Skip to content

Commit 0c25245

Browse files
committed
Fix a use-after-free in MandatoryInlining
In recordDeadFunction, we look at operands of an instruction to be deleted, and add back the defining instruction of the operands to the worklist. This works in general when we are deleting dead instructions recursively. But we also consider, an instruction with only debug uses as dead. So when we are deleting a debug instruction, we may have already deleted its operand's defining instruction. So it would be incorrect to add it to the worklist.
1 parent b43c671 commit 0c25245

File tree

1 file changed

+13
-0
lines changed

1 file changed

+13
-0
lines changed

lib/SILOptimizer/Mandatory/MandatoryInlining.cpp

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -473,6 +473,19 @@ class ClosureCleanup {
473473
/// This regular instruction deletion callback checks for any function-type
474474
/// values that may be unused after deleting the given instruction.
475475
void recordDeadFunction(SILInstruction *deletedInst) {
476+
// If it is a debug instruction, return.
477+
// In this function, we look at operands of an instruction to be
478+
// deleted, and add back the defining instruction of the operands to the
479+
// worklist if it has a function type. This works in general when we are
480+
// deleting dead instructions recursively.
481+
// But we also consider, an instruction with only debug uses as dead.
482+
// And with eraseFromParentWithDebugInsts, we will be deleting a dead
483+
// instruction with its debug instructions. So when we are deleting a debug
484+
// instruction, we may have already deleted its operand's defining
485+
// instruction. So it would be incorrect to add back its operand's defining
486+
// instruction.
487+
if (deletedInst->isDebugInstruction())
488+
return;
476489
// If the deleted instruction was already recorded as a function producer,
477490
// delete it from the map and record its operands instead.
478491
deadFunctionVals.erase(deletedInst);

0 commit comments

Comments
 (0)