maxjhandsome
/
llvm-project
forked from OSchip/llvm-project
1
0
Fork 0
Code Issues Pull Requests Packages Releases Wiki Activity

Fix MSAN failure on Function destruction 

Summary:
When Function is destroyed, GlobalValue base class is destroyed, then
Value destructor would call use_empty, which ultimately attempts to
downcast 'this' to GlobalValue. This is UB, and is caught my MSAN as
accessing uninitialized memory.

Call materialized_use_empty, which doesn't call
assertModuleIsMaterializedImpl().

Reviewers: eugenis

Reviewed By: eugenis

Subscribers: hiraditya, llvm-commits

Tags: #llvm

Differential Revision: https://reviews.llvm.org/D74161

Patch by Antonio Maiorano.
This commit is contained in:
Evgenii Stepanov 2020-02-06 15:07:20 -08:00
parent ac8a12c874
commit 7dd2810907
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
llvm/lib/IR/Value.cpp
View File

@ -83,13 +83,17 @@ Value::~Value() {
// reference and something is wrong. This code is here to print out where // reference and something is wrong. This code is here to print out where
// the value is still being referenced. // the value is still being referenced.
// //
if (!use_empty()) { // Note that use_empty() cannot be called here, as it eventually downcasts
// 'this' to GlobalValue (derived class of Value), but GlobalValue has already
// been destructed, so accessing it is UB.
//
if (!materialized_use_empty()) {
dbgs() << "While deleting: " << *VTy << " %" << getName() << "\n"; dbgs() << "While deleting: " << *VTy << " %" << getName() << "\n";
for (auto *U : users()) for (auto *U : users())
dbgs() << "Use still stuck around after Def is destroyed:" << *U << "\n"; dbgs() << "Use still stuck around after Def is destroyed:" << *U << "\n";
} }
#endif #endif
assert(use_empty() && "Uses remain when a value is destroyed!"); assert(materialized_use_empty() && "Uses remain when a value is destroyed!");
// If this value is named, destroy the name. This should not be in a symtab // If this value is named, destroy the name. This should not be in a symtab
// at this point. // at this point.