Page MenuHomePhabricator

[InstCombine] Avoid use after free in DenseMap, when built with GCC
ClosedPublic

Authored by mstorsjo on May 29 2019, 1:18 PM.

Details

Summary

In a statement like Map[A] = Map[B], first the right hand side is evaluated as a reference, then left hand side is evaluated. If the left hand side operator[] invocation grows the map, the previous reference may be invalidated.

GCC seems to dereference the right hand side reference only after evaluating the left hand side, while Clang dereferences it before. (If the value type is larger type, Clang also dereferences it after the left hand side operator[] call.)

With GCC, a cast to Value* isn't enough to make it dereference the right hand side reference before invoking (while that is enough to make Clang/LLVM do the right thing for larger types), but storing it in an intermediate variable in a separate statement works.

Diff Detail

Repository
rL LLVM

Event Timeline

mstorsjo created this revision.May 29 2019, 1:18 PM
Herald added a project: Restricted Project. · View Herald TranscriptMay 29 2019, 1:18 PM

FWIW, I can provide a small repro case that highlights the issue and file it as a bug, if you want.

Testcase and slightly longer description is available at https://bugs.llvm.org/show_bug.cgi?id=42065.

sbaranga accepted this revision.May 30 2019, 4:09 AM

Thanks, LGTM!

This revision is now accepted and ready to land.May 30 2019, 4:09 AM
This revision was automatically updated to reflect the committed changes.