[Mlir-commits] [mlir] [mlir] Fix use-after-free bugs in {RankedTensorType|VectorType}::Builder (PR #68969)

Benjamin Maxwell llvmlistbot at llvm.org
Tue Oct 17 03:43:42 PDT 2023


================
@@ -277,7 +277,7 @@ class RankedTensorType::Builder {
     if (storage.empty())
       storage.append(shape.begin(), shape.end());
     storage.erase(storage.begin() + pos);
-    shape = {storage.data(), storage.size()};
+    shape = {};
----------------
MacDue wrote:

>> I think it'll just wrap this pattern in a helper CopyOnWriteArrayRef class, which can be safer, and simplify the builder's code (and ensure consistency there).

> It feels that that's adding complexity to something that was meant to be fairly simple.

It seemed like there was confusion with mixing the logic in the builders, so moving it to a helper class `CopyOnWriteArrayRef<T>`  actually simplifies the builders (and alleviates the concerns about needing the `getShape()/getScalableDims()` methods). 

https://github.com/llvm/llvm-project/pull/68969


More information about the Mlir-commits mailing list