Hi,

PR 103449 revealed that when I was storing result of one hash_map
lookup into another entry in the hash_map, I was still accessing the
entry in the table, which meanwhile could get reallocated, making the
accesses invalid-after-free.

Fixed with the following, which also simplifies the return statement
which must have been true even now.

Bootstrapped and tested on x86_64-linux.  OK for master?

Thanks,

Martin


gcc/ChangeLog:

2021-11-29  Martin Liska  <mli...@suse.cz>
            Martin Jambor  <mjam...@suse.cz>

        PR ipa/103449
        * ipa-param-manipulation.c
        (ipa_param_body_adjustments::prepare_debug_expressions): Be
        careful about hash_map reallocating itself.  Simpify a return
        which always returns true.
---
 gcc/ipa-param-manipulation.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/gcc/ipa-param-manipulation.c b/gcc/ipa-param-manipulation.c
index 479c20b3871..163af94cde0 100644
--- a/gcc/ipa-param-manipulation.c
+++ b/gcc/ipa-param-manipulation.c
@@ -1279,9 +1279,10 @@ ipa_param_body_adjustments::prepare_debug_expressions 
(tree dead_ssa)
       if (gimple_assign_copy_p (def)
          && TREE_CODE (gimple_assign_rhs1 (def)) == SSA_NAME)
        {
-         tree *d = m_dead_ssa_debug_equiv.get (gimple_assign_rhs1 (def));
-         m_dead_ssa_debug_equiv.put (dead_ssa, *d);
-         return (*d != NULL_TREE);
+         tree d = *m_dead_ssa_debug_equiv.get (gimple_assign_rhs1 (def));
+         gcc_assert (d);
+         m_dead_ssa_debug_equiv.put (dead_ssa, d);
+         return true;
        }
 
       tree val
-- 
2.33.1

Reply via email to