maxjhandsome
/
llvm-project
forked from OSchip/llvm-project
1
0
Fork 0
Code Issues Pull Requests Packages Releases Wiki Activity

[Wasm] Don't iterate over MachineBasicBlock::successors while erasing from it 

This will read out of bounds. Found by asan.

llvm-svn: 339230
This commit is contained in:
Benjamin Kramer 2018-08-08 10:13:19 +00:00
parent a10cfcc1db
commit 83996e4dee
1 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
llvm/lib/Target/WebAssembly/WebAssemblyLateEHPrepare.cpp
View File

@ -83,11 +83,12 @@ MachineBasicBlock *GetMatchingEHPad(MachineInstr *MI) {
return EHPad;
}
// Erases the given BB and all its children from the function. If other BBs have
// this BB as a successor, the successor relationships will be deleted as well.
static void EraseBBAndChildren(MachineBasicBlock *MBB) {
SmallVector<MachineBasicBlock *, 8> WL;
WL.push_back(MBB);
// Erases the given BBs and all their children from the function. If other BBs
// have the BB as a successor, the successor relationships will be deleted as
// well.
template <typename Container>
static void EraseBBsAndChildren(const Container &MBBs) {
SmallVector<MachineBasicBlock *, 8> WL(MBBs.begin(), MBBs.end());
while (!WL.empty()) {
MachineBasicBlock *MBB = WL.pop_back_val();
for (auto *Pred : MBB->predecessors())
@ -243,9 +244,11 @@ bool WebAssemblyLateEHPrepare::addRethrows(MachineFunction &MF) {
// eventually lead to an unreachable. Delete it because rethrow itself is
// a terminator, and also delete non-EH pad successors if any.
MBB.erase(std::next(MachineBasicBlock::iterator(Rethrow)), MBB.end());
SmallVector<MachineBasicBlock *, 8> NonPadSuccessors;
for (auto *Succ : MBB.successors())
if (!Succ->isEHPad())
EraseBBAndChildren(Succ);
NonPadSuccessors.push_back(Succ);
EraseBBsAndChildren(NonPadSuccessors);
}
return Changed;
}
@ -302,8 +305,7 @@ bool WebAssemblyLateEHPrepare::ensureSingleBBTermPads(MachineFunction &MF) {
BuildMI(*EHPad, InsertPos, Call->getDebugLoc(),
TII.get(WebAssembly::UNREACHABLE));
EHPad->erase(InsertPos, EHPad->end());
for (auto *Succ : EHPad->successors())
EraseBBAndChildren(Succ);
EraseBBsAndChildren(EHPad->successors());
}
return Changed;
}