[all-commits] [llvm/llvm-project] 27e304: [Coroutines] Fix CoroElide resume fallthrough cleanup

[Yuxuan Chen via All-commits]

  Branch: refs/heads/users/yuxuanchen1997/fix-coro-halo-suspend-never-bad-free
  Home:   https://github.com/llvm/llvm-project
  Commit: 27e30457faa757259901a8db9f28a179fe18610f
      https://github.com/llvm/llvm-project/commit/27e30457faa757259901a8db9f28a179fe18610f
  Author: Yuxuan Chen <i at yuxuan.ch>
  Date:   2026-07-17 (Fri, 17 Jul 2026)

  Changed paths:
    A clang/test/CodeGenCoroutines/gh188230-coro-await-elidable-suspend-never-final.cpp
    M llvm/include/llvm/Transforms/Coroutines/CoroShape.h
    M llvm/lib/Transforms/Coroutines/CoroSplit.cpp
    M llvm/lib/Transforms/Coroutines/Coroutines.cpp
    M llvm/test/Transforms/Coroutines/coro-split-00.ll
    M llvm/test/Transforms/Coroutines/coro-split-addrspace.ll
    A llvm/test/Transforms/Coroutines/coro-split-resume-fallthrough-destroy-slot.ll

  Log Message:
  -----------
  [Coroutines] Fix CoroElide resume fallthrough cleanup

Fixes https://github.com/llvm/llvm-project/issues/188230

A CoroElide noalloc variant stores the cleanup clone in the frame destroy
slot, while ordinary ramp entry stores the destroy clone. A resume clone
that falls through to coro.end previously loaded that slot after running
user cleanup and tail-called the selected clone. The continuation can free
the enclosing frame before that late load, producing an ASan use-after-free.
Moreover, both the destroy and cleanup clones repeat the promise cleanup
already performed by the resume clone, so heap entry double-destroys the
promise.

Cache the destroy slot on resume entry, before user code can resume a
continuation. Use the cached value only to distinguish an elided frame from
a heap frame and make the existing coro.free result null for the elided case.
The resume clone then performs shared cleanup once and directly frees only a
heap frame. This is enabled only when CoroElide creates a noalloc variant,
since other switch coroutines cannot receive an elided frame. Register the
cleanup clone before the resume clone in LazyCallGraph because the comparison
adds a resume-to-cleanup reference.

Cover the behavior in the split tests, including a non-default function
address space, and in the C++ regression with and without ASan instrumentation.

Assisted-By: Codex GPT 5.5



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications