From 436dffcbb39f8fa8741b8cc68cdd5776f2a98901 Mon Sep 17 00:00:00 2001 From: Sungun Park Date: Fri, 26 Sep 2025 20:20:34 -0700 Subject: [PATCH] Fix a crash for MaterialCache The parser object was accessed to generate a key after being passed to the lambda using std::move(). This led to a crash on certain platforms (at least on Windows). This change fixes it by creating key first before moving the parser object into the lambda. --- filament/src/MaterialCache.cpp | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/filament/src/MaterialCache.cpp b/filament/src/MaterialCache.cpp index bfd5ee781c..88f3be3ef4 100644 --- a/filament/src/MaterialCache.cpp +++ b/filament/src/MaterialCache.cpp @@ -51,7 +51,14 @@ MaterialDefinition* UTILS_NULLABLE MaterialCache::acquire(FEngine& engine, engine.getShaderLanguage(), data, size); assert_invariant(parser); - return mDefinitions.acquire(Key{parser.get()}, [&engine, parser = std::move(parser)]() mutable { + // The `key` must be constructed using parser.get() before parser is moved into the lambda + // function. This prevents a potential crash or undefined behavior, as accessing a moved-from + // object is unsafe. The validity of the generated key is guaranteed because the + // MaterialDefinition object (which owns the same parser object) created within the lambda is + // subsequently used as the associated value in the map. + const Key key{ parser.get() }; + + return mDefinitions.acquire(key, [&engine, parser = std::move(parser)]() mutable { return MaterialDefinition::create(engine, std::move(parser)); }); }