
 #endif
 {
 	fHashTable.SetElementVector(&fElementArray);
diff --git a/src/kits/tracker/IconCache.h b/src/kits/tracker/IconCache.h
index d803ba76d9..e14f3fb2e0 100644
--- a/src/kits/tracker/IconCache.h
+++ b/src/kits/tracker/IconCache.h
@@ -262,8 +262,8 @@ public:
 	void RemoveAliasesTo(int32 index);
 
 private:
-	OpenHashTable<SharedCacheEntry, SharedCacheEntryArray> fHashTable;
 	SharedCacheEntryArray fElementArray;
+	OpenHashTable<SharedCacheEntry, SharedCacheEntryArray> fHashTable;
 	BObjectList<BBitmap> fRetiredBitmaps;
 		// icons are drawn asynchronously, can't just delete them right away,
 		// instead have to place them onto the retired bitmap list and wait
@@ -336,8 +336,8 @@ public:
 	void RemoveAliasesTo(int32 index);
 
 private:
-	OpenHashTable<NodeCacheEntry, NodeCacheEntryArray> fHashTable;
 	NodeCacheEntryArray fElementArray;
+	OpenHashTable<NodeCacheEntry, NodeCacheEntryArray> fHashTable;
 };