[llvm] d5f58a5 - [CoroSplit] Fix use-after-free related to coro.suspend (#156572)

[via llvm-commits]

Author: Weibo He
Date: 2025-09-15T10:51:17+08:00
New Revision: d5f58a582769af320323cb0c1ea450d8b3962a41

URL: https://github.com/llvm/llvm-project/commit/d5f58a582769af320323cb0c1ea450d8b3962a41
DIFF: https://github.com/llvm/llvm-project/commit/d5f58a582769af320323cb0c1ea450d8b3962a41.diff

LOG: [CoroSplit] Fix use-after-free related to coro.suspend (#156572)

Fix #156444

Added: 
    llvm/test/Transforms/Coroutines/coro-split-invalid.ll

Modified: 
    llvm/lib/Transforms/Coroutines/Coroutines.cpp

Removed: 
    


################################################################################
diff  --git a/llvm/lib/Transforms/Coroutines/Coroutines.cpp b/llvm/lib/Transforms/Coroutines/Coroutines.cpp
index ac93f748ce65c..28a89a8f87dbd 100644
--- a/llvm/lib/Transforms/Coroutines/Coroutines.cpp
+++ b/llvm/lib/Transforms/Coroutines/Coroutines.cpp
@@ -356,9 +356,9 @@ void coro::Shape::invalidateCoroutine(
     // present.
     for (AnyCoroSuspendInst *CS : CoroSuspends) {
       CS->replaceAllUsesWith(PoisonValue::get(CS->getType()));
-      CS->eraseFromParent();
       if (auto *CoroSave = CS->getCoroSave())
         CoroSave->eraseFromParent();
+      CS->eraseFromParent();
     }
     CoroSuspends.clear();
 

diff  --git a/llvm/test/Transforms/Coroutines/coro-split-invalid.ll b/llvm/test/Transforms/Coroutines/coro-split-invalid.ll
new file mode 100644
index 0000000000000..94fe539697214
--- /dev/null
+++ b/llvm/test/Transforms/Coroutines/coro-split-invalid.ll
@@ -0,0 +1,14 @@
+; NOTE: Assertions have been autogenerated by utils/update_test_checks.py UTC_ARGS: --version 5
+; Tests that coro-split correctly invalidate bad coroutines
+; RUN: opt < %s -passes='cgscc(coro-split)' -S | FileCheck %s
+
+define void @pr156444() presplitcoroutine {
+; CHECK-LABEL: define void @pr156444(
+; CHECK-SAME: ) #[[ATTR0:[0-9]+]] {
+; CHECK-NEXT:  [[ENTRY:.*:]]
+; CHECK-NEXT:    ret void
+;
+entry:
+  %0 = call i8 @llvm.coro.suspend(token none, i1 false)
+  ret void
+}