[clang] [Clang] Fix stack-use-after-return in TryArrayCopy by allocating OpaqueValueExpr on the ASTContext (PR #192080)

Aaron Ballman via cfe-commits cfe-commits at lists.llvm.org
Fri Apr 24 05:05:44 PDT 2026


================
@@ -4380,10 +4380,10 @@ static void TryArrayCopy(Sema &S, const InitializationKind &Kind,
       InitializedEntity::InitializeElement(S.Context, 0, Entity);
   QualType InitEltT =
       S.Context.getAsArrayType(Initializer->getType())->getElementType();
-  OpaqueValueExpr OVE(Initializer->getExprLoc(), InitEltT,
-                      Initializer->getValueKind(),
-                      Initializer->getObjectKind());
-  Expr *OVEAsExpr = &OVE;
+  OpaqueValueExpr *OVE = new (S.Context) OpaqueValueExpr(
+      Initializer->getExprLoc(), InitEltT, Initializer->getValueKind(),
+      Initializer->getObjectKind());
----------------
AaronBallman wrote:

The original code looks wrong but I think this swaps a use-after-free bug for a memory leak bug, so it's not really a fix. But how the code *should* look is a bit of a mystery too; we don't really have transactions for the AST so there's not a direct way to resolve the issue where we could allocate into a temporary arena that's either committed to the `ASTContext` or released if not needed.

CC @zwuis @cor3ntin as folks who did the original work and review here.

https://github.com/llvm/llvm-project/pull/192080


More information about the cfe-commits mailing list