@@ -5,6 +5,8 @@ sil_stage canonical
5
5
6
6
import Builtin
7
7
8
+ sil @guaranteed_user : $@convention(thin) (@guaranteed Builtin.NativeObject) -> ()
9
+
8
10
// This checks if the dataflow verifier asserts when we have two consuming users
9
11
// in the same block.
10
12
// CHECK-LABEL: Function: 'double_consume_same_bb'
@@ -83,3 +85,41 @@ bb0(%0 : $Builtin.NativeObject):
83
85
return %9999 : $()
84
86
}
85
87
88
+ // We have a use of a borrowed value after an end_borrow. This is effectively a
89
+ // use after consume.
90
+ //
91
+ // CHECK-LABEL: Function: 'use_after_end_borrow'
92
+ // CHECK: Found use after free?!
93
+ // CHECK: Value: %1 = begin_borrow %0 : $Builtin.NativeObject
94
+ // CHECK: Consuming User: end_borrow %1 from %0 : $Builtin.NativeObject, $Builtin.NativeObject
95
+ // CHECK: Non Consuming User: %4 = apply %2(%1) : $@convention(thin) (@guaranteed Builtin.NativeObject) -> ()
96
+ // CHECK: Block: bb0
97
+ sil @use_after_end_borrow : $@convention(thin) (@owned Builtin.NativeObject) -> () {
98
+ bb0(%0 : $Builtin.NativeObject):
99
+ %1 = begin_borrow %0 : $Builtin.NativeObject
100
+ %2 = function_ref @guaranteed_user : $@convention(thin) (@guaranteed Builtin.NativeObject) -> ()
101
+ end_borrow %1 from %0 : $Builtin.NativeObject, $Builtin.NativeObject
102
+ apply %2(%1) : $@convention(thin) (@guaranteed Builtin.NativeObject) -> ()
103
+ destroy_value %0 : $Builtin.NativeObject
104
+ %9999 = tuple()
105
+ return %9999 : $()
106
+ }
107
+
108
+ // We have a destroy value of an owned value before a borrow of the owned value
109
+ // has finished.
110
+ //
111
+ // CHECK-LABEL: Function: 'destroy_before_end_borrow'
112
+ // CHECK: Found use after free?!
113
+ // CHECK: Value: %0 = argument of bb0 : $Builtin.NativeObject
114
+ // CHECK: Consuming User: destroy_value %0 : $Builtin.NativeObject
115
+ // CHECK: Non Consuming User: end_borrow %1 from %0 : $Builtin.NativeObject, $Builtin.NativeObject
116
+ // CHECK: Block: bb0
117
+ sil @destroy_before_end_borrow : $@convention(thin) (@owned Builtin.NativeObject) -> () {
118
+ bb0(%0 : $Builtin.NativeObject):
119
+ %1 = begin_borrow %0 : $Builtin.NativeObject
120
+ %2 = function_ref @guaranteed_user : $@convention(thin) (@guaranteed Builtin.NativeObject) -> ()
121
+ destroy_value %0 : $Builtin.NativeObject
122
+ end_borrow %1 from %0 : $Builtin.NativeObject, $Builtin.NativeObject
123
+ %9999 = tuple()
124
+ return %9999 : $()
125
+ }
0 commit comments