[llvm] [GlobalISel] Fix UMR in `SwiftErrorValueTracking` (PR #190273)
Yuta Saito via llvm-commits
llvm-commits at lists.llvm.org
Thu Apr 2 15:55:53 PDT 2026
https://github.com/kateinoigakukun updated https://github.com/llvm/llvm-project/pull/190273
>From 10dea626123c5da95404b72acdf03e37eceeb14f Mon Sep 17 00:00:00 2001
From: Yuta Saito <kateinoigakukun at gmail.com>
Date: Thu, 2 Apr 2026 20:48:23 +0000
Subject: [PATCH] [GlobalISel] Fix UMR in `SwiftErrorValueTracking`
`SwiftErrorValueTracking` holds per-function state used by `IRTranslator`.
On targets where `TargetLowering::supportSwiftError()` is false, (e.g. wasm)
`SwiftErrorValueTracking::setFunction()` exits early. Historically, that early
return happened before clearing per-function containers, and pointer members
(including `SwiftErrorArg`) had no in-class initialization.
The bad case is a function with a swifterror argument on such a target:
`IRTranslator` uses `SwiftError.getFunctionArg()` without checking
`supportSwiftError()` and this could read an uninitialized `SwiftErrorArg`
value. (SelectionDAG gates the `getFunctionArg` usages behind
`supportSwiftError()`, so it's specific to GlobalISel)
29391328ab66 added a first test case that satisfies:
- the target is `supportSwiftError` = false
- use swiftcc
- use GlobalISel
and it made the issue observable with sanitizer builds.
This commit fixes the per-function container reinitialization and
defensively add explicit pointer member initializations.
---
llvm/include/llvm/CodeGen/SwiftErrorValueTracking.h | 10 +++++-----
llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp | 2 +-
llvm/lib/CodeGen/SwiftErrorValueTracking.cpp | 6 +++---
3 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/llvm/include/llvm/CodeGen/SwiftErrorValueTracking.h b/llvm/include/llvm/CodeGen/SwiftErrorValueTracking.h
index a374736347f6d..06795b1eb8420 100644
--- a/llvm/include/llvm/CodeGen/SwiftErrorValueTracking.h
+++ b/llvm/include/llvm/CodeGen/SwiftErrorValueTracking.h
@@ -33,10 +33,10 @@ namespace llvm {
class SwiftErrorValueTracking {
// Some useful objects to reduce the number of function arguments needed.
- MachineFunction *MF;
- const Function *Fn;
- const TargetLowering *TLI;
- const TargetInstrInfo *TII;
+ MachineFunction *MF = nullptr;
+ const Function *Fn = nullptr;
+ const TargetLowering *TLI = nullptr;
+ const TargetInstrInfo *TII = nullptr;
/// A map from swifterror value in a basic block to the virtual register it is
/// currently represented by.
@@ -55,7 +55,7 @@ class SwiftErrorValueTracking {
VRegDefUses;
/// The swifterror argument of the current function.
- const Value *SwiftErrorArg;
+ const Value *SwiftErrorArg = nullptr;
using SwiftErrorValues = SmallVector<const Value*, 1>;
/// A function can only have a single swifterror argument. And if it does
diff --git a/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp b/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp
index 346c37b04ac66..18c90ceee3867 100644
--- a/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp
+++ b/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp
@@ -4277,7 +4277,7 @@ bool IRTranslator::runOnMachineFunction(MachineFunction &CurMF) {
ArrayRef<Register> VRegs = getOrCreateVRegs(Arg);
VRegArgs.push_back(VRegs);
- if (Arg.hasSwiftErrorAttr()) {
+ if (CLI->supportSwiftError() && Arg.hasSwiftErrorAttr()) {
assert(VRegs.size() == 1 && "Too many vregs for Swift error");
SwiftError.setCurrentVReg(EntryBB, SwiftError.getFunctionArg(), VRegs[0]);
}
diff --git a/llvm/lib/CodeGen/SwiftErrorValueTracking.cpp b/llvm/lib/CodeGen/SwiftErrorValueTracking.cpp
index 4ae9726d7e0c2..c45fef0c76a46 100644
--- a/llvm/lib/CodeGen/SwiftErrorValueTracking.cpp
+++ b/llvm/lib/CodeGen/SwiftErrorValueTracking.cpp
@@ -81,15 +81,15 @@ void SwiftErrorValueTracking::setFunction(MachineFunction &mf) {
TLI = MF->getSubtarget().getTargetLowering();
TII = MF->getSubtarget().getInstrInfo();
- if (!TLI->supportSwiftError())
- return;
-
SwiftErrorVals.clear();
VRegDefMap.clear();
VRegUpwardsUse.clear();
VRegDefUses.clear();
SwiftErrorArg = nullptr;
+ if (!TLI->supportSwiftError())
+ return;
+
// Check if function has a swifterror argument.
bool HaveSeenSwiftErrorArg = false;
for (Function::const_arg_iterator AI = Fn->arg_begin(), AE = Fn->arg_end();
More information about the llvm-commits
mailing list