[llvm] [GlobalISel] Fix UMR in `SwiftErrorValueTracking` (PR #190273)

Yuta Saito via llvm-commits llvm-commits at lists.llvm.org
Thu Apr 2 15:55:53 PDT 2026


https://github.com/kateinoigakukun updated https://github.com/llvm/llvm-project/pull/190273

>From 10dea626123c5da95404b72acdf03e37eceeb14f Mon Sep 17 00:00:00 2001
From: Yuta Saito <kateinoigakukun at gmail.com>
Date: Thu, 2 Apr 2026 20:48:23 +0000
Subject: [PATCH] [GlobalISel] Fix UMR in `SwiftErrorValueTracking`

`SwiftErrorValueTracking` holds per-function state used by `IRTranslator`.

On targets where `TargetLowering::supportSwiftError()` is false, (e.g. wasm)
`SwiftErrorValueTracking::setFunction()` exits early. Historically, that early
return happened before clearing per-function containers, and pointer members
(including `SwiftErrorArg`) had no in-class initialization.

The bad case is a function with a swifterror argument on such a target:
`IRTranslator` uses `SwiftError.getFunctionArg()` without checking
`supportSwiftError()` and this could read an uninitialized `SwiftErrorArg`
value. (SelectionDAG gates the `getFunctionArg` usages behind
`supportSwiftError()`, so it's specific to GlobalISel)

29391328ab66 added a first test case that satisfies:
- the target is `supportSwiftError` = false
- use swiftcc
- use GlobalISel
and it made the issue observable with sanitizer builds.
This commit fixes the per-function container reinitialization and
defensively add explicit pointer member initializations.
---
 llvm/include/llvm/CodeGen/SwiftErrorValueTracking.h | 10 +++++-----
 llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp        |  2 +-
 llvm/lib/CodeGen/SwiftErrorValueTracking.cpp        |  6 +++---
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/llvm/include/llvm/CodeGen/SwiftErrorValueTracking.h b/llvm/include/llvm/CodeGen/SwiftErrorValueTracking.h
index a374736347f6d..06795b1eb8420 100644
--- a/llvm/include/llvm/CodeGen/SwiftErrorValueTracking.h
+++ b/llvm/include/llvm/CodeGen/SwiftErrorValueTracking.h
@@ -33,10 +33,10 @@ namespace llvm {
 
 class SwiftErrorValueTracking {
   // Some useful objects to reduce the number of function arguments needed.
-  MachineFunction *MF;
-  const Function *Fn;
-  const TargetLowering *TLI;
-  const TargetInstrInfo *TII;
+  MachineFunction *MF = nullptr;
+  const Function *Fn = nullptr;
+  const TargetLowering *TLI = nullptr;
+  const TargetInstrInfo *TII = nullptr;
 
   /// A map from swifterror value in a basic block to the virtual register it is
   /// currently represented by.
@@ -55,7 +55,7 @@ class SwiftErrorValueTracking {
       VRegDefUses;
 
   /// The swifterror argument of the current function.
-  const Value *SwiftErrorArg;
+  const Value *SwiftErrorArg = nullptr;
 
   using SwiftErrorValues = SmallVector<const Value*, 1>;
   /// A function can only have a single swifterror argument. And if it does
diff --git a/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp b/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp
index 346c37b04ac66..18c90ceee3867 100644
--- a/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp
+++ b/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp
@@ -4277,7 +4277,7 @@ bool IRTranslator::runOnMachineFunction(MachineFunction &CurMF) {
     ArrayRef<Register> VRegs = getOrCreateVRegs(Arg);
     VRegArgs.push_back(VRegs);
 
-    if (Arg.hasSwiftErrorAttr()) {
+    if (CLI->supportSwiftError() && Arg.hasSwiftErrorAttr()) {
       assert(VRegs.size() == 1 && "Too many vregs for Swift error");
       SwiftError.setCurrentVReg(EntryBB, SwiftError.getFunctionArg(), VRegs[0]);
     }
diff --git a/llvm/lib/CodeGen/SwiftErrorValueTracking.cpp b/llvm/lib/CodeGen/SwiftErrorValueTracking.cpp
index 4ae9726d7e0c2..c45fef0c76a46 100644
--- a/llvm/lib/CodeGen/SwiftErrorValueTracking.cpp
+++ b/llvm/lib/CodeGen/SwiftErrorValueTracking.cpp
@@ -81,15 +81,15 @@ void SwiftErrorValueTracking::setFunction(MachineFunction &mf) {
   TLI = MF->getSubtarget().getTargetLowering();
   TII = MF->getSubtarget().getInstrInfo();
 
-  if (!TLI->supportSwiftError())
-    return;
-
   SwiftErrorVals.clear();
   VRegDefMap.clear();
   VRegUpwardsUse.clear();
   VRegDefUses.clear();
   SwiftErrorArg = nullptr;
 
+  if (!TLI->supportSwiftError())
+    return;
+
   // Check if function has a swifterror argument.
   bool HaveSeenSwiftErrorArg = false;
   for (Function::const_arg_iterator AI = Fn->arg_begin(), AE = Fn->arg_end();



More information about the llvm-commits mailing list