[PATCH] D34971: Remove freed InvalidDomains from InvalidDomainMap.

[Maximilian Falkenstein via Phabricator via llvm-commits]

maxf created this revision.

Since r306667, propagateInvalidStmtDomains gets a reference to an
InvalidDomainMap. As part of the branch leading to return false, the respective
domain is freed. It is, however, not removed from the InvalidDomainMap, leaking
a pointer to a freed object which results in a use-after-free. Fix this be
removing the domain from the map before returning.


https://reviews.llvm.org/D34971

Files:
  lib/Analysis/ScopInfo.cpp


Index: lib/Analysis/ScopInfo.cpp
===================================================================
--- lib/Analysis/ScopInfo.cpp
+++ lib/Analysis/ScopInfo.cpp
@@ -2825,6 +2825,7 @@
         continue;
 
       isl_set_free(InvalidDomain);
+      InvalidDomainMap.erase(BB);
       invalidate(COMPLEXITY, TI->getDebugLoc());
       return false;
     }


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D34971.105127.patch
Type: text/x-patch
Size: 353 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20170704/79ff01e6/attachment.bin>