Fix use-after-free of var name in BuildDefaultValueExpr (#8025)

The `var_name` string was built on the stack and then added to the
`IdentifierStore`. This lead to use-after-free, since `IdentifierStore`
just stores a `llvm::StringRef`.

Add it to `ast_context().Idents` to provide a longer-lived reference.
This commit is contained in:
Nicholas Bishop authored and GitHub committed 2026-10-25 15:26:19 +00:00
1 parent 224a22ef30
commit 8fdc8ebc37
1 file changed
+2 -1
+2 -1
View File
@@ -1224,8 +1224,9 @@ static auto BuildDefaultValueExpr(Context& context, SemIR::LocId loc_id,
mangler.Mangle(target.function_id, SemIR::SpecificId::None);
llvm::SmallString<64> var_name = llvm::formatv(
"__carbon_default_value_{}_{}", mangled_fn_name, parameter_index);
auto& ident = context.ast_context().Idents.get(var_name);
auto name_id =
SemIR::NameId::ForIdentifier(context.identifiers().Add(var_name));
SemIR::NameId::ForIdentifier(context.identifiers().Add(ident.getName()));
// First we synthesize the variable definition by creating an EntityName from
// the generated name stored in `var_name`. We want to generate a