Parcourir la source

[1.11>master] [MERGE #6267 @zenparsing] Prevent a use after free in memop

Merge pull request #6267 from zenparsing:use-after-free-memop
Kevin Smith il y a 6 ans
Parent
commit
e79d68a8c0
1 fichiers modifiés avec 5 ajouts et 4 suppressions
  1. 5 4
      lib/Backend/GlobOpt.cpp

+ 5 - 4
lib/Backend/GlobOpt.cpp

@@ -17410,13 +17410,14 @@ GlobOpt::EmitMemop(Loop * loop, LoopCount *loopCount, const MemOpEmitData* emitD
     RemoveMemOpSrcInstr(memopInstr, emitData->stElemInstr, emitData->block);
     if (!isMemset)
     {
-        if (((MemCopyEmitData*)emitData)->ldElemInstr->GetSrc1()->IsIndirOpnd())
+        IR::Instr* ldElemInstr = ((MemCopyEmitData*)emitData)->ldElemInstr;
+        if (ldElemInstr->GetSrc1()->IsIndirOpnd())
         {
-            baseOpnd = ((MemCopyEmitData*)emitData)->ldElemInstr->GetSrc1()->AsIndirOpnd()->GetBaseOpnd();
+            baseOpnd = ldElemInstr->GetSrc1()->AsIndirOpnd()->GetBaseOpnd();
             isLikelyJsArray = baseOpnd->GetValueType().IsLikelyArrayOrObjectWithArray();
-            ProcessNoImplicitCallArrayUses(baseOpnd, baseOpnd->IsArrayRegOpnd() ? baseOpnd->AsArrayRegOpnd() : nullptr, emitData->stElemInstr, isLikelyJsArray, true);
+            ProcessNoImplicitCallArrayUses(baseOpnd, baseOpnd->IsArrayRegOpnd() ? baseOpnd->AsArrayRegOpnd() : nullptr, ldElemInstr, isLikelyJsArray, true);
         }
-        RemoveMemOpSrcInstr(memopInstr, ((MemCopyEmitData*)emitData)->ldElemInstr, emitData->block);
+        RemoveMemOpSrcInstr(memopInstr, ldElemInstr, emitData->block);
     }
     InsertNoImplicitCallUses(memopInstr);
     noImplicitCallUsesToInsert->Clear();