[PATCH] D33224: [GISel]: Fix more Undefined behavior in GlobalISel::IRTranslator

[Aditya Nandakumar via Phabricator via llvm-commits]

aditya_nandakumar created this revision.
Herald added subscribers: igorb, kristof.beyls.

Turns out the MachineIRBuilder holds on references to TrackingMDRef (and IRTranslator has MachineIRBuilder objects). When the context gets destroyed, first all the MDRefs are deallocated and then the passes are destroyed. When the IRTranslator is about to get destroyed, it's destructor would end up trying to destroy the trackingMDRefs which the builders held on to leading to Undefined behavior.
Fix this by explicitly default constructing the MachineIRBuidlers at the end of runOnMachineFunction.


Repository:
  rL LLVM

https://reviews.llvm.org/D33224

Files:
  lib/CodeGen/GlobalISel/IRTranslator.cpp


Index: lib/CodeGen/GlobalISel/IRTranslator.cpp
===================================================================
--- lib/CodeGen/GlobalISel/IRTranslator.cpp
+++ lib/CodeGen/GlobalISel/IRTranslator.cpp
@@ -1129,6 +1129,17 @@
   ValToVReg.clear();
   FrameIndices.clear();
   MachinePreds.clear();
+  // MachineIRBuilder holds a DebugLoc which can hold on to a TrackingMDRef
+  // that can outlive the context.
+  // When the LLVMContext is destroyed, it first releases all MDNode references
+  // and then destroys the passes. If we don't clear the Builders(which may
+  // hold some ref), the DebugLoc will again get destroyed leading to
+  // undefined behavior.
+  // We do it here - but we could probably also do it in
+  // releaseMemory.
+  // This also clears various pointers that the Builders hold on to.
+  EntryBuilder = MachineIRBuilder();
+  CurBuilder = MachineIRBuilder();
 }
 
 bool IRTranslator::runOnMachineFunction(MachineFunction &CurMF) {


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D33224.99089.patch
Type: text/x-patch
Size: 961 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20170516/de4e3208/attachment.bin>