Skip to content
Permalink
Browse files

[MERGE #6267 @zenparsing] Prevent a use after free in memop

Merge pull request #6267 from zenparsing:use-after-free-memop
  • Loading branch information...
Kevin Smith
Kevin Smith committed Sep 5, 2019
2 parents e1f5b03 + fb4a653 commit c5297b86536fbf1a02d27cec28fea3c516e6ab84
Showing with 5 additions and 4 deletions.
  1. +5 −4 lib/Backend/GlobOpt.cpp
@@ -17080,13 +17080,14 @@ GlobOpt::EmitMemop(Loop * loop, LoopCount *loopCount, const MemOpEmitData* emitD
RemoveMemOpSrcInstr(memopInstr, emitData->stElemInstr, emitData->block);
if (!isMemset)
{
if (((MemCopyEmitData*)emitData)->ldElemInstr->GetSrc1()->IsIndirOpnd())
IR::Instr* ldElemInstr = ((MemCopyEmitData*)emitData)->ldElemInstr;
if (ldElemInstr->GetSrc1()->IsIndirOpnd())
{
baseOpnd = ((MemCopyEmitData*)emitData)->ldElemInstr->GetSrc1()->AsIndirOpnd()->GetBaseOpnd();
baseOpnd = ldElemInstr->GetSrc1()->AsIndirOpnd()->GetBaseOpnd();
isLikelyJsArray = baseOpnd->GetValueType().IsLikelyArrayOrObjectWithArray();
ProcessNoImplicitCallArrayUses(baseOpnd, baseOpnd->IsArrayRegOpnd() ? baseOpnd->AsArrayRegOpnd() : nullptr, emitData->stElemInstr, isLikelyJsArray, true);
ProcessNoImplicitCallArrayUses(baseOpnd, baseOpnd->IsArrayRegOpnd() ? baseOpnd->AsArrayRegOpnd() : nullptr, ldElemInstr, isLikelyJsArray, true);
}
RemoveMemOpSrcInstr(memopInstr, ((MemCopyEmitData*)emitData)->ldElemInstr, emitData->block);
RemoveMemOpSrcInstr(memopInstr, ldElemInstr, emitData->block);
}
InsertNoImplicitCallUses(memopInstr);
noImplicitCallUsesToInsert->Clear();

0 comments on commit c5297b8

Please sign in to comment.
You can’t perform that action at this time.