mirror of
https://github.com/carbon-language/carbon-lang.git
synced 2026-09-24 22:02:23 +01:00
Richard Smith
e05523db21
There were two issues contributing to this crash: - Primarily, the issue is that we queue up diagnostics and don't format them into a string until we reach the end of compilation. In some code paths in the driver, we destroyed the Semantics IR object before this happened. But diagnostics can contain references to Semantics IR objects, such as strings stored in the string table, which can lead to a use after destruction bug. This is fixed by ensuring the diagnotics consumer is flushed before destroying any of the objects that it can refer to. The current approach to this is not especially clean, unfortunately, but this requires fighting C++ as this isn't the order in which it wants to destroy things. - This issue was obscured by the Semantics IR's string table holding a reference to whatever underlying storage it was given rather than its own string storage, so sometimes it would hold a reference to a string from the source file, and sometimes a string from the tokenized buffer's string table. The diagnostics were always flushed before the source file was destroyed, but not before the tokenized buffer was destroyed. So to see the issue, you'd need to have a string literal with certain contents followed by an identifier with a name that matched those contents. The crash is made more reliable by holding references to the Semantics IR's string map in its string table, rather than references to someone else's strings. This also fixes a latent bug where passing a string temporary to SemanticsIR::AddString would store a dangling reference in the string table. Incidentally, AddString is also changed to perform only one hash table lookup rather than two for each added string.