aboutsummaryrefslogtreecommitdiff
path: root/gcc
diff options
context:
space:
mode:
authorTrevor Saunders <tsaunders@mozilla.com>2014-08-05 19:52:08 +0000
committerTrevor Saunders <tbsaunde@gcc.gnu.org>2014-08-05 19:52:08 +0000
commit6ef6945c9cbb0ab43f3b04e97f0a2285494a9c87 (patch)
tree08e15d996f5d38479d228272b96d20455a6a1b92 /gcc
parentfa12e57e0cbd3f761326c511cc2eeac9581f6889 (diff)
downloadgcc-6ef6945c9cbb0ab43f3b04e97f0a2285494a9c87.zip
gcc-6ef6945c9cbb0ab43f3b04e97f0a2285494a9c87.tar.gz
gcc-6ef6945c9cbb0ab43f3b04e97f0a2285494a9c87.tar.bz2
fix pr62009 use after free in redirect_edge_var_map_dup
The change to get the entry for the old edge before inserting the new one was incorrect because if inserting the new one resized the table then the pointer to the entry for the old one would become invalid. gcc/ * tree-ssa.c (redirect_edge_var_map_dup): insert newe before getting olde. From-SVN: r213644
Diffstat (limited to 'gcc')
-rw-r--r--gcc/ChangeLog5
-rw-r--r--gcc/tree-ssa.c7
2 files changed, 9 insertions, 3 deletions
diff --git a/gcc/ChangeLog b/gcc/ChangeLog
index f199fed..17a0f2d 100644
--- a/gcc/ChangeLog
+++ b/gcc/ChangeLog
@@ -1,3 +1,8 @@
+2014-08-05 Trevor Saunders <tsaunders@mozilla.com>
+
+ * tree-ssa.c (redirect_edge_var_map_dup): insert newe before
+ getting olde.
+
2014-08-05 Richard Biener <rguenther@suse.de>
PR rtl-optimization/61672
diff --git a/gcc/tree-ssa.c b/gcc/tree-ssa.c
index 217b9fc..e684296 100644
--- a/gcc/tree-ssa.c
+++ b/gcc/tree-ssa.c
@@ -106,11 +106,12 @@ redirect_edge_var_map_dup (edge newe, edge olde)
if (!edge_var_maps)
return;
- auto_vec<edge_var_map> *head = edge_var_maps->get (olde);
- if (!head)
+ auto_vec<edge_var_map> *new_head = &edge_var_maps->get_or_insert (newe);
+ auto_vec<edge_var_map> *old_head = edge_var_maps->get (olde);
+ if (!old_head)
return;
- edge_var_maps->get_or_insert (newe).safe_splice (*head);
+ new_head->safe_splice (*old_head);
}