Skip to content

Commit 300ba4c

Browse files
committed
[6.2] LoopRotate: Fix a by reference map bug under reallocation
Issue: When using a densemap subscript expression on both sides of an assignment in the same statement of the same map we run into the issue that the map can reallocate because of the assignment but we are referencing the value of the RHS map subscript by reference -- i.e we can reference deallocated memory. Not good. Scope: A "silent" memory error that one might run into including the reporter of the bug. Risk: Extremely, low. The fix is spliting an assignment from a map value to a map entry into: A value assignment of the map value to a local. And then storing the local in the map entry forgoing the reference of reallocated memory bug. ``` valueMap[bfi] = valueMap[bfi->getBorrowedValue()]; => auto mappedMValue = valueMap[bfi->getBorrowedValue()]; valueMap[bfi] = mappedValue; ``` Reviewed by: Meghana G, Erik E., Joe G. Testing: The fix was tested on the reporting project. rdar://151031297
1 parent 18a3f08 commit 300ba4c

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

lib/SILOptimizer/LoopTransforms/LoopRotate.cpp

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -428,7 +428,8 @@ static bool rotateLoop(SILLoop *loop, DominanceInfo *domInfo,
428428

429429
for (auto &inst : *header) {
430430
if (auto *bfi = dyn_cast<BorrowedFromInst>(&inst)) {
431-
valueMap[bfi] = valueMap[bfi->getBorrowedValue()];
431+
auto mappedValue = valueMap[bfi->getBorrowedValue()];
432+
valueMap[bfi] = mappedValue;
432433
} else if (SILInstruction *cloned = inst.clone(preheaderBranch)) {
433434
mapOperands(cloned, valueMap);
434435

0 commit comments

Comments
 (0)