From 6edb891c8efd1fb055ffce6611704da3906d68ec Mon Sep 17 00:00:00 2001 From: George Burgess IV Date: Mon, 2 May 2016 18:09:19 +0000 Subject: [PATCH] [CFLAA] Fix a use-of-invalid-pointer bug. As shown in the diff, we used to add to CFLAA's cache by doing `Cache[Fn] = buildSetsFrom(Fn)`. `buildSetsFrom(Fn)` may cause `Cache` to reallocate its underlying storage, if this happens and `Cache[Fn]` was evaluated prior to `buildSetsFrom(Fn)`, then we'll store the result to a bad address. Patch by Jia Chen. llvm-svn: 268269 --- llvm/lib/Analysis/CFLAliasAnalysis.cpp | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/llvm/lib/Analysis/CFLAliasAnalysis.cpp b/llvm/lib/Analysis/CFLAliasAnalysis.cpp index 3e3e498..1a6d871 100644 --- a/llvm/lib/Analysis/CFLAliasAnalysis.cpp +++ b/llvm/lib/Analysis/CFLAliasAnalysis.cpp @@ -994,7 +994,12 @@ void CFLAAResult::scan(Function *Fn) { assert(InsertPair.second && "Trying to scan a function that has already been cached"); - Cache[Fn] = buildSetsFrom(Fn); + // Note that we can't do Cache[Fn] = buildSetsFrom(Fn) here: the function call + // may get evaluated after operator[], potentially triggering a DenseMap + // resize and invalidating the reference returned by operator[] + auto FunInfo = buildSetsFrom(Fn); + Cache[Fn] = std::move(FunInfo); + Handles.push_front(FunctionHandle(Fn, this)); } -- 2.7.4