diff options
author | Bill Wendling <isanbard@gmail.com> | 2013-12-14 08:04:09 +0000 |
---|---|---|
committer | Bill Wendling <isanbard@gmail.com> | 2013-12-14 08:04:09 +0000 |
commit | dd36ddfaec578968b163fc4bbb7148921084aa6e (patch) | |
tree | a1d0767c1202161b909dbfdbf430cd3877a07a25 | |
parent | e09cd8d42b7621050d2dcdccc37ee341a1b553d5 (diff) | |
download | llvm-dd36ddfaec578968b163fc4bbb7148921084aa6e.tar.gz llvm-dd36ddfaec578968b163fc4bbb7148921084aa6e.tar.bz2 llvm-dd36ddfaec578968b163fc4bbb7148921084aa6e.tar.xz |
Merging r197178:
------------------------------------------------------------------------
r197178 | hfinkel | 2013-12-12 12:45:24 -0800 (Thu, 12 Dec 2013) | 9 lines
Fix a use-after-free error in GlobalOpt CleanupConstantGlobalUsers
GlobalOpt's CleanupConstantGlobalUsers function uses a worklist array to manage
constant users to be visited. The pointers in this array need to be weak
handles because when we delete a constant array, we may also be holding a
pointer to one of its elements (or an element of one of its elements if we're
dealing with an array of arrays) in the worklist.
Fixes PR17347.
------------------------------------------------------------------------
git-svn-id: https://llvm.org/svn/llvm-project/llvm/branches/release_34@197322 91177308-0d34-0410-b5e6-96231b3b80d8
-rw-r--r-- | lib/Transforms/IPO/GlobalOpt.cpp | 13 | ||||
-rw-r--r-- | test/Transforms/GlobalOpt/array-elem-refs.ll | 32 |
2 files changed, 43 insertions, 2 deletions
diff --git a/lib/Transforms/IPO/GlobalOpt.cpp b/lib/Transforms/IPO/GlobalOpt.cpp index 7e918979ec..2ea89a16d8 100644 --- a/lib/Transforms/IPO/GlobalOpt.cpp +++ b/lib/Transforms/IPO/GlobalOpt.cpp @@ -37,6 +37,7 @@ #include "llvm/Support/GetElementPtrTypeIterator.h" #include "llvm/Support/MathExtras.h" #include "llvm/Support/raw_ostream.h" +#include "llvm/Support/ValueHandle.h" #include "llvm/Target/TargetLibraryInfo.h" #include "llvm/Transforms/Utils/GlobalStatus.h" #include "llvm/Transforms/Utils/ModuleUtils.h" @@ -267,9 +268,17 @@ static bool CleanupPointerRootUsers(GlobalVariable *GV, static bool CleanupConstantGlobalUsers(Value *V, Constant *Init, DataLayout *TD, TargetLibraryInfo *TLI) { bool Changed = false; - SmallVector<User*, 8> WorkList(V->use_begin(), V->use_end()); + // Note that we need to use a weak value handle for the worklist items. When + // we delete a constant array, we may also be holding pointer to one of its + // elements (or an element of one of its elements if we're dealing with an + // array of arrays) in the worklist. + SmallVector<WeakVH, 8> WorkList(V->use_begin(), V->use_end()); while (!WorkList.empty()) { - User *U = WorkList.pop_back_val(); + Value *UV = WorkList.pop_back_val(); + if (!UV) + continue; + + User *U = cast<User>(UV); if (LoadInst *LI = dyn_cast<LoadInst>(U)) { if (Init) { diff --git a/test/Transforms/GlobalOpt/array-elem-refs.ll b/test/Transforms/GlobalOpt/array-elem-refs.ll new file mode 100644 index 0000000000..ec472b0e99 --- /dev/null +++ b/test/Transforms/GlobalOpt/array-elem-refs.ll @@ -0,0 +1,32 @@ +; RUN: opt < %s -S -globalopt | FileCheck %s +target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64-S128" +target triple = "x86_64-unknown-linux-gnu" + +%struct.S = type { i8, i8 } + +@c = internal global i8** bitcast (i8* getelementptr (i8* bitcast ([8 x i8*]* @b to i8*), i64 48) to i8**), align 8 +@b = internal global [8 x i8*] [i8* null, i8* null, i8* null, i8* null, i8* null, i8* null, i8* getelementptr inbounds (%struct.S* @a, i32 0, i32 0), i8* getelementptr (i8* getelementptr inbounds (%struct.S* @a, i32 0, i32 0), i64 1)], align 16 +@a = internal global %struct.S zeroinitializer, align 1 + +; Function Attrs: nounwind uwtable +define signext i8 @foo() #0 { +entry: + %0 = load i8*** @c, align 8 + %1 = load i8** %0, align 8 + %2 = load i8* %1, align 1 + ret i8 %2 + +; CHECK-LABEL: @foo +; CHECK: ret i8 0 +} + +; Function Attrs: nounwind uwtable +define i32 @main() #0 { +entry: + %retval = alloca i32, align 4 + store i32 0, i32* %retval + ret i32 0 +} + +attributes #0 = { nounwind uwtable } + |