[SelectionDAG] Fix use-after-free introduced in D130881

[zero9178]

Summary

The code introduced in https://reviews.llvm.org/D130881 has a bug as it may cause a use-after-free error that can be caught by ASAN.
The bug essentially boils down to iterator invalidation of DenseMap. The expression SDEI[To] = I->second; may cause SDEI to grow if To is inserted for the very first time. When that happens, all existing iterators to the map are invalidated as their backing storage has been freed. Accessing I->second is then invalid and attempts to access freed memory (as I is an iterator of SDEI).

This patch fixes that quite simply by first making a copy of I->second, and then moving into the possibly newly inserted KV of the DenseMap.

No test attached as I am not sure it is practible to test.

---

Downstream ASAN failure for reference:
https://github.com/zero9178/Pylir/actions/runs/3165945057/jobs/5155328897

As can nicely be seen in the stacktrace, the memor is freed by operator[] and the accessed by operator= afterwards

[melver]

Thanks for the fix!

llvm/lib/CodeGen/SelectionDAG/SelectionDAG.cpp

SDValue SelectionDAG::getNeutralElement(unsigned Opcode, const SDLoc &DL,
   }
 }
 
 void SelectionDAG::copyExtraInfo(SDNode *From, SDNode *To) {
   assert(From && To && "Invalid SDNode; empty source SDValue?");
   auto I = SDEI.find(From);
   if (I == SDEI.end())
     return;
-  SDEI[To] = I->second;
+
+  // Use of operator[] on the DenseMap may cause an insertion, which invalidates
+  // the iterator, hence the need to make a copy to prevent a use-after-free.
+  NodeExtraInfo Copy = I->second;
+  SDEI[To] = std::move(Copy);
 }
 
 #ifndef NDEBUG
 static void checkForCyclesHelper(const SDNode *N,
                                  SmallPtrSetImpl<const SDNode*> &Visited,
                                  SmallPtrSetImpl<const SDNode*> &Checked,
                                  const llvm::SelectionDAG *DAG) {
   // If this node has already been checked, don't check it again.