| author | Duncan P. N. Exon Smith <dexonsmith@apple.com> | |
| Thu, 22 Jan 2015 21:36:45 +0000 (21:36 +0000) | ||
| committer | Duncan P. N. Exon Smith <dexonsmith@apple.com> | |
| Thu, 22 Jan 2015 21:36:45 +0000 (21:36 +0000) | ||
| commit | 003346177cff3ac5c6f533cbd41a186980116571 | |
| tree | 9f30ec0d7cea185145ed90b8b034a26ffae85cdd | tree | snapshot (tar.xz tar.gz zip) |
| parent | 40a218658ae01a78f1a5954390610644efcaa90b | commit | diff |
IR: Update references to temporaries before deleting
During `MDNode::deleteTemporary()`, call `replaceAllUsesWith(nullptr)`
to update all tracking references to `nullptr`.
This fixes PR22280, where inverted destruction order between tracking
references and the temporaries themselves caused a use-after-free in
`LLParser`.
An alternative fix would be to add an assertion that there are no users,
and continue to fix inverted destruction order in clients (like
`LLParser`), but instead I decided to make getting-teardown-right easy.
(If someone disagrees let me know.)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@226866 91177308-0d34-0410-b5e6-96231b3b80d8
During `MDNode::deleteTemporary()`, call `replaceAllUsesWith(nullptr)`
to update all tracking references to `nullptr`.
This fixes PR22280, where inverted destruction order between tracking
references and the temporaries themselves caused a use-after-free in
`LLParser`.
An alternative fix would be to add an assertion that there are no users,
and continue to fix inverted destruction order in clients (like
`LLParser`), but instead I decided to make getting-teardown-right easy.
(If someone disagrees let me know.)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@226866 91177308-0d34-0410-b5e6-96231b3b80d8
| include/llvm/IR/Metadata.h | diff | blob | history | |
| lib/IR/Metadata.cpp | diff | blob | history | |
| test/Assembler/invalid-mdnode-badref.ll | [new file with mode: 0644] | blob |
| unittests/IR/MetadataTest.cpp | diff | blob | history |