Skip to content

Commit f80f31d

Browse files
committed
fix a use-after-free problem in redundant load elimination
This shows up in an assert in RLE, but is very hard to reproduce. The problem was that the reference to the Values map element is potentially invalidated when assigning to the Values map in this line: Values[Base] = FirstVal.stripLastLevelProjection(); hopefully fixes rdar://problem/29922800
1 parent 9392ac5 commit f80f31d

File tree

1 file changed

+4
-1
lines changed

1 file changed

+4
-1
lines changed

lib/SILOptimizer/Utils/LoadStoreOptUtils.cpp

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,10 @@ LSValue::reduceInner(LSLocation &Base, SILModule *M, LSLocationValueMap &Values,
5858

5959
// This is NOT a leaf node, we need to construct a value for it.
6060
auto Iter = NextLevel.begin();
61-
LSValue &FirstVal = Values[*Iter];
61+
62+
// Don't make this a reference! It may be invalidated as soon as the Values
63+
// map is modified, e.g. later at Values[Base] = ...
64+
LSValue FirstVal = Values[*Iter];
6265

6366
// There is only 1 children node and its value's projection path is not
6467
// empty, keep stripping it.

0 commit comments

Comments
 (0)