Fix use after delete in cleanup_election()

fixes #154

nano/node/active_transactions.cpp

@@ -349,59 +349,59 @@ void nano::active_transactions::request_confirm (nano::unique_lock<nano::mutex>
 	}
 }
 
-void nano::active_transactions::cleanup_election (nano::unique_lock<nano::mutex> & lock_a, nano::election const & election)
+void nano::active_transactions::cleanup_election (nano::unique_lock<nano::mutex> & lock_a, std::shared_ptr<nano::election> election)
 {
 	debug_assert (lock_a.owns_lock ());
 
-	if (!election.confirmed ())
+	if (!election->confirmed ())
 	{
 		node.stats.inc (nano::stat::type::election, nano::stat::detail::election_drop_all);
-		if (election.behavior == election_behavior::hinted)
+		if (election->behavior == election_behavior::hinted)
 		{
 			node.stats.inc (nano::stat::type::election, nano::stat::detail::election_hinted_drop);
 		}
 	}
 	else
 	{
 		node.stats.inc (nano::stat::type::election, nano::stat::detail::election_confirmed_all);
-		if (election.behavior == election_behavior::hinted)
+		if (election->behavior == election_behavior::hinted)
 		{
 			node.stats.inc (nano::stat::type::election, nano::stat::detail::election_hinted_confirmed);
 		}
 	}
 
-	if (election.behavior == election_behavior::hinted)
+	if (election->behavior == election_behavior::hinted)
 	{
 		--active_hinted_elections_count;
 	}
 
-	auto blocks_l = election.blocks ();
+	auto blocks_l = election->blocks ();
 	for (auto const & [hash, block] : blocks_l)
 	{
 		auto erased (blocks.erase (hash));
 		(void)erased;
 		debug_assert (erased == 1);
 		erase_inactive_votes_cache (hash);
 	}
-	roots.get<tag_root> ().erase (roots.get<tag_root> ().find (election.qualified_root));
+	roots.get<tag_root> ().erase (roots.get<tag_root> ().find (election->qualified_root));
 
 	lock_a.unlock ();
 	vacancy_update ();
 	for (auto const & [hash, block] : blocks_l)
 	{
 		// Notify observers about dropped elections & blocks lost confirmed elections
-		if (!election.confirmed () || hash != election.winner ()->hash ())
+		if (!election->confirmed () || hash != election->winner ()->hash ())
 		{
 			node.observers.active_stopped.notify (hash);
 		}
 
-		if (!election.confirmed ())
+		if (!election->confirmed ())
 		{
 			// Clear from publish filter
 			node.network.publish_filter.clear (block);
 		}
 	}
-	node.logger.try_log (boost::str (boost::format ("Election erased for root %1%, confirmed: %2$b") % election.qualified_root.to_string () % election.confirmed ()));
+	node.logger.try_log (boost::str (boost::format ("Election erased for root %1%, confirmed: %2$b") % election->qualified_root.to_string () % election->confirmed ()));
 }
 
 std::vector<std::shared_ptr<nano::election>> nano::active_transactions::list_active (std::size_t max_a)
@@ -1045,7 +1045,7 @@ void nano::active_transactions::erase (nano::qualified_root const & root_a)
 	auto root_it (roots.get<tag_root> ().find (root_a));
 	if (root_it != roots.get<tag_root> ().end ())
 	{
-		cleanup_election (lock, *root_it->election);
+		cleanup_election (lock, root_it->election);
 	}
 }
 
@@ -1063,7 +1063,7 @@ void nano::active_transactions::erase_oldest ()
 	{
 		node.stats.inc (nano::stat::type::election, nano::stat::detail::election_drop_overflow);
 		auto item = roots.get<tag_random_access> ().front ();
-		cleanup_election (lock, *item.election);
+		cleanup_election (lock, item.election);
 	}
 }
 

nano/node/active_transactions.hpp

@@ -233,7 +233,7 @@ class active_transactions final
 	void request_confirm (nano::unique_lock<nano::mutex> &);
 	void erase (nano::qualified_root const &);
 	// Erase all blocks from active and, if not confirmed, clear digests from network filters
-	void cleanup_election (nano::unique_lock<nano::mutex> & lock_a, nano::election const &);
+	void cleanup_election (nano::unique_lock<nano::mutex> & lock_a, std::shared_ptr<nano::election>);
 	// Returns a list of elections sorted by difficulty, mutex must be locked
 	std::vector<std::shared_ptr<nano::election>> list_active_impl (std::size_t) const;