[PATCH] D157267: [NewGVN] Fix an use after free when updating use count

[Vladimir Radosavljevic via Phabricator via llvm-commits]

vladimirradosavljevic created this revision.
vladimirradosavljevic added a reviewer: fhahn.
Herald added subscribers: kmitropoulou, StephenFan, hiraditya.
Herald added a project: All.
vladimirradosavljevic requested review of this revision.
Herald added a project: LLVM.
Herald added a subscriber: llvm-commits.

This patch fixes the issue where reference to a dominating leader count can point to a freed memory, since UseCounts map can grow as there is a possible insert into it.


Repository:
  rG LLVM Github Monorepo

https://reviews.llvm.org/D157267

Files:
  llvm/lib/Transforms/Scalar/NewGVN.cpp


Index: llvm/lib/Transforms/Scalar/NewGVN.cpp
===================================================================
--- llvm/lib/Transforms/Scalar/NewGVN.cpp
+++ llvm/lib/Transforms/Scalar/NewGVN.cpp
@@ -4109,7 +4109,7 @@
           U->set(DominatingLeader);
           // This is now a use of the dominating leader, which means if the
           // dominating leader was dead, it's now live!
-          auto &LeaderUseCount = UseCounts[DominatingLeader];
+          auto LeaderUseCount = UseCounts[DominatingLeader];
           // It's about to be alive again.
           if (LeaderUseCount == 0 && isa<Instruction>(DominatingLeader))
             ProbablyDead.erase(cast<Instruction>(DominatingLeader));
@@ -4120,7 +4120,7 @@
             if (--IIUseCount == 0)
               ProbablyDead.insert(II);
           }
-          ++LeaderUseCount;
+          ++UseCounts[DominatingLeader];
           AnythingReplaced = true;
         }
       }


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D157267.547689.patch
Type: text/x-patch
Size: 941 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20230807/e6482b7d/attachment.bin>