[all-commits] [llvm/llvm-project] bc5b90: [clang][CodeGen] Fix stack-use-after-return in def...

[Philipp Dominik Schubert via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: bc5b9040d28773b03d4d9ec3ca50271bdf776d77
      https://github.com/llvm/llvm-project/commit/bc5b9040d28773b03d4d9ec3ca50271bdf776d77
  Author: Philipp Dominik Schubert <philipp.schubert at sonarsource.com>
  Date:   2026-09-30 (Wed, 30 Sep 2026)

  Changed paths:
    M clang/docs/ReleaseNotes.md
    M clang/lib/CodeGen/CodeGenModule.cpp
    M clang/lib/CodeGen/CodeGenModule.h
    R clang/test/CodeGenCXX/attr-annotate-constructor.cpp
    R clang/test/CodeGenCXX/attr-annotate-destructor.cpp
    A clang/test/CodeGenCXX/attr-annotate-member-functions.cpp

  Log Message:
  -----------
  [clang][CodeGen] Fix stack-use-after-return in deferred annotations (#226942)

CodeGenModule::DeferredAnnotations was keyed by StringRef, but not every
mangled name passed to GetOrCreateLLVMFunction outlives the call.
CodeGenVTables::maybeEmitThunk mangles the thunk name into a stack-local
SmallString and hands it to GetAddrOfThunk, so for an annotated virtual
function the map retained a reference into a frame that was gone by the
time EmitGlobalAnnotations looked the key up.

ASan reports this as a stack-use-after-return in EmitGlobalAnnotations,
with the freed frame being maybeEmitThunk's 'Name'. The user-visible
effect is that annotations silently disappear from the this-adjusting
thunks once the dead frame has been reused.

Make the key own its storage, using StringMap<unsigned> as the MapVector
map type so lookups still hash a StringRef without allocating.

The clang/test/CodeGenCXX/attr-annotate-member-functions.cpp‎ test has
been created with help of an AI.



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications