Merge pull request #22993 from JuliaLang/jn/22973

JeffBezanson · web-flow · commit 100a6fceab49 · 2017-07-28T11:42:37.000-04:00
codegen: fix use-after-free
diff --git a/src/codegen.cpp b/src/codegen.cpp
@@ -5694,10 +5694,15 @@ static std::unique_ptr<Module> emit_function(
                 }
             }
             if (!have_real_use) {
+                Instruction *use = NULL;
                 for (Use &U : root->uses()) {
+                    if (use) // erase after the iterator moves on
+                        use->eraseFromParent();
                     User *RU = U.getUser();
-                    cast<Instruction>(RU)->eraseFromParent();
+                    use = cast<Instruction>(RU);
                 }
+                if (use)
+                    use->eraseFromParent();
                 root->eraseFromParent();
                 if (store_value)
                     store_value->eraseFromParent();

Original file line number	Diff line number	Diff line change
`@@ -5694,10 +5694,15 @@ static std::unique_ptr<Module> emit_function(`
`5694`	`5694`	`}`
`5695`	`5695`	`}`
`5696`	`5696`	`if (!have_real_use) {`
	`5697`	`+ Instruction *use = NULL;`
`5697`	`5698`	`for (Use &U : root->uses()) {`
	`5699`	`+ if (use) // erase after the iterator moves on`
	`5700`	`+ use->eraseFromParent();`
`5698`	`5701`	`User *RU = U.getUser();`
`5699`		`- cast<Instruction>(RU)->eraseFromParent();`
	`5702`	`+ use = cast<Instruction>(RU);`
`5700`	`5703`	`}`
	`5704`	`+ if (use)`
	`5705`	`+ use->eraseFromParent();`
`5701`	`5706`	`root->eraseFromParent();`
`5702`	`5707`	`if (store_value)`
`5703`	`5708`	`store_value->eraseFromParent();`