replica
/
hanchenye-llvm-project
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

IR: Fix memory corruption in MDNode new/delete 

There were two major problems with `MDNode` memory management.

 1. `MDNode::operator new()` called a placement array constructor for
    `MDOperand`.  What?  Each operand needs to be placed individually.

 2. `MDNode::operator delete()` failed to destruct the `MDOperand`s at
    all.

Frankly it's hard to understand how this worked locally, how this
survived an LTO bootstrap, or how it worked on most of the bots.

llvm-svn: 223858
This commit is contained in:
Duncan P. N. Exon Smith 2014-12-09 23:56:39 +00:00
parent 4cea5b4954
commit 22600ff328
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
llvm/lib/IR/Metadata.cpp
View File

@ -378,14 +378,18 @@ StringRef MDString::getString() const {
void *MDNode::operator new(size_t Size, unsigned NumOps) {
void *Ptr = ::operator new(Size + NumOps * sizeof(MDOperand));
MDOperand *First = new (Ptr) MDOperand[NumOps];
return First + NumOps;
MDOperand *O = static_cast<MDOperand *>(Ptr);
for (MDOperand *E = O + NumOps; O != E; ++O)
(void)new (O) MDOperand;
return O;
}
void MDNode::operator delete(void *Mem) {
MDNode *N = static_cast<MDNode *>(Mem);
MDOperand *Last = static_cast<MDOperand *>(Mem);
::operator delete(Last - N->NumOperands);
MDOperand *O = static_cast<MDOperand *>(Mem);
for (MDOperand *E = O - N->NumOperands; O != E; --O)
(O - 1)->~MDOperand();
::operator delete(O);
}
MDNode::MDNode(LLVMContext &Context, unsigned ID, ArrayRef<Metadata *> MDs)