Skip to content

Commit c65fe25

Browse files
smeenailanza
authored andcommitted
[CIR][ABI] Fix use after free from erasing while iterating (llvm#854)
The loop was erasing the user of a value while iterating on the value's users, which results in a use after free. We're already assuming (and asserting) that there's only one user, so we can just access it directly instead. CIR/Transforms/Target/x86_64/x86_64-call-conv-lowering-pass.cpp was failing with ASAN before this change. We're now ASAN-clean except for llvm#829 (which is also in progress).
1 parent 2903b14 commit c65fe25

1 file changed

Lines changed: 5 additions & 8 deletions

File tree

clang/lib/CIR/Dialect/Transforms/TargetLowering/LowerFunction.cpp

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -386,14 +386,11 @@ LowerFunction::buildFunctionProlog(const LowerFunctionInfo &FI, FuncOp Fn,
386386
// the argument is used only to be stored in a alloca.
387387
Value arg = SrcFn.getArgument(ArgNo);
388388
assert(arg.hasOneUse());
389-
for (auto *firstStore : arg.getUsers()) {
390-
assert(isa<StoreOp>(firstStore));
391-
auto argAlloca = cast<StoreOp>(firstStore).getAddr();
392-
rewriter.replaceAllUsesWith(argAlloca, Alloca);
393-
rewriter.eraseOp(firstStore);
394-
rewriter.eraseOp(argAlloca.getDefiningOp());
395-
}
396-
389+
auto *firstStore = *arg.user_begin();
390+
auto argAlloca = cast<StoreOp>(firstStore).getAddr();
391+
rewriter.replaceAllUsesWith(argAlloca, Alloca);
392+
rewriter.eraseOp(firstStore);
393+
rewriter.eraseOp(argAlloca.getDefiningOp());
397394
break;
398395
}
399396
default:

0 commit comments

Comments
 (0)