[PATCH] D87853: [Sema] Update specialization iterator after template argument deduction.

[Hongtao Yu via Phabricator via cfe-commits]

hoy created this revision.
Herald added subscribers: cfe-commits, wenlei.
Herald added a project: clang.
hoy requested review of this revision.

Template argument deduction may update the underlying specialization container and invalidate previous iterators of the container. This triggered an assert (in DeclTemplate.cpp) and corrupted the heap with writing through invalid iterators. This change recomputes invalided iterators in place before they are referenced.

Test Plan:


Repository:
  rG LLVM Github Monorepo

https://reviews.llvm.org/D87853

Files:
  clang/lib/Sema/SemaTemplate.cpp


Index: clang/lib/Sema/SemaTemplate.cpp
===================================================================
--- clang/lib/Sema/SemaTemplate.cpp
+++ clang/lib/Sema/SemaTemplate.cpp
@@ -4471,7 +4471,16 @@
   // Note that we do not instantiate a definition until we see an odr-use
   // in DoMarkVarDeclReferenced().
   // FIXME: LateAttrs et al.?
-  VarTemplateSpecializationDecl *Decl = BuildVarTemplateInstantiation(
+  // Search for the variable template specialization declaration that
+  // corresponds to these arguments again to get an up-to-date InsertPos.
+  // The template argument deduction in between may update the underlying
+  // specialization container and invalidate previous iterators.
+  VarTemplateSpecializationDecl *Decl =
+      Template->findSpecialization(Converted, InsertPos);
+  // Assert we should not have a variable template specialization, otherwise we
+  // should have returned early.
+  assert(!Decl);
+  Decl = BuildVarTemplateInstantiation(
       Template, InstantiationPattern, *InstantiationArgs, TemplateArgs,
       Converted, TemplateNameLoc, InsertPos /*, LateAttrs, StartingScope*/);
   if (!Decl)


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D87853.292595.patch
Type: text/x-patch
Size: 1142 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/cfe-commits/attachments/20200917/6c5a5e88/attachment.bin>