maxjhandsome
/
llvm-project
forked from OSchip/llvm-project
1
0
Fork 0
Code Issues Pull Requests Packages Releases Wiki Activity

[Wasm] Don't iterate over MachineBasicBlock::successors while erasing from it 

This will read out of bounds. Found by asan.

llvm-svn: 339230
This commit is contained in:
Benjamin Kramer 2018-08-08 10:13:19 +00:00
parent a10cfcc1db
commit 83996e4dee
1 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
llvm/lib/Target/WebAssembly/WebAssemblyLateEHPrepare.cpp
View File

@ -83,11 +83,12 @@ MachineBasicBlock *GetMatchingEHPad(MachineInstr *MI) {
return EHPad; return EHPad;
} }
// Erases the given BB and all its children from the function. If other BBs have // Erases the given BBs and all their children from the function. If other BBs
// this BB as a successor, the successor relationships will be deleted as well. // have the BB as a successor, the successor relationships will be deleted as
static void EraseBBAndChildren(MachineBasicBlock *MBB) { // well.
SmallVector<MachineBasicBlock *, 8> WL; template <typename Container>
WL.push_back(MBB); static void EraseBBsAndChildren(const Container &MBBs) {
SmallVector<MachineBasicBlock *, 8> WL(MBBs.begin(), MBBs.end());
while (!WL.empty()) { while (!WL.empty()) {
MachineBasicBlock *MBB = WL.pop_back_val(); MachineBasicBlock *MBB = WL.pop_back_val();
for (auto *Pred : MBB->predecessors()) for (auto *Pred : MBB->predecessors())
@ -243,9 +244,11 @@ bool WebAssemblyLateEHPrepare::addRethrows(MachineFunction &MF) {
// eventually lead to an unreachable. Delete it because rethrow itself is // eventually lead to an unreachable. Delete it because rethrow itself is
// a terminator, and also delete non-EH pad successors if any. // a terminator, and also delete non-EH pad successors if any.
MBB.erase(std::next(MachineBasicBlock::iterator(Rethrow)), MBB.end()); MBB.erase(std::next(MachineBasicBlock::iterator(Rethrow)), MBB.end());
SmallVector<MachineBasicBlock *, 8> NonPadSuccessors;
for (auto *Succ : MBB.successors()) for (auto *Succ : MBB.successors())
if (!Succ->isEHPad()) if (!Succ->isEHPad())
EraseBBAndChildren(Succ); NonPadSuccessors.push_back(Succ);
EraseBBsAndChildren(NonPadSuccessors);
} }
return Changed; return Changed;
} }
@ -302,8 +305,7 @@ bool WebAssemblyLateEHPrepare::ensureSingleBBTermPads(MachineFunction &MF) {
BuildMI(*EHPad, InsertPos, Call->getDebugLoc(), BuildMI(*EHPad, InsertPos, Call->getDebugLoc(),
TII.get(WebAssembly::UNREACHABLE)); TII.get(WebAssembly::UNREACHABLE));
EHPad->erase(InsertPos, EHPad->end()); EHPad->erase(InsertPos, EHPad->end());
for (auto *Succ : EHPad->successors()) EraseBBsAndChildren(EHPad->successors());
EraseBBAndChildren(Succ);
} }
return Changed; return Changed;
} }