[all-commits] [llvm/llvm-project] 055ab0: [Coroutines] Use destroy slot for CoroElide resume...

[Yuxuan Chen via All-commits]

  Branch: refs/heads/users/yuxuanchen1997/fix-coro-halo-suspend-never-bad-free
  Home:   https://github.com/llvm/llvm-project
  Commit: 055ab022b52c0813fb7c5aec22aafa1855507553
      https://github.com/llvm/llvm-project/commit/055ab022b52c0813fb7c5aec22aafa1855507553
  Author: Yuxuan Chen <i at yuxuan.ch>
  Date:   2026-07-17 (Fri, 17 Jul 2026)

  Changed paths:
    A clang/test/CodeGenCoroutines/gh188230-coro-await-elidable-suspend-never-final.cpp
    M llvm/include/llvm/Transforms/Coroutines/CoroShape.h
    M llvm/lib/Transforms/Coroutines/CoroSplit.cpp
    M llvm/lib/Transforms/Coroutines/Coroutines.cpp
    M llvm/test/Transforms/Coroutines/coro-split-00.ll
    M llvm/test/Transforms/Coroutines/coro-split-addrspace.ll
    A llvm/test/Transforms/Coroutines/coro-split-resume-fallthrough-destroy-slot.ll

  Log Message:
  -----------
  [Coroutines] Use destroy slot for CoroElide resume fallthrough

Fixes https://github.com/llvm/llvm-project/issues/188230

A switch coroutine with a CoroElide noalloc variant uses the frame destroy slot as a runtime discriminator: heap-allocated frames store the destroy clone, while allocation-elided frames store the cleanup clone. Its resume clone can reach a fallthrough coro.end after the final suspend.

The coroutine body can invoke a continuation before reaching that coro.end. A suspend_never continuation can complete and free its frame before control returns. When the callee frame was elided into that caller allocation, loading the destroy slot at coro.end reads freed storage, which AddressSanitizer reports as a use-after-free.

Load and cache the destroy function in the switch-resume entry block before executing the resume body, then tail-call the cached value at fallthrough coro.end. The cache retains the frame slot as the allocation discriminator without dereferencing an elided frame after the continuation returns.

Add a runnable ASan regression for the original C++ reproducer and update CoroSplit tests to require the entry load.

Assisted-By: Codex GPT 5.5



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications