Skip to content

Commit 4af277c

Browse files
Fix potential pointer lifetime issue in the type scavenger. (#1850)
As computerPointerElementType is recursive, it's possible for the hash table to be resized during the call to the function. If this happens, then the reference to the value is no longer a valid reference, and may overwrite memory (or just plain segfault).
1 parent 9ccf154 commit 4af277c

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

lib/SPIRV/SPIRVTypeScavenger.cpp

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -293,7 +293,7 @@ SPIRVTypeScavenger::computePointerElementType(Value *V) {
293293
}
294294

295295
// Check if we've already deduced a type for the value.
296-
DeducedType &Ty = DeducedTypes[V];
296+
DeducedType Ty = DeducedTypes[V];
297297
if (Ty) {
298298
return Ty;
299299
}
@@ -402,6 +402,7 @@ SPIRVTypeScavenger::computePointerElementType(Value *V) {
402402
Ty = Deferred;
403403
}
404404

405+
DeducedTypes[V] = Ty;
405406
VisitStack.pop_back();
406407
return Ty;
407408
}

0 commit comments

Comments
 (0)