carbon-language/carbon-lang
1
0
Fork 0
mirror of https://github.com/carbon-language/carbon-lang.git synced 2026-10-05 22:02:55 +01:00
Code Issues Packages Projects Releases 10 Wiki Activity

Fix use-after-free in return statement handling. (#4472)

Browse Source 
Initialization can import a function and thus invalidate the reference
we're holding to the enclosing function. Don't use the reference after
initialization completes.
This commit is contained in:
Richard Smith
2024-11-01 23:11:27 +00:00
committed by GitHub
parent ac5cc33da4
commit 261fe38508
2 changed files with 1394 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
toolchain/check/return.cpp
+2 -1
View File
@@ -160,8 +160,9 @@ auto BuildReturnWithExpr(Context& context, Parse::ReturnStatementId node_id,
// convert to it.
expr_id = SemIR::InstId::BuiltinError;
} else if (return_info.has_return_slot()) {
expr_id = Initialize(context, node_id, function.return_slot_id, expr_id);
return_slot_id = function.return_slot_id;
// Note that this can import a function and invalidate `function`.
expr_id = Initialize(context, node_id, return_slot_id, expr_id);
} else {
expr_id =
ConvertToValueOfType(context, node_id, expr_id, return_info.type_id);