[all-commits] [llvm/llvm-project] bb02a6: [Coroutines] Use destroy slot for CoroElide resume...

[Yuxuan Chen via All-commits]

  Branch: refs/heads/users/yuxuanchen1997/fix-coro-halo-suspend-never-bad-free
  Home:   https://github.com/llvm/llvm-project
  Commit: bb02a61d6f5170726d61db06590185de9ba832d5
      https://github.com/llvm/llvm-project/commit/bb02a61d6f5170726d61db06590185de9ba832d5
  Author: Yuxuan Chen <i at yuxuan.ch>
  Date:   2026-07-07 (Tue, 07 Jul 2026)

  Changed paths:
    M clang/test/CodeGenCoroutines/coro-elide.cpp
    M clang/test/CodeGenCoroutines/coro-halo.cpp
    A clang/test/CodeGenCoroutines/gh188230-coro-await-elidable-suspend-never-final.cpp
    M llvm/lib/Transforms/Coroutines/CoroSplit.cpp
    M llvm/test/Transforms/Coroutines/coro-alloc-with-param-O0.ll
    M llvm/test/Transforms/Coroutines/coro-alloc-with-param-O2.ll
    M llvm/test/Transforms/Coroutines/coro-alloca-07.ll
    M llvm/test/Transforms/Coroutines/coro-await-suspend-lower-invoke.ll
    M llvm/test/Transforms/Coroutines/coro-await-suspend-lower.ll
    M llvm/test/Transforms/Coroutines/coro-eh-aware-edge-split-01.ll
    M llvm/test/Transforms/Coroutines/coro-eh-aware-edge-split-02.ll
    M llvm/test/Transforms/Coroutines/coro-frame-arrayalloca.ll
    M llvm/test/Transforms/Coroutines/coro-frame.ll
    M llvm/test/Transforms/Coroutines/coro-padding.ll
    M llvm/test/Transforms/Coroutines/coro-readnone-02.ll
    M llvm/test/Transforms/Coroutines/coro-spill-corobegin.ll
    M llvm/test/Transforms/Coroutines/coro-spill-promise-02.ll
    M llvm/test/Transforms/Coroutines/coro-spill-promise.ll
    M llvm/test/Transforms/Coroutines/coro-spill-suspend.ll
    M llvm/test/Transforms/Coroutines/coro-split-00.ll
    M llvm/test/Transforms/Coroutines/coro-split-02.ll
    M llvm/test/Transforms/Coroutines/coro-split-addrspace.ll
    M llvm/test/Transforms/Coroutines/coro-split-hidden.ll
    A llvm/test/Transforms/Coroutines/coro-split-resume-fallthrough-destroy-slot.ll
    M llvm/test/Transforms/Coroutines/coro-split-sink-lifetime-01.ll
    M llvm/test/Transforms/Coroutines/coro-split-sink-lifetime-02.ll
    M llvm/test/Transforms/Coroutines/coro-split-sink-lifetime-03.ll
    M llvm/test/Transforms/Coroutines/coro-split-sink-lifetime-04.ll
    M llvm/test/Transforms/Coroutines/coro-split-tbaa-md.ll
    M llvm/test/Transforms/Coroutines/coro-zero-alloca.ll

  Log Message:
  -----------
  [Coroutines] Use destroy slot for CoroElide resume fallthrough

Fixes https://github.com/llvm/llvm-project/issues/188230

When a switch coroutine is allocation-elided, resuming it can run through to a coro.end path and destroy the coroutine frame from inside the resume clone. That is fine for a heap-allocated frame, but it is wrong for the clang::coro_await_elidable CoroElide path: the caller may have supplied stack storage through the noalloc ramp. In that case, the frame's destroy slot is initialized to the cleanup clone, while the resume clone still emitted the normal coro.free/deallocation sequence and attempted to free storage owned by the caller.

Prepare the frame destroy slot for switch resume clones and pass it into coro.end lowering. The individual coro.end lowering decides whether to use it: null-frame fallthrough coro.end paths tail-call the cached destroy/cleanup function, while ordinary non-null-frame suspend returns still just return. This keeps the frame slot as the runtime discriminator: elided frames dispatch to cleanup and heap frames dispatch to destroy.

The resume clone preloads the destroy slot in its entry block because user code before coro.end may resume a continuation that completes and frees the parent frame containing the elided callee frame. Loading the slot only at coro.end is therefore too late and can become a use-after-free under ASan.

Add an IR regression for the split lowering and a C++ CodeGen regression for the original suspend_never final_suspend shape. The C++ test forces CoroAnnotationElide with -coro-elide-branch-ratio=0 because the current branch-frequency heuristic may otherwise skip the elision and hide the bug, and it also checks the ASan-instrumented IR shape.

Assisted-By: Codex GPT 5.5



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications