From 3d81e0635339d698e598a748406aa24a713a205d Mon Sep 17 00:00:00 2001
From: Avi Kivity <avi@cloudius-systems.com>
Date: Wed, 25 Feb 2015 11:02:00 +0200
Subject: [PATCH] shared_ptr: fix dynamic_pointer_cast() dropping a ref after
 failure

If the input to dynamic_pointer_cast() faild the conversion, we leaked
a reference to the input object.
---
 core/shared_ptr.hh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/core/shared_ptr.hh b/core/shared_ptr.hh
index 33fa6be4d08..e40137df73d 100644
--- a/core/shared_ptr.hh
+++ b/core/shared_ptr.hh
@@ -282,8 +282,7 @@ private:
         ++_b->count;
     }
     shared_ptr(shared_ptr_count_base* b, T* p) noexcept : _b(b), _p(p) {
-        // test _p, not _b, since dynamic_pointer_cast<>() can zero p but not b
-        if (_p) {
+        if (_b) {
             ++_b->count;
         }
     }
@@ -436,7 +435,8 @@ template <typename T, typename U>
 inline
 shared_ptr<T>
 dynamic_pointer_cast(const shared_ptr<U>& p) {
-    return shared_ptr<T>(p._b, dynamic_cast<T*>(p._p));
+    auto q = dynamic_cast<T*>(p._p);
+    return shared_ptr<T>(q ? p._b : nullptr, q);
 }
 
 template <typename T, typename U>