https://github.com/rjodinchr updated https://github.com/llvm/llvm-project/pull/238333
>From 2b3deaff8a2b0fee6998e8b3ed3c75c00ba39bd1 Mon Sep 17 00:00:00 2001 From: Romaric Jodin <[email protected]> Date: Tue, 3 Nov 2026 11:53:11 +0100 Subject: [PATCH] [Clang][LifetimeSafety] Avoid typed Allocate<FactType> before new FactManager::createFact allocated storage for polymorphic Fact subclasses via FactAllocator.Allocate<FactType>() before constructing the FactType object with placement new. AllocatorBase::Allocate<T> casts the raw void * buffer returned by Allocate(sizeof(T), alignof(T)) to T * using static_cast<T *>. Because FactType derives from the polymorphic Fact class, compiling with Control Flow Integrity (-fsanitize=cfi-unrelated-cast) instruments static_cast<FactType *> to verify the vtable pointer at the returned address before placement new has initialized the object's vtable, causing a runtime CFI failure on uninitialized BumpPtrAllocator memory. Use the untyped FactAllocator.Allocate(sizeof(FactType), alignof(FactType)) overload and pass the resulting void * directly to placement new so the FactType * pointer is only formed by the placement new expression after the vtable pointer is initialized. --- clang/include/clang/Analysis/Analyses/LifetimeSafety/Facts.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/clang/include/clang/Analysis/Analyses/LifetimeSafety/Facts.h b/clang/include/clang/Analysis/Analyses/LifetimeSafety/Facts.h index 7e086f8c0f1a7..bb575429f9bdf 100644 --- a/clang/include/clang/Analysis/Analyses/LifetimeSafety/Facts.h +++ b/clang/include/clang/Analysis/Analyses/LifetimeSafety/Facts.h @@ -449,7 +449,7 @@ class FactManager { template <typename FactType, typename... Args> FactType *createFact(Args &&...args) { - void *Mem = FactAllocator.Allocate<FactType>(); + void *Mem = FactAllocator.Allocate(sizeof(FactType), alignof(FactType)); FactType *Res = new (Mem) FactType(std::forward<Args>(args)...); Res->setID(NextFactID++); return Res; _______________________________________________ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
