[clang] efb01c1 - [Clang][Coroutines] Don't emit fake uses for coroutine parameters (#194690)

[via cfe-commits]

Author: Stephen Tozer
Date: 2026-05-01T10:48:16+01:00
New Revision: efb01c1bf558eaaf8ec64e1a54110584e827f21b

URL: https://github.com/llvm/llvm-project/commit/efb01c1bf558eaaf8ec64e1a54110584e827f21b
DIFF: https://github.com/llvm/llvm-project/commit/efb01c1bf558eaaf8ec64e1a54110584e827f21b.diff

LOG: [Clang][Coroutines] Don't emit fake uses for coroutine parameters (#194690)

Fixes issue: https://github.com/llvm/llvm-project/issues/192351

The combination of coroutines with -fextend-variable-liveness has
resulted in use-after-free, caused by the fact that we insert fake uses
of coroutine parameters at the end of the coroutine. While this is fine
for normal functions, in coroutines these variables are stored in the
coroutine frame, which is freed before the end of the function; this
results in us loading from the deleted frame.

This patch fixes this by no longer emitting fake uses for most coroutine
parameters. Since coroutine parameters will be saved back to the frame
when we suspend, and currently may not be optimized out, fake uses are
not needed in this case, and so by not emitting them we avoid dealing
with the complexity of updating fake uses in the CoroSplit pass. The
exception to this is 'this', which is not saved to the frame.

Added: 
    clang/test/CodeGenCoroutines/coro-param-fake-use.cpp

Modified: 
    clang/lib/CodeGen/CGDecl.cpp

Removed: 
    


################################################################################
diff  --git a/clang/lib/CodeGen/CGDecl.cpp b/clang/lib/CodeGen/CGDecl.cpp
index 22079e0fb3a38..63ad0bc9ec238 100644
--- a/clang/lib/CodeGen/CGDecl.cpp
+++ b/clang/lib/CodeGen/CGDecl.cpp
@@ -2846,8 +2846,13 @@ void CodeGenFunction::EmitParmDecl(const VarDecl &D, ParamValue Arg,
       (CGM.getCodeGenOpts().getExtendVariableLiveness() ==
            CodeGenOptions::ExtendVariableLivenessKind::This &&
        &D == CXXABIThisDecl)) {
-    if (shouldExtendLifetime(getContext(), CurCodeDecl, D, CXXABIThisDecl))
-      EHStack.pushCleanup<FakeUse>(NormalFakeUse, DeclPtr);
+    // We don't emit fake uses for coroutine parameters, other than `this`.
+    if (auto *FnDecl = dyn_cast_or_null<FunctionDecl>(CurCodeDecl);
+        &D == CXXABIThisDecl || !FnDecl ||
+        FnDecl->getBody()->getStmtClass() != Stmt::CoroutineBodyStmtClass) {
+      if (shouldExtendLifetime(getContext(), CurCodeDecl, D, CXXABIThisDecl))
+        EHStack.pushCleanup<FakeUse>(NormalFakeUse, DeclPtr);
+    }
   }
 
   // Emit debug info for param declarations in non-thunk functions.

diff  --git a/clang/test/CodeGenCoroutines/coro-param-fake-use.cpp b/clang/test/CodeGenCoroutines/coro-param-fake-use.cpp
new file mode 100644
index 0000000000000..0a0da815975d9
--- /dev/null
+++ b/clang/test/CodeGenCoroutines/coro-param-fake-use.cpp
@@ -0,0 +1,42 @@
+// RUN: %clang_cc1 -std=c++20 -triple=x86_64-unknown-linux-gnu -emit-llvm -fextend-variable-liveness -o - %s -disable-llvm-passes -fexceptions | FileCheck %s
+
+// See issue #192351
+// Tests that parameters to a coroutine do not have fake uses inserted for them
+// when we enable -fextend-variable-liveness, except for `this`, which is not
+// stored in the coroutine frame.
+
+#include "Inputs/coroutine.h"
+
+struct task {
+    struct promise_type {
+        task get_return_object() noexcept { return {}; }
+        std::suspend_never initial_suspend() noexcept { return {}; }
+        std::suspend_never final_suspend() noexcept { return {}; }
+        void return_void() noexcept {}
+        void unhandled_exception() noexcept {}
+    };
+};
+
+class C {
+public:
+    C() {}
+
+    // CHECK-LABEL: void @_ZN1C1fEb(ptr noundef{{.*}} %this, i1 noundef{{.*}} %b)
+    task f(bool b) {
+        // CHECK: store ptr %this, ptr %[[THIS_ADDR:.+]]
+        // CHECK-NOT: llvm.fake.use
+
+        // CHECK:      coro.ret:
+        // CHECK-NEXT: call void @llvm.coro.end(
+        // CHECK-NEXT: %[[THIS_FAKE_USE:.+]] = load ptr, ptr %[[THIS_ADDR]]
+        // CHECK-NEXT: notail call void (...) @llvm.fake.use(ptr %[[THIS_FAKE_USE]])
+        // CHECK-NEXT: ret void
+        if (b) {
+            co_await std::suspend_always{};
+        }
+    }
+};
+
+void foo() {
+    C().f(false);
+}