diff mbox series

ipa-param-manip: Be careful about a reallocating hash_map (PR 103449)

Message ID ri68rx6hlmi.fsf@suse.cz
State Committed
Commit b3f60112edcb85b459e60f66c44a55138b1cef49
Headers
Series ipa-param-manip: Be careful about a reallocating hash_map (PR 103449) |

Commit Message

Martin Jambor Nov. 29, 2021, 6:17 p.m. UTC 
  Hi,

PR 103449 revealed that when I was storing result of one hash_map
lookup into another entry in the hash_map, I was still accessing the
entry in the table, which meanwhile could get reallocated, making the
accesses invalid-after-free.

Fixed with the following, which also simplifies the return statement
which must have been true even now.

Bootstrapped and tested on x86_64-linux.  OK for master?

Thanks,

Martin


gcc/ChangeLog:

2021-11-29  Martin Liska  <mliska@suse.cz>
	    Martin Jambor  <mjambor@suse.cz>

	PR ipa/103449
	* ipa-param-manipulation.c
	(ipa_param_body_adjustments::prepare_debug_expressions): Be
	careful about hash_map reallocating itself.  Simpify a return
	which always returns true.
---
 gcc/ipa-param-manipulation.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

Comments

Jan Hubicka Nov. 29, 2021, 6:19 p.m. UTC | #1 
> Hi,
> 
> PR 103449 revealed that when I was storing result of one hash_map
> lookup into another entry in the hash_map, I was still accessing the
> entry in the table, which meanwhile could get reallocated, making the
> accesses invalid-after-free.
> 
> Fixed with the following, which also simplifies the return statement
> which must have been true even now.
> 
> Bootstrapped and tested on x86_64-linux.  OK for master?
> 
> Thanks,
> 
> Martin
> 
> 
> gcc/ChangeLog:
> 
> 2021-11-29  Martin Liska  <mliska@suse.cz>
> 	    Martin Jambor  <mjambor@suse.cz>
> 
> 	PR ipa/103449
> 	* ipa-param-manipulation.c
> 	(ipa_param_body_adjustments::prepare_debug_expressions): Be
> 	careful about hash_map reallocating itself.  Simpify a return
> 	which always returns true.
OK, thanks!
Honza
diff mbox series

Patch

diff --git a/gcc/ipa-param-manipulation.c b/gcc/ipa-param-manipulation.c
index 479c20b3871..163af94cde0 100644
--- a/gcc/ipa-param-manipulation.c
+++ b/gcc/ipa-param-manipulation.c
@@ -1279,9 +1279,10 @@  ipa_param_body_adjustments::prepare_debug_expressions (tree dead_ssa)
       if (gimple_assign_copy_p (def)
 	  && TREE_CODE (gimple_assign_rhs1 (def)) == SSA_NAME)
 	{
-	  tree *d = m_dead_ssa_debug_equiv.get (gimple_assign_rhs1 (def));
-	  m_dead_ssa_debug_equiv.put (dead_ssa, *d);
-	  return (*d != NULL_TREE);
+	  tree d = *m_dead_ssa_debug_equiv.get (gimple_assign_rhs1 (def));
+	  gcc_assert (d);
+	  m_dead_ssa_debug_equiv.put (dead_ssa, d);
+	  return true;
 	}
 
       tree val