Cold-Air-Networks/mirror-llvm-project
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 7

[Clang][Coroutines] Don't emit fake uses for coroutine parameters (#194690)

Browse source 
Fixes issue: https://github.com/llvm/llvm-project/issues/192351

The combination of coroutines with -fextend-variable-liveness has
resulted in use-after-free, caused by the fact that we insert fake uses
of coroutine parameters at the end of the coroutine. While this is fine
for normal functions, in coroutines these variables are stored in the
coroutine frame, which is freed before the end of the function; this
results in us loading from the deleted frame.

This patch fixes this by no longer emitting fake uses for most coroutine
parameters. Since coroutine parameters will be saved back to the frame
when we suspend, and currently may not be optimized out, fake uses are
not needed in this case, and so by not emitting them we avoid dealing
with the complexity of updating fake uses in the CoroSplit pass. The
exception to this is 'this', which is not saved to the frame.

(cherry picked from commit efb01c1bf5)
This commit is contained in:
Stephen Tozer 2026-05-01 10:48:16 +01:00 committed by Douglas Yung
parent 5fb52fc3fd
commit fc4aad7b5d
No known key found for this signature in database
GPG key ID: 316C56D064CACBA5
2 changed files with 49 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
clang/lib/CodeGen/CGDecl.cpp
View file

@ -2829,8 +2829,13 @@ void CodeGenFunction::EmitParmDecl(const VarDecl &D, ParamValue Arg,
(CGM.getCodeGenOpts().getExtendVariableLiveness() ==
CodeGenOptions::ExtendVariableLivenessKind::This &&
&D == CXXABIThisDecl)) {
if (shouldExtendLifetime(getContext(), CurCodeDecl, D, CXXABIThisDecl))
EHStack.pushCleanup<FakeUse>(NormalFakeUse, DeclPtr);
// We don't emit fake uses for coroutine parameters, other than `this`.
if (auto *FnDecl = dyn_cast_or_null<FunctionDecl>(CurCodeDecl);
&D == CXXABIThisDecl || !FnDecl ||
FnDecl->getBody()->getStmtClass() != Stmt::CoroutineBodyStmtClass) {
if (shouldExtendLifetime(getContext(), CurCodeDecl, D, CXXABIThisDecl))
EHStack.pushCleanup<FakeUse>(NormalFakeUse, DeclPtr);
}
}
// Emit debug info for param declarations in non-thunk functions.

42
clang/test/CodeGenCoroutines/coro-param-fake-use.cpp Normal file
View file

@ -0,0 +1,42 @@
// RUN: %clang_cc1 -std=c++20 -triple=x86_64-unknown-linux-gnu -emit-llvm -fextend-variable-liveness -o - %s -disable-llvm-passes -fexceptions | FileCheck %s
// See issue #192351
// Tests that parameters to a coroutine do not have fake uses inserted for them
// when we enable -fextend-variable-liveness, except for `this`, which is not
// stored in the coroutine frame.
#include "Inputs/coroutine.h"
struct task {
struct promise_type {
task get_return_object() noexcept { return {}; }
std::suspend_never initial_suspend() noexcept { return {}; }
std::suspend_never final_suspend() noexcept { return {}; }
void return_void() noexcept {}
void unhandled_exception() noexcept {}
};
};
class C {
public:
C() {}
// CHECK-LABEL: void @_ZN1C1fEb(ptr noundef{{.*}} %this, i1 noundef{{.*}} %b)
task f(bool b) {
// CHECK: store ptr %this, ptr %[[THIS_ADDR:.+]]
// CHECK-NOT: llvm.fake.use
// CHECK: coro.ret:
// CHECK-NEXT: call void @llvm.coro.end(
// CHECK-NEXT: %[[THIS_FAKE_USE:.+]] = load ptr, ptr %[[THIS_ADDR]]
// CHECK-NEXT: notail call void (...) @llvm.fake.use(ptr %[[THIS_FAKE_USE]])
// CHECK-NEXT: ret void
if (b) {
co_await std::suspend_always{};
}
}
};
void foo() {
C().f(false);
}