Skip to content

Commit c5297b8

Browse files
author
Kevin Smith
committed
[MERGE #6267 @zenparsing] Prevent a use after free in memop
Merge pull request #6267 from zenparsing:use-after-free-memop
2 parents e1f5b03 + fb4a653 commit c5297b8

File tree

1 file changed

+5
-4
lines changed

1 file changed

+5
-4
lines changed

lib/Backend/GlobOpt.cpp

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17080,13 +17080,14 @@ GlobOpt::EmitMemop(Loop * loop, LoopCount *loopCount, const MemOpEmitData* emitD
1708017080
RemoveMemOpSrcInstr(memopInstr, emitData->stElemInstr, emitData->block);
1708117081
if (!isMemset)
1708217082
{
17083-
if (((MemCopyEmitData*)emitData)->ldElemInstr->GetSrc1()->IsIndirOpnd())
17083+
IR::Instr* ldElemInstr = ((MemCopyEmitData*)emitData)->ldElemInstr;
17084+
if (ldElemInstr->GetSrc1()->IsIndirOpnd())
1708417085
{
17085-
baseOpnd = ((MemCopyEmitData*)emitData)->ldElemInstr->GetSrc1()->AsIndirOpnd()->GetBaseOpnd();
17086+
baseOpnd = ldElemInstr->GetSrc1()->AsIndirOpnd()->GetBaseOpnd();
1708617087
isLikelyJsArray = baseOpnd->GetValueType().IsLikelyArrayOrObjectWithArray();
17087-
ProcessNoImplicitCallArrayUses(baseOpnd, baseOpnd->IsArrayRegOpnd() ? baseOpnd->AsArrayRegOpnd() : nullptr, emitData->stElemInstr, isLikelyJsArray, true);
17088+
ProcessNoImplicitCallArrayUses(baseOpnd, baseOpnd->IsArrayRegOpnd() ? baseOpnd->AsArrayRegOpnd() : nullptr, ldElemInstr, isLikelyJsArray, true);
1708817089
}
17089-
RemoveMemOpSrcInstr(memopInstr, ((MemCopyEmitData*)emitData)->ldElemInstr, emitData->block);
17090+
RemoveMemOpSrcInstr(memopInstr, ldElemInstr, emitData->block);
1709017091
}
1709117092
InsertNoImplicitCallUses(memopInstr);
1709217093
noImplicitCallUsesToInsert->Clear();

0 commit comments

Comments
 (0)