[flang-commits] [flang] 9be7c10 - [flang][Lower] Fix UB in location handling (#177944)

[via flang-commits]

Author: Tom Eccles
Date: 2026-01-26T14:06:46Z
New Revision: 9be7c1037f26146e469c85061d6685a9172c5de9

URL: https://github.com/llvm/llvm-project/commit/9be7c1037f26146e469c85061d6685a9172c5de9
DIFF: https://github.com/llvm/llvm-project/commit/9be7c1037f26146e469c85061d6685a9172c5de9.diff

LOG: [flang][Lower] Fix UB in location handling (#177944)

Previously `prov` received the address of a variable allocated in stack
memory (the contents of `include`). `prov` would then access that memory
outside of the lifetime of that stack allocation: leading to UB.

This only manifested on thinLTO builds. No added test because
flang/test/Lower/location.f90 covers it (when thinLTO is enabled) and
there are bots guarding the thin-lto configuration.

Fixes #156629
Fixes #176404

Added: 
    

Modified: 
    flang/lib/Lower/Bridge.cpp

Removed: 
    


################################################################################
diff  --git a/flang/lib/Lower/Bridge.cpp b/flang/lib/Lower/Bridge.cpp
index 5eefd5472e143..b4c344ba4254e 100644
--- a/flang/lib/Lower/Bridge.cpp
+++ b/flang/lib/Lower/Bridge.cpp
@@ -1117,7 +1117,7 @@ class FirConverter : public Fortran::lower::AbstractConverter {
                                                       fir::LocationKind::Base));
 
         // Gather include location information if any.
-        Fortran::parser::ProvenanceRange *prov = &*provenance;
+        std::optional<Fortran::parser::ProvenanceRange> prov = provenance;
         while (prov) {
           if (std::optional<Fortran::parser::ProvenanceRange> include =
                   cooked->allSources().GetInclusionInfo(*prov)) {
@@ -1127,9 +1127,9 @@ class FirConverter : public Fortran::lower::AbstractConverter {
               locAttrs.push_back(fir::LocationKindAttr::get(
                   &getMLIRContext(), fir::LocationKind::Inclusion));
             }
-            prov = &*include;
+            prov = include;
           } else {
-            prov = nullptr;
+            prov.reset();
           }
         }
         if (locs.size() > 1) {