[PATCH] Fix use-after-free in the strlen pass (PR tree-optimization/82977)

[Jakub Jelinek]

Hi!

strlen_to_stridx.get (rhs1) returns an address into the hash_map, and
strlen_to_stridx.put (lhs, *ps); (in order to be efficient) doesn't make a
copy of the argument just in case, first inserts the slot into it which
may cause reallocation, and only afterwards runs the copy ctor to assign
the value into the new slot.  So, passing it a reference to something
in the hash_map is wrong.  Fixed thusly, bootstrapped/regtested on
x86_64-linux and i686-linux, ok for trunk?

2017-11-14  Jakub Jelinek  <ja...@redhat.com>

        PR tree-optimization/82977
        * tree-ssa-strlen.c (strlen_optimize_stmt): Pass a reference to a copy
        constructed temporary to strlen_to_stridx.put.

--- gcc/tree-ssa-strlen.c.jj    2017-11-13 09:31:30.000000000 +0100
+++ gcc/tree-ssa-strlen.c       2017-11-14 10:28:30.583110162 +0100
@@ -2968,7 +2968,7 @@ strlen_optimize_stmt (gimple_stmt_iterat
 
        tree rhs1 = gimple_assign_rhs1 (stmt);
        if (stridx_strlenloc *ps = strlen_to_stridx.get (rhs1))
-         strlen_to_stridx.put (lhs, *ps);
+         strlen_to_stridx.put (lhs, stridx_strlenloc (*ps));
       }
     else if (TREE_CODE (lhs) != SSA_NAME && !TREE_SIDE_EFFECTS (lhs))
        {

        Jakub