| Issue |
208848
|
| Summary |
[CIR] Use-after-free in VisitAbstractConditionalOperator when a ternary arm is a throw _expression_
|
| Labels |
new issue
|
| Assignees |
|
| Reporter |
kumarak
|
ClangIR CIRGen crashes when emitting a conditional operator whose arm is a throw _expression_. Depending on heap reuse, this manifests as either a CIR verifier failure or a segfault.
### Reproducer:
```
int f(bool b, int x) { return b ? throw 1 : x; }
$ clang++ -fclangir -fexceptions -fcxx-exceptions -Xclang -emit-cir -S repro.cpp
loc(fused["repro.cpp":1:31, "repro.cpp":1:45]): error: 'cir.yield' op must be the last operation in the parent block
fatal error: CIR module verification error before running CIR-to-CIR passes
The same file with -fclangir -c instead segfaults:
#7 ScalarExprEmitter::VisitAbstractConditionalOperator(clang::AbstractConditionalOperator const*)
#6 cir::YieldOp::create(mlir::OpBuilder&, mlir::Location)
#5 mlir::OpBuilder::create(mlir::OperationState const&)
```
It also reproduces with the throw in the false arm and with both arms throwing.
This breaks compiling std::cout << "str" against current libc++ headers, whose operator<<(basic_ostream&, const char*) contains a ternary with a throwing arm.
Example:
```
#include <iostream>
int main() { std::cout << "test segfault"; return 0; }
```
![]()
_______________________________________________
llvm-bugs mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-bugs
