Skip to content

Commit 3bbc997

Browse files
adrian-prantladrian-prantl
authored
Merge pull request #9692 from adrian-prantl/use-after-free-6.1
[lldb] Fix use-after-free from recent SP refactor found by ASAN
2 parents 3a45ba4 + 3d1996e commit 3bbc997

File tree

11 files changed

+141
-94
lines changed

11 files changed

+141
-94
lines changed

‎lldb/source/Plugins/ExpressionParser/Swift/SwiftExpressionParser.cpp

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1118,14 +1118,16 @@ AddArchetypeTypeAliases(std::unique_ptr<SwiftASTManipulator> &code_manipulator,
11181118
if (!runtime)
11191119
return llvm::createStringError("no runtime");
11201120

1121-
auto &typeref_typesystem = swift_ast_context.GetTypeSystemSwiftTypeRef();
1121+
auto typeref_typesystem = swift_ast_context.GetTypeSystemSwiftTypeRef();
1122+
if (!typeref_typesystem)
1123+
return llvm::createStringError("no typeref typesystem");
11221124

11231125
// Skip this for variadic generic functions.
11241126
ConstString func_name =
11251127
stack_frame.GetSymbolContext(lldb::eSymbolContextFunction)
11261128
.GetFunctionName(Mangled::ePreferMangled);
11271129
if (auto signature = SwiftLanguageRuntime::GetGenericSignature(
1128-
func_name.GetStringRef(), typeref_typesystem))
1130+
func_name.GetStringRef(), *typeref_typesystem))
11291131
if (signature->pack_expansions.size())
11301132
return llvm::createStringError("[AddArchetypeTypeAliases] Variadic "
11311133
"generic functions are not supported.");
@@ -1180,7 +1182,7 @@ AddArchetypeTypeAliases(std::unique_ptr<SwiftASTManipulator> &code_manipulator,
11801182
MetadataPointerInfo &info = pair.getSecond();
11811183

11821184
auto dependent_type =
1183-
typeref_typesystem.CreateGenericTypeParamType(info.depth, info.index);
1185+
typeref_typesystem->CreateGenericTypeParamType(info.depth, info.index);
11841186
auto bound_type =
11851187
runtime->BindGenericTypeParameters(stack_frame, dependent_type);
11861188
if (!bound_type) {

‎lldb/source/Plugins/ExpressionParser/Swift/SwiftExpressionSourceCode.cpp

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -56,10 +56,13 @@ static llvm::Expected<std::string> TransformPackType(
5656
if (!tss)
5757
return llvm::createStringError(llvm::errc::not_supported,
5858
"unexpected typesystem");
59-
auto &ts = tss->GetTypeSystemSwiftTypeRef();
59+
auto ts = tss->GetTypeSystemSwiftTypeRef();
60+
if (!ts)
61+
return llvm::createStringError(llvm::errc::not_supported,
62+
"no typeref typesystem");
6063
using namespace swift::Demangle;
6164
Demangler dem;
62-
NodePointer node = ts.GetCanonicalDemangleTree(
65+
NodePointer node = ts->GetCanonicalDemangleTree(
6366
dem, type.GetMangledTypeName().GetStringRef());
6467

6568
node = TypeSystemSwiftTypeRef::Transform(dem, node, [](NodePointer n) {
@@ -73,7 +76,7 @@ static llvm::Expected<std::string> TransformPackType(
7376
});
7477

7578
bool error = false;
76-
ConstString type_name = ts.RemangleAsType(dem, node).GetMangledTypeName();
79+
ConstString type_name = ts->RemangleAsType(dem, node).GetMangledTypeName();
7780
swift::Demangle::DemangleOptions options;
7881
options = swift::Demangle::DemangleOptions::SimplifiedUIDemangleOptions();
7982
options.DisplayStdlibModule = false;

‎lldb/source/Plugins/ExpressionParser/Swift/SwiftUserExpression.cpp

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -626,13 +626,14 @@ SwiftUserExpression::GetTextAndSetExpressionParser(
626626
return ParseResult::retry_no_bind_generic_params;
627627
}
628628

629-
if (stack_frame) {
629+
auto ts = m_swift_ast_ctx->GetTypeSystemSwiftTypeRef();
630+
if (ts && stack_frame) {
630631
// Extract the generic signature of the context.
631632
ConstString func_name =
632633
stack_frame->GetSymbolContext(lldb::eSymbolContextFunction)
633634
.GetFunctionName(Mangled::ePreferMangled);
634635
m_generic_signature = SwiftLanguageRuntime::GetGenericSignature(
635-
func_name.GetStringRef(), m_swift_ast_ctx->GetTypeSystemSwiftTypeRef());
636+
func_name.GetStringRef(), *ts);
636637
}
637638

638639
if (m_options.GetBindGenericTypes() == lldb::eDontBind &&

‎lldb/source/Plugins/Language/Swift/SwiftLanguage.cpp

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1399,9 +1399,9 @@ std::unique_ptr<Language::TypeScavenger> SwiftLanguage::GetTypeScavenger() {
13991399
if (auto swift_ast_ctx =
14001400
result_type.GetTypeSystem()
14011401
.dyn_cast_or_null<SwiftASTContext>())
1402-
result_type = swift_ast_ctx->GetTypeSystemSwiftTypeRef()
1403-
.GetTypeFromMangledTypename(
1404-
result_type.GetMangledTypeName());
1402+
if (auto ts = swift_ast_ctx->GetTypeSystemSwiftTypeRef())
1403+
result_type = ts->GetTypeFromMangledTypename(
1404+
result_type.GetMangledTypeName());
14051405
}
14061406
results.insert(TypeOrDecl(result_type));
14071407
}

‎lldb/source/Plugins/LanguageRuntime/Swift/SwiftLanguageRuntimeDynamicTypeResolution.cpp

Lines changed: 51 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1470,9 +1470,11 @@ bool SwiftLanguageRuntimeImpl::ForEachSuperClassType(
14701470
ExecutionContext exe_ctx(instance.GetExecutionContextRef());
14711471
LLDBTypeInfoProvider tip(*this, &exe_ctx);
14721472
lldb::addr_t pointer = instance.GetPointerValue();
1473+
auto tr_ts = ts->GetTypeSystemSwiftTypeRef();
1474+
if (!tr_ts)
1475+
return false;
14731476
return reflection_ctx->ForEachSuperClassType(
1474-
&tip, ts->GetTypeSystemSwiftTypeRef().GetDescriptorFinder(),
1475-
pointer, fn);
1477+
&tip, tr_ts->GetDescriptorFinder(), pointer, fn);
14761478
}
14771479

14781480
bool SwiftLanguageRuntime::IsSelf(Variable &variable) {
@@ -1803,7 +1805,9 @@ bool SwiftLanguageRuntimeImpl::GetDynamicTypeAndAddress_Class(
18031805
if (!tss)
18041806
return false;
18051807
address.SetRawAddress(instance_ptr);
1806-
auto &ts = tss->GetTypeSystemSwiftTypeRef();
1808+
auto ts = tss->GetTypeSystemSwiftTypeRef();
1809+
if (!ts)
1810+
return false;
18071811
// Ask the Objective-C runtime about Objective-C types.
18081812
if (tss->IsImportedType(class_type.GetOpaqueQualType(), nullptr))
18091813
if (auto *objc_runtime = SwiftLanguageRuntime::GetObjCRuntime(m_process)) {
@@ -1820,7 +1824,7 @@ bool SwiftLanguageRuntimeImpl::GetDynamicTypeAndAddress_Class(
18201824
// useful to users.
18211825
if (IsPrivateNSClass(node))
18221826
return false;
1823-
class_type_or_name.SetCompilerType(ts.RemangleAsType(dem, node));
1827+
class_type_or_name.SetCompilerType(ts->RemangleAsType(dem, node));
18241828
found = true;
18251829
return true;
18261830
}
@@ -1836,14 +1840,14 @@ bool SwiftLanguageRuntimeImpl::GetDynamicTypeAndAddress_Class(
18361840
return false;
18371841

18381842
const auto *typeref = reflection_ctx->ReadTypeFromInstance(
1839-
instance_ptr, ts.GetDescriptorFinder(), true);
1843+
instance_ptr, ts->GetDescriptorFinder(), true);
18401844

18411845
// If we couldn't find the typeref from the instance, the best we can do is
18421846
// use the static type. This is a valid use case when the binary doesn't
18431847
// contain any metadata (for example, embedded Swift).
1844-
if (!typeref)
1848+
if (!typeref)
18451849
typeref = reflection_ctx->GetTypeRefOrNull(class_type.GetMangledTypeName(),
1846-
ts.GetDescriptorFinder());
1850+
ts->GetDescriptorFinder());
18471851

18481852
if (!typeref) {
18491853
HEALTH_LOG("could not read typeref for type: {0} (instance_ptr = {0:x})",
@@ -1852,7 +1856,7 @@ bool SwiftLanguageRuntimeImpl::GetDynamicTypeAndAddress_Class(
18521856
}
18531857
swift::Demangle::Demangler dem;
18541858
swift::Demangle::NodePointer node = typeref->getDemangling(dem);
1855-
CompilerType dynamic_type = ts.RemangleAsType(dem, node);
1859+
CompilerType dynamic_type = ts->RemangleAsType(dem, node);
18561860
LLDB_LOG(log, "dynamic type of instance_ptr {0:x} is {1}", instance_ptr,
18571861
class_type.GetMangledTypeName());
18581862
class_type_or_name.SetCompilerType(dynamic_type);
@@ -1950,7 +1954,7 @@ bool SwiftLanguageRuntimeImpl::GetDynamicTypeAndAddress_Existential(
19501954
}
19511955

19521956
const swift::reflection::TypeRef *existential_typeref =
1953-
GetTypeRef(existential_type, &tss->GetTypeSystemSwiftTypeRef());
1957+
GetTypeRef(existential_type, tss->GetTypeSystemSwiftTypeRef().get());
19541958
if (!existential_typeref) {
19551959
if (log)
19561960
log->Printf("Could not get existential typeref");
@@ -1995,10 +1999,12 @@ bool SwiftLanguageRuntimeImpl::GetDynamicTypeAndAddress_Existential(
19951999
ThreadSafeReflectionContext reflection_ctx = GetReflectionContext();
19962000
if (!reflection_ctx)
19972001
return false;
1998-
2002+
auto tr_ts = tss->GetTypeSystemSwiftTypeRef();
2003+
if (!tr_ts)
2004+
return false;
19992005
auto pair = reflection_ctx->ProjectExistentialAndUnwrapClass(
20002006
remote_existential, *existential_typeref,
2001-
tss->GetTypeSystemSwiftTypeRef().GetDescriptorFinder());
2007+
tr_ts->GetDescriptorFinder());
20022008
if (use_local_buffer)
20032009
PopLocalBuffer();
20042010

@@ -2011,10 +2017,12 @@ bool SwiftLanguageRuntimeImpl::GetDynamicTypeAndAddress_Existential(
20112017
const swift::reflection::TypeRef *typeref;
20122018
swift::remote::RemoteAddress out_address(nullptr);
20132019
std::tie(typeref, out_address) = *pair;
2014-
auto &ts = tss->GetTypeSystemSwiftTypeRef();
2020+
auto ts = tss->GetTypeSystemSwiftTypeRef();
2021+
if (!ts)
2022+
return false;
20152023
swift::Demangle::Demangler dem;
20162024
swift::Demangle::NodePointer node = typeref->getDemangling(dem);
2017-
class_type_or_name.SetCompilerType(ts.RemangleAsType(dem, node));
2025+
class_type_or_name.SetCompilerType(ts->RemangleAsType(dem, node));
20182026
address.SetRawAddress(out_address.getAddressData());
20192027

20202028
#ifndef NDEBUG
@@ -2057,9 +2065,12 @@ bool SwiftLanguageRuntimeImpl::GetDynamicTypeAndAddress_ExistentialMetatype(
20572065
if (!tss)
20582066
return false;
20592067

2068+
auto tr_ts = tss->GetTypeSystemSwiftTypeRef();
2069+
if (!tr_ts)
2070+
return false;
2071+
20602072
const swift::reflection::TypeRef *type_ref =
2061-
reflection_ctx->ReadTypeFromMetadata(
2062-
ptr, tss->GetTypeSystemSwiftTypeRef().GetDescriptorFinder());
2073+
reflection_ctx->ReadTypeFromMetadata(ptr, tr_ts->GetDescriptorFinder());
20632074

20642075
if (!type_ref)
20652076
return false;
@@ -2076,7 +2087,7 @@ bool SwiftLanguageRuntimeImpl::GetDynamicTypeAndAddress_ExistentialMetatype(
20762087
meta->addChild(node, dem);
20772088
wrapped->addChild(meta,dem);
20782089

2079-
meta_type = tss->GetTypeSystemSwiftTypeRef().RemangleAsType(dem, wrapped);
2090+
meta_type = tr_ts->RemangleAsType(dem, wrapped);
20802091
class_type_or_name.SetCompilerType(meta_type);
20812092
address.SetRawAddress(ptr);
20822093
return true;
@@ -2092,14 +2103,17 @@ CompilerType SwiftLanguageRuntimeImpl::GetTypeFromMetadata(TypeSystemSwift &ts,
20922103
if (!reflection_ctx)
20932104
return {};
20942105

2106+
auto tr_ts = ts.GetTypeSystemSwiftTypeRef();
2107+
if (!tr_ts)
2108+
return {};
2109+
20952110
const swift::reflection::TypeRef *type_ref =
2096-
reflection_ctx->ReadTypeFromMetadata(
2097-
ptr, ts.GetTypeSystemSwiftTypeRef().GetDescriptorFinder());
2111+
reflection_ctx->ReadTypeFromMetadata(ptr, tr_ts->GetDescriptorFinder());
20982112

20992113
using namespace swift::Demangle;
21002114
Demangler dem;
21012115
NodePointer node = type_ref->getDemangling(dem);
2102-
return ts.GetTypeSystemSwiftTypeRef().RemangleAsType(dem, node);
2116+
return tr_ts->RemangleAsType(dem, node);
21032117
}
21042118

21052119
std::optional<lldb::addr_t>
@@ -2171,9 +2185,13 @@ CompilerType SwiftLanguageRuntimeImpl::BindGenericTypeParameters(
21712185
Demangler dem;
21722186
NodePointer unbound_node =
21732187
dem.demangleSymbol(unbound_type.GetMangledTypeName().GetStringRef());
2188+
2189+
auto tr_ts = ts->GetTypeSystemSwiftTypeRef();
2190+
if (!tr_ts)
2191+
return unbound_type;
2192+
21742193
auto type_ref = reflection_ctx->GetTypeRefOrNull(
2175-
dem, unbound_node,
2176-
ts->GetTypeSystemSwiftTypeRef().GetDescriptorFinder());
2194+
dem, unbound_node, tr_ts->GetDescriptorFinder());
21772195
if (!type_ref) {
21782196
LLDB_LOG(GetLog(LLDBLog::Expressions | LLDBLog::Types),
21792197
"Couldn't get TypeRef of unbound type");
@@ -2198,7 +2216,7 @@ CompilerType SwiftLanguageRuntimeImpl::BindGenericTypeParameters(
21982216

21992217
const auto *type_ref = reflection_ctx->GetTypeRefOrNull(
22002218
type.GetMangledTypeName().GetStringRef(),
2201-
ts->GetTypeSystemSwiftTypeRef().GetDescriptorFinder());
2219+
tr_ts->GetDescriptorFinder());
22022220
if (!type_ref) {
22032221
LLDB_LOG(GetLog(LLDBLog::Expressions | LLDBLog::Types),
22042222
"Couldn't get TypeRef when binding generic type parameters.");
@@ -2216,9 +2234,9 @@ CompilerType SwiftLanguageRuntimeImpl::BindGenericTypeParameters(
22162234
const swift::reflection::TypeRef *bound_type_ref =
22172235
reflection_ctx->ApplySubstitutions(
22182236
type_ref, substitutions,
2219-
ts->GetTypeSystemSwiftTypeRef().GetDescriptorFinder());
2237+
tr_ts->GetDescriptorFinder());
22202238
NodePointer node = bound_type_ref->getDemangling(dem);
2221-
return ts->GetTypeSystemSwiftTypeRef().RemangleAsType(dem, node);
2239+
return tr_ts->RemangleAsType(dem, node);
22222240
}
22232241

22242242
CompilerType
@@ -2932,6 +2950,9 @@ SwiftLanguageRuntimeImpl::GetTypeRef(CompilerType type,
29322950
if (it != known_types_with_redefined_modules.end())
29332951
mangled_name = it->second;
29342952

2953+
if (!module_holder)
2954+
return nullptr;
2955+
29352956
swift::Demangle::NodePointer node =
29362957
module_holder->GetCanonicalDemangleTree(dem, mangled_name);
29372958
if (!node)
@@ -2971,6 +2992,9 @@ SwiftLanguageRuntimeImpl::GetSwiftRuntimeTypeInfo(
29712992
auto ts = type.GetTypeSystem().dyn_cast_or_null<TypeSystemSwift>();
29722993
if (!ts)
29732994
return nullptr;
2995+
auto tr_ts = ts->GetTypeSystemSwiftTypeRef();
2996+
if (!tr_ts)
2997+
return nullptr;
29742998

29752999
// Resolve all type aliases.
29763000
type = type.GetCanonicalType();
@@ -2988,8 +3012,7 @@ SwiftLanguageRuntimeImpl::GetSwiftRuntimeTypeInfo(
29883012
// BindGenericTypeParameters imports the type into the scratch
29893013
// context, but we need to resolve (any DWARF links in) the typeref
29903014
// in the original module.
2991-
const swift::reflection::TypeRef *type_ref =
2992-
GetTypeRef(type, &ts->GetTypeSystemSwiftTypeRef());
3015+
const swift::reflection::TypeRef *type_ref = GetTypeRef(type, tr_ts.get());
29933016
if (!type_ref)
29943017
return nullptr;
29953018

@@ -3001,9 +3024,8 @@ SwiftLanguageRuntimeImpl::GetSwiftRuntimeTypeInfo(
30013024
return nullptr;
30023025

30033026
LLDBTypeInfoProvider provider(*this, exe_scope);
3004-
return reflection_ctx->GetTypeInfo(
3005-
type_ref, &provider,
3006-
ts->GetTypeSystemSwiftTypeRef().GetDescriptorFinder());
3027+
return reflection_ctx->GetTypeInfo(type_ref, &provider,
3028+
tr_ts->GetDescriptorFinder());
30073029
}
30083030

30093031
bool SwiftLanguageRuntimeImpl::IsStoredInlineInBuffer(CompilerType type) {

0 commit comments

Comments
 (0)