[llvm-branch-commits] [llvm] ad30f6e - [NFC] Fix use-after-free: track TargetLibraryAnalysis in BasicAAResult invalidation (#183852)

[Douglas Yung via llvm-branch-commits]

Author: Daniel Paoliello
Date: 2026-03-05T17:29:02Z
New Revision: ad30f6e88e654a5919984a74b1e6152df4d761be

URL: https://github.com/llvm/llvm-project/commit/ad30f6e88e654a5919984a74b1e6152df4d761be
DIFF: https://github.com/llvm/llvm-project/commit/ad30f6e88e654a5919984a74b1e6152df4d761be.diff

LOG: [NFC] Fix use-after-free: track TargetLibraryAnalysis in BasicAAResult invalidation (#183852)

`BasicAAResult` holds a reference to `TargetLibraryInfo` but its
`invalidate()` function did not check `TargetLibraryAnalysis`. When the
pass manager destroyed and re-created `TLI` (e.g. during `CGSCC`
invalidation or `FAM.clear()`), `BasicAAResult` survived with a dangling
`TLI` reference.

This was exposed by #157495 which added `aliasErrno()`, the first code
path that dereferences `TLI` from `BasicAAResult` during the `CGSCC`
pipeline, causing a AV when compiling Rust's core library on Arm64
Windows.

This change adds `TargetLibraryAnalysis` to the invalidation check so
`BasicAAResult` is properly invalidated when its `TLI` reference becomes
stale.

(cherry picked from commit 788625757ea4a7de562461dfea9b7a59b050ec91)

Added: 
    

Modified: 
    llvm/lib/Analysis/BasicAliasAnalysis.cpp

Removed: 
    


################################################################################
diff  --git a/llvm/lib/Analysis/BasicAliasAnalysis.cpp b/llvm/lib/Analysis/BasicAliasAnalysis.cpp
index 1d5f9ac465808..64e035436a414 100644
--- a/llvm/lib/Analysis/BasicAliasAnalysis.cpp
+++ b/llvm/lib/Analysis/BasicAliasAnalysis.cpp
@@ -86,7 +86,8 @@ bool BasicAAResult::invalidate(Function &Fn, const PreservedAnalyses &PA,
   // may be created without handles to some analyses and in that case don't
   // depend on them.
   if (Inv.invalidate<AssumptionAnalysis>(Fn, PA) ||
-      (DT_ && Inv.invalidate<DominatorTreeAnalysis>(Fn, PA)))
+      (DT_ && Inv.invalidate<DominatorTreeAnalysis>(Fn, PA)) ||
+      Inv.invalidate<TargetLibraryAnalysis>(Fn, PA))
     return true;
 
   // Otherwise this analysis result remains valid.