[llvm] [CodeExtractor][Verifier] Fix OoB read when a DIExpression is used multiple times (PR #226857)

Henry Jiang via llvm-commits llvm-commits at lists.llvm.org
Sun Sep 27 23:36:41 PDT 2026


mustartt wrote:

I ran the crashing reproducer with just this patch. After the split,
```llvm
define void @f(i32 %a, i32 %b, i1 %c) !dbg !4 {
entry:
  %x = add i32 %a, 1, !dbg !7
  %y = add i32 %b, 2, !dbg !7
    #dbg_value(!DIArgList(i32 %x, i32 %y), !8, !DIExpression(DW_OP_LLVM_arg, 0, DW_OP_LLVM_arg, 1, DW_OP_plus, DW_OP_stack_value), !7)
  br i1 %c, label %codeRepl, label %exit, !dbg !7

codeRepl:                                         ; preds = %entry
  call void @f.cold.1(i32 %x, i32 %y) #2, !dbg !7
  br label %exit

exit:                                             ; preds = %codeRepl, %entry
  ret void, !dbg !7
}

; Function Attrs: cold minsize
define internal void @f.cold.1(i32 %x, i32 %y) #1 !dbg !10 !prof !11 {
newFuncRoot:
    #dbg_value(i32 %x, !12, !DIExpression(), !13) ; <---------- here
    #dbg_value(i32 %y, !12, !DIExpression(), !13) ; <---------- and here
  br label %cold, !dbg !13

cold:                                             ; preds = %newFuncRoot
  %s = add i32 %x, %y, !dbg !13
  call void @sink(i32 %s), !dbg !13
  call void @sink(i32 %x), !dbg !13
  br label %exit.exitStub, !dbg !13

exit.exitStub:                                    ; preds = %cold
  ret void
}
```
we get empty `!DIExpression()`.

https://github.com/llvm/llvm-project/pull/226857


More information about the llvm-commits mailing list