-
Notifications
You must be signed in to change notification settings - Fork 10.5k
Fix ForEachLoopUnroll use-after-free miscompile. #35302
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
This pass generated incorrect borrow scopes: %stack = alloc_stack %borrow = begin_borrow %element store_borrow %borrow to %stack end_borrow %borrow try_apply %f(%stack) normal bb1, error bb2 ... destroy_value %element This was not showing up as a miscompile before because: - an array holds an extra copy of the unrolled elements, that array is now being optimized away completely. - CopyPropagation now canonicalizes OSSA lifetimes independent of unrelated program side effects. So, since there is no explicit relationship between %borrow and the OSSA value in %stack, we end up with: %stack = alloc_stack %borrow = begin_borrow %element store_borrow %borrow to %stack end_borrow %borrow destroy_value %element try_apply %f(%stack) normal bb1, error bb2 Fixes rdar://72904101 ([CanonicalOSSA] Fix ForEachLoopUnroll use-after-free miscompile.)
@swift-ci test |
@swift-ci benchmark |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
lgtm
Build failed |
Performance: -O
Code size: -OPerformance: -Osize
Code size: -OsizePerformance: -Onone
Code size: -swiftlibsHow to read the dataThe tables contain differences in performance which are larger than 8% and differences in code size which are larger than 1%.If you see any unexpected regressions, you should consider fixing the Noise: Sometimes the performance results (not code size!) contain false Hardware Overview
|
@swift-ci smoke test linux |
@swift-ci smoke test windows |
Build failed |
@swift-ci smoke test |
This pass generated incorrect borrow scopes:
%stack = alloc_stack
%borrow = begin_borrow %element
store_borrow %borrow to %stack
end_borrow %borrow
try_apply %f(%stack) normal bb1, error bb2
...
destroy_value %element
This was not showing up as a miscompile before because:
an array holds an extra copy of the unrolled elements, that array is
now being optimized away completely.
CopyPropagation now canonicalizes OSSA lifetimes independent of
unrelated program side effects.
So, since there is no explicit relationship between %borrow and the
OSSA value in %stack, we end up with:
%stack = alloc_stack
%borrow = begin_borrow %element
store_borrow %borrow to %stack
end_borrow %borrow
destroy_value %element
try_apply %f(%stack) normal bb1, error bb2
Fixes rdar://72904101 ([CanonicalOSSA] Fix ForEachLoopUnroll use-after-free miscompile.)