[llvm] r341422 - [ThinLTO] Fix memory corruption in ThinLTOCodeGenerator when CodeGenOnly was specified

[Steven Wu via llvm-commits]

Author: steven_wu
Date: Tue Sep  4 15:54:17 2018
New Revision: 341422

URL: http://llvm.org/viewvc/llvm-project?rev=341422&view=rev
Log:
[ThinLTO] Fix memory corruption in ThinLTOCodeGenerator when CodeGenOnly was specified

Summary:
Issue occurs when doing ThinLTO with CodeGenOnly flag.
TMBuilder.TheTriple is assigned to by multiple threads in an unsafe way resulting in double-free of std::string memory.

Pseudocode:
if (CodeGenOnly) {
  // Perform only parallel codegen and return.
  ThreadPool Pool;
  int count = 0;
  for (auto &ModuleBuffer : Modules) {
    Pool.async([&](int count) {
    ...
      /// Now call OutputBuffer = codegen(*TheModule);
      /// Which turns into initTMBuilder(moduleTMBuilder, Triple(TheModule.getTargetTriple()));
      /// Which turns into

      TMBuilder.TheTriple = std::move(TheTriple);   // std::string = "....."
      /// So, basically std::string assignment to same string on multiple threads = memory corruption

  }

  return;
}

Patch by Alex Borcan

Reviewers: llvm-commits, steven_wu

Reviewed By: steven_wu

Subscribers: mehdi_amini, inglorion, eraman, steven_wu, dexonsmith, llvm-commits

Differential Revision: https://reviews.llvm.org/D51651

Modified:
    llvm/trunk/include/llvm/LTO/legacy/ThinLTOCodeGenerator.h
    llvm/trunk/lib/LTO/ThinLTOCodeGenerator.cpp

Modified: llvm/trunk/include/llvm/LTO/legacy/ThinLTOCodeGenerator.h
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/include/llvm/LTO/legacy/ThinLTOCodeGenerator.h?rev=341422&r1=341421&r2=341422&view=diff
==============================================================================
--- llvm/trunk/include/llvm/LTO/legacy/ThinLTOCodeGenerator.h (original)
+++ llvm/trunk/include/llvm/LTO/legacy/ThinLTOCodeGenerator.h Tue Sep  4 15:54:17 2018
@@ -299,11 +299,6 @@ public:
    */
   void optimize(Module &Module);
 
-  /**
-   * Perform ThinLTO CodeGen.
-   */
-  std::unique_ptr<MemoryBuffer> codegen(Module &Module);
-
   /**@}*/
 
 private:

Modified: llvm/trunk/lib/LTO/ThinLTOCodeGenerator.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/LTO/ThinLTOCodeGenerator.cpp?rev=341422&r1=341421&r2=341422&view=diff
==============================================================================
--- llvm/trunk/lib/LTO/ThinLTOCodeGenerator.cpp (original)
+++ llvm/trunk/lib/LTO/ThinLTOCodeGenerator.cpp Tue Sep  4 15:54:17 2018
@@ -818,14 +818,6 @@ void ThinLTOCodeGenerator::optimize(Modu
   optimizeModule(TheModule, *TMBuilder.create(), OptLevel, Freestanding);
 }
 
-/**
- * Perform ThinLTO CodeGen.
- */
-std::unique_ptr<MemoryBuffer> ThinLTOCodeGenerator::codegen(Module &TheModule) {
-  initTMBuilder(TMBuilder, Triple(TheModule.getTargetTriple()));
-  return codegenModule(TheModule, *TMBuilder.create());
-}
-
 /// Write out the generated object file, either from CacheEntryPath or from
 /// OutputBuffer, preferring hard-link when possible.
 /// Returns the path to the generated file in SavedObjectsDirectoryPath.
@@ -893,7 +885,7 @@ void ThinLTOCodeGenerator::run() {
                                  /*IsImporting*/ false);
 
         // CodeGen
-        auto OutputBuffer = codegen(*TheModule);
+        auto OutputBuffer = codegenModule(*TheModule, *TMBuilder.create());
         if (SavedObjectsDirectoryPath.empty())
           ProducedBinaries[count] = std::move(OutputBuffer);
         else