diff mbox series

tree-optimization/114624 - fix use-after-free in SCCP

Message ID 20240408093730.4A8353858C32@sourceware.org
State Committed
Commit 97d5cd8740384dbce5a83080916388f80d8976dd
Headers
Series tree-optimization/114624 - fix use-after-free in SCCP |

Checks

Context Check Description
linaro-tcwg-bot/tcwg_gcc_build--master-aarch64 success Testing passed
linaro-tcwg-bot/tcwg_gcc_check--master-aarch64 warning Patch is already merged
linaro-tcwg-bot/tcwg_gcc_build--master-arm warning Patch is already merged

Commit Message

Richard Biener April 8, 2024, 9:36 a.m. UTC 
  We're inspecting the replaced PHI node after releasing it.

Bootstrapped and tested on x86-64-unknown-linux-gnu, pushed.

	PR tree-optimization/114624
	* tree-scalar-evolution.cc (final_value_replacement_loop):
	Get at the PHI arg location before releasing the PHI node.

	* gcc.dg/torture/pr114624.c: New testcase.
---
 gcc/testsuite/gcc.dg/torture/pr114624.c | 20 ++++++++++++++++++++
 gcc/tree-scalar-evolution.cc            |  4 ++--
 2 files changed, 22 insertions(+), 2 deletions(-)
 create mode 100644 gcc/testsuite/gcc.dg/torture/pr114624.c
diff mbox series

Patch

diff --git a/gcc/testsuite/gcc.dg/torture/pr114624.c b/gcc/testsuite/gcc.dg/torture/pr114624.c
new file mode 100644
index 00000000000..ae031356982
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/torture/pr114624.c
@@ -0,0 +1,20 @@ 
+/* { dg-do compile } */
+
+int a, b;
+int main() {
+  int c, d = 1;
+  while (a) {
+    while (b)
+      if (d)
+        while (a)
+          ;
+    for (; b < 2; b++)
+      if (b)
+        for (c = 0; c < 8; c++)
+          d = 0;
+      else
+        for (a = 0; a < 2; a++)
+          ;
+  }
+  return 0;
+}
diff --git a/gcc/tree-scalar-evolution.cc b/gcc/tree-scalar-evolution.cc
index 25e3130e2f1..b0a5e09a77c 100644
--- a/gcc/tree-scalar-evolution.cc
+++ b/gcc/tree-scalar-evolution.cc
@@ -3877,6 +3877,7 @@  final_value_replacement_loop (class loop *loop)
 	 to a GIMPLE sequence or to a statement list (keeping this a
 	 GENERIC interface).  */
       def = unshare_expr (def);
+      auto loc = gimple_phi_arg_location (phi, exit->dest_idx);
       remove_phi_node (&psi, false);
 
       /* Propagate constants immediately, but leave an unused initialization
@@ -3888,8 +3889,7 @@  final_value_replacement_loop (class loop *loop)
       gimple_seq stmts;
       def = force_gimple_operand (def, &stmts, false, NULL_TREE);
       gassign *ass = gimple_build_assign (rslt, def);
-      gimple_set_location (ass,
-			   gimple_phi_arg_location (phi, exit->dest_idx));
+      gimple_set_location (ass, loc);
       gimple_seq_add_stmt (&stmts, ass);
 
       /* If def's type has undefined overflow and there were folded