[polly] r307499 - Remove freed InvalidDomains from InvalidDomainMap.

[Tobias Grosser via llvm-commits]

Author: grosser
Date: Sun Jul  9 08:47:17 2017
New Revision: 307499

URL: http://llvm.org/viewvc/llvm-project?rev=307499&view=rev
Log:
Remove freed InvalidDomains from InvalidDomainMap.

Summary:
Since r306667, propagateInvalidStmtDomains gets a reference to an
InvalidDomainMap. As part of the branch leading to return false, the respective
domain is freed. It is, however, not removed from the InvalidDomainMap, leaking
a pointer to a freed object which results in a use-after-free. Fix this be
removing the domain from the map before returning.

We tried to derive a test case that reliably failes, but did not succeed in
producing one. Hence, for now the failures in our LNT bots must be sufficient
to keep this issue tested.

Reviewers: grosser, Meinersbur, bollu

Subscribers: bollu, nandini12396, pollydev, llvm-commits

Differential Revision: https://reviews.llvm.org/D34971

Modified:
    polly/trunk/lib/Analysis/ScopInfo.cpp

Modified: polly/trunk/lib/Analysis/ScopInfo.cpp
URL: http://llvm.org/viewvc/llvm-project/polly/trunk/lib/Analysis/ScopInfo.cpp?rev=307499&r1=307498&r2=307499&view=diff
==============================================================================
--- polly/trunk/lib/Analysis/ScopInfo.cpp (original)
+++ polly/trunk/lib/Analysis/ScopInfo.cpp Sun Jul  9 08:47:17 2017
@@ -2825,6 +2825,7 @@ bool Scop::propagateInvalidStmtDomains(
         continue;
 
       isl_set_free(InvalidDomain);
+      InvalidDomainMap.erase(BB);
       invalidate(COMPLEXITY, TI->getDebugLoc());
       return false;
     }