1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
|
// RUN: %target-sil-opt -enforce-exclusivity=none -enable-sil-verify-all %s -copy-forwarding -enable-copyforwarding | %FileCheck %s
// CopyForwarding currently only runs on OSSA. This file only contains
// tests that will break is CopyForwarding were to run on non-OSSA SIL.
sil_stage canonical
import Builtin
import Swift
struct ObjWrapper {
var obj: AnyObject
}
// If CopyForwarding (with destroy-hoisting) runs on non-OSSA SIL it
// may result in a use-after-free in this case.
//
// In this example, some other pass, such as retain-sinking, has
// already moved an object's retain (bb1) below the destroy of the
// memory from which the object was originally loaded (copy_addr
// [take] in bb0). This seems crazy but still follows non-OSSA SIL
// rules.
//
// If destroy hoisting reorders the retain and destroy_addr in bb1,
// then the object passed as a guaranteed argument will be incorrectly
// destroyed.
// CHECK-LABEL: sil @testDestroyHoistOverRetain : $@convention(thin) (@guaranteed AnyObject) -> () {
// CHECK: bb1:
// CHECK: retain_value %{{.*}} : $AnyObject
// CHECK: destroy_addr %{{.*}} : $*ObjWrapper
// CHECK-LABEL: } // end sil function 'testDestroyHoistOverRetain'
sil @testDestroyHoistOverRetain : $@convention(thin) (@guaranteed AnyObject) -> () {
bb0(%0 : $AnyObject):
%alloc1 = alloc_stack $ObjWrapper
%objaddr = struct_element_addr %alloc1 : $*ObjWrapper, #ObjWrapper.obj
store %0 to %objaddr : $*AnyObject
%ref = load %objaddr : $*AnyObject
%alloc2 = alloc_stack $ObjWrapper
// The location loaded from is destroyed here with no corresponding
// retain.
copy_addr [take] %alloc1 to [init] %alloc2 : $*ObjWrapper
cond_br undef, bb1, bb2
bb1:
// This retain and destroy are not obviously related but need to
// execute in this order to cancel each other out.
retain_value %ref : $AnyObject
destroy_addr %alloc2 : $*ObjWrapper
br bb3
bb2:
copy_addr [take] %alloc2 to [init] %alloc1 : $*ObjWrapper
br bb3
bb3:
dealloc_stack %alloc2 : $*ObjWrapper
dealloc_stack %alloc1 : $*ObjWrapper
%99 = tuple ()
return %99 : $()
}
|
