[Mlir-commits] [mlir] ca8c01c - [mlir][Interfaces] Fix use-after-free after #176641 (#177536)

[llvmlistbot at llvm.org]

Author: Matthias Springer
Date: 2026-01-23T07:28:58Z
New Revision: ca8c01cce22c0618a990e1ab2d7618d6f9420792

URL: https://github.com/llvm/llvm-project/commit/ca8c01cce22c0618a990e1ab2d7618d6f9420792
DIFF: https://github.com/llvm/llvm-project/commit/ca8c01cce22c0618a990e1ab2d7618d6f9420792.diff

LOG: [mlir][Interfaces] Fix use-after-free after #176641 (#177536)

Fix a use-after-free after #176641: the successor operands
`OperandRange` is now longer value after the terminator has been erased.

Added: 
    

Modified: 
    mlir/lib/Interfaces/ControlFlowInterfaces.cpp

Removed: 
    


################################################################################
diff  --git a/mlir/lib/Interfaces/ControlFlowInterfaces.cpp b/mlir/lib/Interfaces/ControlFlowInterfaces.cpp
index 8ed32ddf39a53..cd0a1a8371aac 100644
--- a/mlir/lib/Interfaces/ControlFlowInterfaces.cpp
+++ b/mlir/lib/Interfaces/ControlFlowInterfaces.cpp
@@ -1182,8 +1182,8 @@ struct InlineRegionBranchOp : public RewritePattern {
     // Inline all regions on the path into the enclosing block.
     rewriter.setInsertionPoint(op);
     ArrayRef remainingPath = path;
-    OperandRange successorOperands =
-        regionBranchOp.getEntrySuccessorOperands(remainingPath.front());
+    SmallVector<Value> successorOperands = llvm::to_vector(
+        regionBranchOp.getEntrySuccessorOperands(remainingPath.front()));
     while (!remainingPath.empty()) {
       RegionSuccessor nextSuccessor = remainingPath.consume_front();
       ValueRange successorInputs =
@@ -1239,8 +1239,8 @@ struct InlineRegionBranchOp : public RewritePattern {
       rewriter.inlineBlockBefore(&nextSuccessor.getSuccessor()->front(),
                                  op->getBlock(), op->getIterator(),
                                  replacements);
-      successorOperands =
-          terminator.getSuccessorOperands(remainingPath.front());
+      successorOperands = llvm::to_vector(
+          terminator.getSuccessorOperands(remainingPath.front()));
       rewriter.eraseOp(terminator);
     }