Skip to content

Fix another use-after-free in SILCombine #34168

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Oct 6, 2020

Conversation

meg-gupta
Copy link
Contributor

@meg-gupta meg-gupta commented Oct 2, 2020

swift::endLifetimeAtFrontier also needs to use swift::emitDestroyOperation and delete instructions via callbacks that
can correctly remove it from the worklist that SILCombine maintains.

swift::endLifetimeAtFrontier also needs to use
swift::emitDestroyOperation and delete instructions via callbacks that
can correctly remove it from the worklist that SILCombine maintains
@meg-gupta meg-gupta requested a review from eeckstein October 2, 2020 21:16
@meg-gupta
Copy link
Contributor Author

@swift-ci smoke test

@atrick
Copy link
Contributor

atrick commented Oct 2, 2020

I can't make sense of this design. Why is the builder deleting anything? And why would we pass around callbacks in addition to a builder? The builder is only supposed to create instructions (or find an existing instruction to use), and it keeps a track of any new instructions it creates. Basic SIL utilities, which often take a builder, shouldn't delete anything either, and shouldn't need to take any callbacks. If SILCombine needs to know about new instructions, it can get that from the builder's context.

@meg-gupta
Copy link
Contributor Author

@atrick this is a follow-up of #34145 which has more context. SILBuilder has several api's that deletes instructions. See SILBuilder::emitStrongReleaseAndFold, SILBuilder::emitReleaseValueAndFold. I think these were added several years back before a powerful ARC optimizer. My first attempt at fixing this issue was to get rid of "folding" in the SILBuilder apis. Several tests need to be updated in -Onone because guaranteed opts at -Onone does not catch these "folding" patterns.

@meg-gupta
Copy link
Contributor Author

SILCombine needs to know about the deleted instructions, and some of these apis deceivingly deletes instructions. The right thing would still be to get rid of "folding" by fixing all Onone tests or improving guaranteed arc opts at -Onone which did not look straight-forward at quick glance. This use-after-free is blocking another PR.

@atrick
Copy link
Contributor

atrick commented Oct 2, 2020

@meg-gupta @eeckstein I just want to make it clear that none of these utility APIs should be taking callbacks and the builder should never erase instructions. It's fine for the builder to "fold" a potential new instruction into an existing one. Any other peepholes that the builder does should be in a separate cleanup routine that's called by the pass, given callbacks if needed, given the same BuilderContext, and driven by the list of new instructions.

@meg-gupta
Copy link
Contributor Author

@swift-ci smoke test OS X Platform

@gottesmm
Copy link
Contributor

gottesmm commented Oct 3, 2020

@atrick @meg-gupta my two thoughts are that:

  1. We should consider just removing these folding APIs in the builders. If we need someone to go through the tests, I have a little time I would be happy to do it since I have wanted to do it for 5 years = p.
  2. This PR needs a test.

@atrick
Copy link
Contributor

atrick commented Oct 3, 2020

@gottesmm I looked at the issue with @meg-gupta. The SILBuilder optimizations that delete instructions can be canonicalizations, which means we shouldn't need to update any tests, unless we end up optimizing even more in some cases. That can be a follow up.

Copy link
Contributor

@eeckstein eeckstein left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree, that the SILBuilder APIs which delete instructions are pretty bad and we should remove them.
Until we do that, we have to live with it.

This PR lgtm.
@meg-gupta can you add a test case?

@meg-gupta
Copy link
Contributor Author

@swift-ci smoke test

@meg-gupta
Copy link
Contributor Author

@swift-ci smoke test Linux Platform

@meg-gupta meg-gupta merged commit 0a21c4d into swiftlang:main Oct 6, 2020
ainu-bot added a commit to google/swift that referenced this pull request Oct 6, 2020
* 'main' of github.com:apple/swift:
  Fix another use-after-free in SILCombine (swiftlang#34168)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants