Skip to content

Commit

Permalink
Builder::create<OpBranchConditional>: Fix access to destroyed array.
Browse files Browse the repository at this point in the history
Previously, md_arr was a named ArrayRef variable constructed from an
initializer list. This initializer list causes a temporary array to be
created, the ArrayRef is then bound to that temporary array, and then
the temporary array gets destroyed. In the subsequent call to
llvm::MDTuple::get(*context.llvmContext, md_arr) then, md_arr no longer
referenced any array still in existence.

Make md_arr an array instead, like its name implies, to ensure it lives
long enough to still be valid during MDTuple::get.
  • Loading branch information
hvdijk committed Oct 30, 2024
1 parent 18e5871 commit 66fe147
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions modules/compiler/spirv-ll/source/builder_core.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -6042,11 +6042,11 @@ llvm::Error Builder::create<OpBranchConditional>(
branch_inst->setMetadata(md_nodes.front().second, md_nodes.front().first);
} else {
// if both possible nodes are needed create an `MDTuple` out of them
const llvm::ArrayRef<llvm::Metadata *> md_arr = {md_nodes[0].first,
md_nodes[1].first};
llvm::Metadata *md_arr[] = {md_nodes[0].first, md_nodes[1].first};

branch_inst->setMetadata(
"MDTuple", llvm::MDTuple::get(*context.llvmContext, md_arr));
"MDTuple",
llvm::MDTuple::get(*context.llvmContext, llvm::ArrayRef(md_arr)));
}
}

Expand Down

0 comments on commit 66fe147

Please sign in to comment.