<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/131325>131325</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            [Clang][Driver] Use-after free in CreateOffloadingDeviceToolChains
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            clang:frontend
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
            jhuber6
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          Meinersbur
      </td>
    </tr>
</table>

<pre>
    For deducing offload triples, the driver creates some temporary ToolChains here:

https://github.com/llvm/llvm-project/blob/e4a8969e56572371201863594b3a549de2e23f32/clang/lib/Driver/Driver.cpp#L1044-L1047
https://github.com/llvm/llvm-project/blob/e4a8969e56572371201863594b3a549de2e23f32/clang/lib/Driver/Driver.cpp#L1051-L1054

The problem is that the ToolChain is used to index into a cache here: 
https://github.com/llvm/llvm-project/blob/c979ce7e362908a361cee721d2a6db4bcd65be1f/clang/lib/Driver/Compilation.cpp#L63

It is possible that the temporary ToolChains are allocated at the same address. In that case the derived arguments for CudaToolChain are reused for AMDGPUOpenMPToolChain.

Causes the flakiness of the offload-Xarch.c test case here: https://lab.llvm.org/buildbot/#/builders/81/builds/5233 
Other complains here: #126248

Temporay Toolchains introduced here: a17ab7aa3be0b2b2adf992e3754a58f17802491f

Btw, it is super risky to use a StringRef as map index type. Instantiating temporary toolchains is not common, but temporary strings definitely are. https://github.com/llvm/llvm-project/blob/c979ce7e362908a361cee721d2a6db4bcd65be1f/clang/lib/Driver/Driver.cpp#L2570 would be one. More bugs be waiting. 

</pre>
<img width="1" height="1" alt="" src="http://email.email.llvm.org/o/eJzMVc1u4zYQfhr5MoghkZRkHXRIbLhYoEEW7S7Q65AcWdylSIGkkubtC0p2kgXaQ9FDFzBsc0SOvp8ZDsZoLo6oL-qHgrFv4yIpNAVjRX3a4ZJGH_pHMo5ClEvYSa9f-7MPoEkvyrgL-GGwHjWkYGZLsWBHSCOBDuaZAqhAmChC9BNBomn2AcMrfPHeHkc0LsJIgQp-X5T5M6Y0x7xi54KdLyaNi9wrPxXsbO3z7eduDv4bqVSws7ReFuxMAg9d01Hd1C3jbcXK6tDwuhOSYy06TYwYHzgr2FlZdJecyOSDpxXm25-9mueC8V-rUoi7_N3-VKDqKoOqxSbWl5FgDl5amsBESCOmVfo3cXN0iaQheTBO059gXPKAoFCNdFMe_gNF1bWdopZ4w7rygLypFFHLKs2w0VJIpZtaUjX8M8Wjn2ZjMRnvbjwbvvH7lDKB2cdopKV3fn9bRhgI0FqvMJGG686IEwFqHSjGPXxyWw6FkbYapYxCA4bLMpFLEQYf4LhofJcw5w20qpgf3j-efvn89Wkm9_j5bdN-w3vEJVJcMw8WvxtHMYIf1sC1S-7-wKDGvYJE8Qrk5sKPFliU-yz53ocsmlyM1dKn9SG_BSjEgp0P1W2dVzXjPDv6lMbcfn6a7cc2g4LxijVMHK41tGm5Sak2KY1LwetFkX47hVWLskXkkkrJJEM9dB0j3tYC68NQtYeSia4atqQP6SVfA2b1Ly4zBQgmfn_NdbhEAoTfUzDu8hsNgBEmnK_lmV5nyj7FhC4ZTPl-eXc7fYAYwfmU6U3e5XfJJX3YGdf0ETQNxplE9jX7uIf_r8x_7GRWtyW8-MVqkATe0R4efSCQyyXmyAuazH2fjdzpnuuOd7ijvmpF1dVNyZvd2AvWMSxFeeAlrwUN9dBUSnEUrCuHTuid6VnJ6pJXomKi5M1eiqrkHSnOW1JtIwpR0oTGvlXazsS4UF_xirN6Z1GSjdfBsPHi90PwLpHT1wkR-lWxDLwQpTUxxfdsySS7Dpbjerg-FfXDVZH6BF8j3eGQKMAQiMA4OK7D4mlrFeMuJ3o2it6bfLcE2_9rD1dOuTWutJ579lcAAAD__9f_Qoo">