[llvm-commits] [llvm] r165898 - /llvm/trunk/lib/VMCore/LLVMContextImpl.cpp

[Benjamin Kramer]

Author: d0k
Date: Sun Oct 14 03:48:40 2012
New Revision: 165898

URL: http://llvm.org/viewvc/llvm-project?rev=165898&view=rev
Log:
Fix use after free when deleting attributes in a chained folding set.

Can't follow the intrusive linked list when the element is gone.

Modified:
    llvm/trunk/lib/VMCore/LLVMContextImpl.cpp

Modified: llvm/trunk/lib/VMCore/LLVMContextImpl.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/VMCore/LLVMContextImpl.cpp?rev=165898&r1=165897&r2=165898&view=diff
==============================================================================
--- llvm/trunk/lib/VMCore/LLVMContextImpl.cpp (original)
+++ llvm/trunk/lib/VMCore/LLVMContextImpl.cpp Sun Oct 14 03:48:40 2012
@@ -97,9 +97,11 @@
 
   // Destroy attributes.
   for (FoldingSetIterator<AttributesImpl> I = AttrsSet.begin(),
-         E = AttrsSet.end(); I != E; ++I)
-    delete &*I;
-  
+         E = AttrsSet.end(); I != E;) {
+    FoldingSetIterator<AttributesImpl> Elem = I++;
+    delete &*Elem;
+  }
+
   // Destroy MDNodes.  ~MDNode can move and remove nodes between the MDNodeSet
   // and the NonUniquedMDNodes sets, so copy the values out first.
   SmallVector<MDNode*, 8> MDNodes;