[all-commits] [llvm/llvm-project] 470690: [clang-repl] Fix Value's move ctor releasing stora...

[Vassil Vassilev via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: 4706906ba256bfbb3590ae1eb05ef9cd4b92421a
      https://github.com/llvm/llvm-project/commit/4706906ba256bfbb3590ae1eb05ef9cd4b92421a
  Author: Vassil Vassilev <v.g.vassilev at gmail.com>
  Date:   2026-06-06 (Sat, 06 Jun 2026)

  Changed paths:
    M clang/lib/Interpreter/Value.cpp
    M clang/unittests/Interpreter/InterpreterTest.cpp

  Log Message:
  -----------
  [clang-repl] Fix Value's move ctor releasing storage on construction (#200888)

Value::Value(Value &&) called Release() on the just-moved-into storage,
decrementing the refcount to zero on the only remaining reference.
Subsequent reads -- including ~Value() running clear(), which calls
Release() a second time on the now-freed allocation -- hit
use-after-free.

The move should transfer the existing reference: the source clears
IsManuallyAlloc so its destructor will not Release, and *this assumes
ownership of the same refcount. Neither side needs to Retain or Release
to keep the count correct.

Add a regression test exercising move-construction, move-assignment, and
follow-on copy-construction on a K_PtrOrObj Value. AddressSanitizer
catches the bug without the fix.



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications