Skip to content

Commit e79d68a

Browse files
author
Kevin Smith
committed
[1.11>master] [MERGE #6267 @zenparsing] Prevent a use after free in memop
Merge pull request #6267 from zenparsing:use-after-free-memop
2 parents b2c0518 + c5297b8 commit e79d68a

File tree

1 file changed

+5
-4
lines changed

1 file changed

+5
-4
lines changed

lib/Backend/GlobOpt.cpp

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17410,13 +17410,14 @@ GlobOpt::EmitMemop(Loop * loop, LoopCount *loopCount, const MemOpEmitData* emitD
1741017410
RemoveMemOpSrcInstr(memopInstr, emitData->stElemInstr, emitData->block);
1741117411
if (!isMemset)
1741217412
{
17413-
if (((MemCopyEmitData*)emitData)->ldElemInstr->GetSrc1()->IsIndirOpnd())
17413+
IR::Instr* ldElemInstr = ((MemCopyEmitData*)emitData)->ldElemInstr;
17414+
if (ldElemInstr->GetSrc1()->IsIndirOpnd())
1741417415
{
17415-
baseOpnd = ((MemCopyEmitData*)emitData)->ldElemInstr->GetSrc1()->AsIndirOpnd()->GetBaseOpnd();
17416+
baseOpnd = ldElemInstr->GetSrc1()->AsIndirOpnd()->GetBaseOpnd();
1741617417
isLikelyJsArray = baseOpnd->GetValueType().IsLikelyArrayOrObjectWithArray();
17417-
ProcessNoImplicitCallArrayUses(baseOpnd, baseOpnd->IsArrayRegOpnd() ? baseOpnd->AsArrayRegOpnd() : nullptr, emitData->stElemInstr, isLikelyJsArray, true);
17418+
ProcessNoImplicitCallArrayUses(baseOpnd, baseOpnd->IsArrayRegOpnd() ? baseOpnd->AsArrayRegOpnd() : nullptr, ldElemInstr, isLikelyJsArray, true);
1741817419
}
17419-
RemoveMemOpSrcInstr(memopInstr, ((MemCopyEmitData*)emitData)->ldElemInstr, emitData->block);
17420+
RemoveMemOpSrcInstr(memopInstr, ldElemInstr, emitData->block);
1742017421
}
1742117422
InsertNoImplicitCallUses(memopInstr);
1742217423
noImplicitCallUsesToInsert->Clear();

0 commit comments

Comments
 (0)