Skip to content

Commit 9c9853e

Browse files
ahatanakahatanaka
authored andcommitted
Fix a use-after-free crash in ResetObjCLayout (llvm#170360)
operator[] can potentially cause reallocation and invalidate live iterators if it's called with a key that isn't present in the DenseMap. Call lookup() instead to prevent the function from inserting new entries into the DenseMap for ObjC classes that don't have any subclasses. rdar://165448332
1 parent 0c18862 commit 9c9853e

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

clang/lib/AST/ASTContext.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12846,7 +12846,7 @@ bool ASTContext::mergeExtParameterInfo(
1284612846
void ASTContext::ResetObjCLayout(const ObjCInterfaceDecl *D) {
1284712847
if (auto It = ObjCLayouts.find(D); It != ObjCLayouts.end()) {
1284812848
It->second = nullptr;
12849-
for (auto *SubClass : ObjCSubClasses[D])
12849+
for (auto *SubClass : ObjCSubClasses.lookup(D))
1285012850
ResetObjCLayout(SubClass);
1285112851
}
1285212852
}

0 commit comments

Comments
 (0)