[llvm-branch-commits] [llvm-branch] r197322 - Merging r197178:

[Bill Wendling]

Author: void
Date: Sat Dec 14 02:04:09 2013
New Revision: 197322

URL: http://llvm.org/viewvc/llvm-project?rev=197322&view=rev
Log:
Merging r197178:
------------------------------------------------------------------------
r197178 | hfinkel | 2013-12-12 12:45:24 -0800 (Thu, 12 Dec 2013) | 9 lines

Fix a use-after-free error in GlobalOpt CleanupConstantGlobalUsers

GlobalOpt's CleanupConstantGlobalUsers function uses a worklist array to manage
constant users to be visited. The pointers in this array need to be weak
handles because when we delete a constant array, we may also be holding a
pointer to one of its elements (or an element of one of its elements if we're
dealing with an array of arrays) in the worklist.

Fixes PR17347.
------------------------------------------------------------------------

Added:
    llvm/branches/release_34/test/Transforms/GlobalOpt/array-elem-refs.ll
      - copied unchanged from r197178, llvm/trunk/test/Transforms/GlobalOpt/array-elem-refs.ll
Modified:
    llvm/branches/release_34/   (props changed)
    llvm/branches/release_34/lib/Transforms/IPO/GlobalOpt.cpp

Propchange: llvm/branches/release_34/
------------------------------------------------------------------------------
--- svn:mergeinfo (original)
+++ svn:mergeinfo Sat Dec 14 02:04:09 2013
@@ -1,3 +1,3 @@
 /llvm/branches/Apple/Pertwee:110850,110961
 /llvm/branches/type-system-rewrite:133420-134817
-/llvm/trunk:155241,195092-195094,195100,195102-195103,195118,195129,195136,195138,195148,195152,195156-195157,195161-195162,195193,195272,195317-195318,195327,195330,195333,195339,195343,195355,195364,195379,195397-195399,195401,195408,195421,195423-195424,195432,195439,195444,195455-195456,195469,195476-195477,195479,195491-195495,195504-195505,195514,195528,195535,195547,195567,195573-195576,195590-195591,195599,195632,195635-195636,195670,195677,195679,195682,195684,195713,195716,195769,195773,195779,195782,195787-195788,195791,195803,195812,195827,195834,195843-195844,195878-195881,195887,195903,195905,195912,195915,195932,195936-195943,195972-195973,195975-195976,196004,196044-196046,196069,196100,196104,196129,196144,196151,196153,196156,196158,196172,196189-196192,196198-196199,196208-196211,196261,196267,196269,196294,196359-196362,196369,196391,196456,196493,196508,196532-196533,196535,196538,196588,196611-196612,196637-196638,196658,196668,196725,196735,196751,196!
 755,19676
 8,196806,196858,197089,197228
+/llvm/trunk:155241,195092-195094,195100,195102-195103,195118,195129,195136,195138,195148,195152,195156-195157,195161-195162,195193,195272,195317-195318,195327,195330,195333,195339,195343,195355,195364,195379,195397-195399,195401,195408,195421,195423-195424,195432,195439,195444,195455-195456,195469,195476-195477,195479,195491-195495,195504-195505,195514,195528,195535,195547,195567,195573-195576,195590-195591,195599,195632,195635-195636,195670,195677,195679,195682,195684,195713,195716,195769,195773,195779,195782,195787-195788,195791,195803,195812,195827,195834,195843-195844,195878-195881,195887,195903,195905,195912,195915,195932,195936-195943,195972-195973,195975-195976,196004,196044-196046,196069,196100,196104,196129,196144,196151,196153,196156,196158,196172,196189-196192,196198-196199,196208-196211,196261,196267,196269,196294,196359-196362,196369,196391,196456,196493,196508,196532-196533,196535,196538,196588,196611-196612,196637-196638,196658,196668,196725,196735,196751,196!
 755,19676
 8,196806,196858,197089,197178,197228

Modified: llvm/branches/release_34/lib/Transforms/IPO/GlobalOpt.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/branches/release_34/lib/Transforms/IPO/GlobalOpt.cpp?rev=197322&r1=197321&r2=197322&view=diff
==============================================================================
--- llvm/branches/release_34/lib/Transforms/IPO/GlobalOpt.cpp (original)
+++ llvm/branches/release_34/lib/Transforms/IPO/GlobalOpt.cpp Sat Dec 14 02:04:09 2013
@@ -37,6 +37,7 @@
 #include "llvm/Support/GetElementPtrTypeIterator.h"
 #include "llvm/Support/MathExtras.h"
 #include "llvm/Support/raw_ostream.h"
+#include "llvm/Support/ValueHandle.h"
 #include "llvm/Target/TargetLibraryInfo.h"
 #include "llvm/Transforms/Utils/GlobalStatus.h"
 #include "llvm/Transforms/Utils/ModuleUtils.h"
@@ -267,9 +268,17 @@ static bool CleanupPointerRootUsers(Glob
 static bool CleanupConstantGlobalUsers(Value *V, Constant *Init,
                                        DataLayout *TD, TargetLibraryInfo *TLI) {
   bool Changed = false;
-  SmallVector<User*, 8> WorkList(V->use_begin(), V->use_end());
+  // Note that we need to use a weak value handle for the worklist items. When
+  // we delete a constant array, we may also be holding pointer to one of its
+  // elements (or an element of one of its elements if we're dealing with an
+  // array of arrays) in the worklist.
+  SmallVector<WeakVH, 8> WorkList(V->use_begin(), V->use_end());
   while (!WorkList.empty()) {
-    User *U = WorkList.pop_back_val();
+    Value *UV = WorkList.pop_back_val();
+    if (!UV)
+      continue;
+
+    User *U = cast<User>(UV);
 
     if (LoadInst *LI = dyn_cast<LoadInst>(U)) {
       if (Init) {