diff options
| author | Richard Biener <rguenther@suse.de> | 2024-04-08 10:38:49 +0200 |
|---|---|---|
| committer | Richard Biener <rguenther@suse.de> | 2024-04-08 11:37:25 +0200 |
| commit | 97d5cd8740384dbce5a83080916388f80d8976dd (patch) | |
| tree | c538933a5a1026275ea75e299058c167dda37b41 | |
| parent | 7d051f7d45789e1442d26c07bfc5e7fb77433b87 (diff) | |
| download | gcc-97d5cd8740384dbce5a83080916388f80d8976dd.zip gcc-97d5cd8740384dbce5a83080916388f80d8976dd.tar.gz gcc-97d5cd8740384dbce5a83080916388f80d8976dd.tar.bz2 | |
tree-optimization/114624 - fix use-after-free in SCCP
We're inspecting the replaced PHI node after releasing it.
PR tree-optimization/114624
* tree-scalar-evolution.cc (final_value_replacement_loop):
Get at the PHI arg location before releasing the PHI node.
* gcc.dg/torture/pr114624.c: New testcase.
| -rw-r--r-- | gcc/testsuite/gcc.dg/torture/pr114624.c | 20 | ||||
| -rw-r--r-- | gcc/tree-scalar-evolution.cc | 4 |
2 files changed, 22 insertions, 2 deletions
diff --git a/gcc/testsuite/gcc.dg/torture/pr114624.c b/gcc/testsuite/gcc.dg/torture/pr114624.c new file mode 100644 index 0000000..ae03135 --- /dev/null +++ b/gcc/testsuite/gcc.dg/torture/pr114624.c @@ -0,0 +1,20 @@ +/* { dg-do compile } */ + +int a, b; +int main() { + int c, d = 1; + while (a) { + while (b) + if (d) + while (a) + ; + for (; b < 2; b++) + if (b) + for (c = 0; c < 8; c++) + d = 0; + else + for (a = 0; a < 2; a++) + ; + } + return 0; +} diff --git a/gcc/tree-scalar-evolution.cc b/gcc/tree-scalar-evolution.cc index 25e3130..b0a5e09 100644 --- a/gcc/tree-scalar-evolution.cc +++ b/gcc/tree-scalar-evolution.cc @@ -3877,6 +3877,7 @@ final_value_replacement_loop (class loop *loop) to a GIMPLE sequence or to a statement list (keeping this a GENERIC interface). */ def = unshare_expr (def); + auto loc = gimple_phi_arg_location (phi, exit->dest_idx); remove_phi_node (&psi, false); /* Propagate constants immediately, but leave an unused initialization @@ -3888,8 +3889,7 @@ final_value_replacement_loop (class loop *loop) gimple_seq stmts; def = force_gimple_operand (def, &stmts, false, NULL_TREE); gassign *ass = gimple_build_assign (rslt, def); - gimple_set_location (ass, - gimple_phi_arg_location (phi, exit->dest_idx)); + gimple_set_location (ass, loc); gimple_seq_add_stmt (&stmts, ass); /* If def's type has undefined overflow and there were folded |