[all-commits] [llvm/llvm-project] d9e403: [Coroutines] Cache CoroElide destroy function befo...

[Yuxuan Chen via All-commits]

  Branch: refs/heads/users/yuxuanchen1997/fix-coro-halo-suspend-never-bad-free
  Home:   https://github.com/llvm/llvm-project
  Commit: d9e4032cb72a27cc4ed589e0e6edc8c77dd3ce10
      https://github.com/llvm/llvm-project/commit/d9e4032cb72a27cc4ed589e0e6edc8c77dd3ce10
  Author: Yuxuan Chen <i at yuxuan.ch>
  Date:   2026-07-17 (Fri, 17 Jul 2026)

  Changed paths:
    A clang/test/CodeGenCoroutines/gh188230-coro-await-elidable-suspend-never-final.cpp
    M llvm/include/llvm/Transforms/Coroutines/CoroShape.h
    M llvm/lib/Transforms/Coroutines/CoroSplit.cpp
    M llvm/lib/Transforms/Coroutines/Coroutines.cpp
    M llvm/test/Transforms/Coroutines/coro-split-00.ll
    M llvm/test/Transforms/Coroutines/coro-split-addrspace.ll
    A llvm/test/Transforms/Coroutines/coro-split-resume-fallthrough-destroy-slot.ll

  Log Message:
  -----------
  [Coroutines] Cache CoroElide destroy function before resume

Fixes https://github.com/llvm/llvm-project/issues/188230

A switch coroutine with a CoroElide noalloc variant uses the frame destroy slot as a runtime discriminator: heap-allocated frames store the destroy clone, while allocation-elided frames store the cleanup clone. Its resume clone can reach a fallthrough coro.end after the final suspend.

The coroutine body can invoke a continuation before reaching that coro.end. A suspend_never continuation can complete and free its frame before control returns. When the callee frame was elided into that caller allocation, loading the destroy slot at coro.end reads freed storage, which AddressSanitizer reports as a use-after-free.

Load and cache the destroy function in the switch-resume entry block before executing the resume body, then tail-call the cached value at fallthrough coro.end. The cache retains the frame slot as the allocation discriminator without dereferencing an elided frame after the continuation returns.

Add a runnable ASan regression for the original C++ reproducer and update CoroSplit tests to require the entry load.

Assisted-By: Codex GPT 5.5



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications