[InstCombine] Avoid use after free in DenseMap, when built with GCC

[mstorsjo]

Summary

In a statement like Map[A] = Map[B], first the right hand side is evaluated as a reference, then left hand side is evaluated. If the left hand side operator[] invocation grows the map, the previous reference may be invalidated.

GCC seems to dereference the right hand side reference only after evaluating the left hand side, while Clang dereferences it before. (If the value type is larger type, Clang also dereferences it after the left hand side operator[] call.)

With GCC, a cast to Value* isn't enough to make it dereference the right hand side reference before invoking (while that is enough to make Clang/LLVM do the right thing for larger types), but storing it in an intermediate variable in a separate statement works.

[mstorsjo]

FWIW, I can provide a small repro case that highlights the issue and file it as a bug, if you want.

[mstorsjo]

Testcase and slightly longer description is available at https://bugs.llvm.org/show_bug.cgi?id=42065.

[sbaranga]

Thanks, LGTM!

lib/Transforms/InstCombine/InstCombineCompares.cpp

static Value *rewriteGEPAsOffset(Value *Start, Value *Base,
 
   // Create all the other instructions.
   for (Value *Val : Explored) {
 
     if (NewInsts.find(Val) != NewInsts.end())
       continue;
 
     if (auto *CI = dyn_cast<CastInst>(Val)) {
-      NewInsts[CI] = NewInsts[CI->getOperand(0)];
+      // Don't get rid of the intermediate variable here; the store can grow
+      // the map which will invalidate the reference to the input value.
+      Value *V = NewInsts[CI->getOperand(0)];
+      NewInsts[CI] = V;
       continue;
     }
     if (auto *GEP = dyn_cast<GEPOperator>(Val)) {
       Value *Index = NewInsts[GEP->getOperand(1)] ? NewInsts[GEP->getOperand(1)]
                                                   : GEP->getOperand(1);
       setInsertionPoint(Builder, GEP);
       // Indices might need to be sign extended. GEPs will magically do
       // this, but we need to do it ourselves here.