[all-commits] [llvm/llvm-project] f3528f: [Coroutines] Use destroy slot for CoroElide resume...

[Yuxuan Chen via All-commits]

  Branch: refs/heads/users/yuxuanchen1997/fix-coro-halo-suspend-never-bad-free
  Home:   https://github.com/llvm/llvm-project
  Commit: f3528f86ab969030210998333741c0d6bbc2e902
      https://github.com/llvm/llvm-project/commit/f3528f86ab969030210998333741c0d6bbc2e902
  Author: Yuxuan Chen <i at yuxuan.ch>
  Date:   2026-07-18 (Sat, 18 Jul 2026)

  Changed paths:
    A clang/test/CodeGenCoroutines/gh188230-coro-await-elidable-suspend-never-final.cpp
    M llvm/include/llvm/Transforms/Coroutines/CoroShape.h
    M llvm/lib/Transforms/Coroutines/CoroSplit.cpp
    M llvm/lib/Transforms/Coroutines/Coroutines.cpp
    M llvm/test/Transforms/Coroutines/coro-split-00.ll
    M llvm/test/Transforms/Coroutines/coro-split-addrspace.ll
    A llvm/test/Transforms/Coroutines/coro-split-resume-fallthrough-destroy-slot.ll

  Log Message:
  -----------
  [Coroutines] Use destroy slot for CoroElide resume fallthrough

Fixes https://github.com/llvm/llvm-project/issues/188230

A switch coroutine with a CoroElide noalloc variant uses the frame destroy slot as a runtime discriminator: heap-allocated frames store the destroy clone, while allocation-elided frames store the cleanup clone. Its resume clone can reach a fallthrough coro.end after the final suspend.

The coroutine body can invoke a continuation before reaching that coro.end. A suspend_never continuation can complete and free its frame before control returns. When the callee frame was elided into that caller allocation, loading the destroy slot at coro.end reads freed storage, which AddressSanitizer reports as a use-after-free.

Load and cache the destroy function in the switch-resume entry block before executing the resume body, then tail-call the cached value at fallthrough coro.end. The cache retains the frame slot as the allocation discriminator without dereferencing an elided frame after the continuation returns.

Add a C++ CodeGen regression for the original suspend_never final-suspend shape and update CoroSplit tests to require the entry load.

Assisted-By: Codex GPT 5.5



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications