Fix heap-use-after-free bug in expandSDiv when the operands are
constants, as discovered by ASAN.
Patch by Mehdi Amini!
llvm-svn: 221401
diff --git a/llvm/lib/Transforms/Utils/IntegerDivision.cpp b/llvm/lib/Transforms/Utils/IntegerDivision.cpp
index 9f91eeb..0ae746c 100644
--- a/llvm/lib/Transforms/Utils/IntegerDivision.cpp
+++ b/llvm/lib/Transforms/Utils/IntegerDivision.cpp
@@ -398,11 +398,13 @@
Rem->dropAllReferences();
Rem->eraseFromParent();
- // If we didn't actually generate a udiv instruction, we're done
- BinaryOperator *BO = dyn_cast<BinaryOperator>(Builder.GetInsertPoint());
- if (!BO || BO->getOpcode() != Instruction::URem)
+ // If we didn't actually generate an urem instruction, we're done
+ // This happens for example if the input were constant. In this case the
+ // Builder insertion point was unchanged
+ if (Rem == Builder.GetInsertPoint())
return true;
+ BinaryOperator *BO = dyn_cast<BinaryOperator>(Builder.GetInsertPoint());
Rem = BO;
}
@@ -456,11 +458,13 @@
Div->dropAllReferences();
Div->eraseFromParent();
- // If we didn't actually generate a udiv instruction, we're done
- BinaryOperator *BO = dyn_cast<BinaryOperator>(Builder.GetInsertPoint());
- if (!BO || BO->getOpcode() != Instruction::UDiv)
+ // If we didn't actually generate an udiv instruction, we're done
+ // This happens for example if the input were constant. In this case the
+ // Builder insertion point was unchanged
+ if (Div == Builder.GetInsertPoint())
return true;
+ BinaryOperator *BO = dyn_cast<BinaryOperator>(Builder.GetInsertPoint());
Div = BO;
}