Commit ac0e966
committed
SILGen: Fix potential use-after-free in
The SIL verifier has identified an issue with the SIL generated for property accessors structured like this:
```
public struct S {
@available(macOS, introduced: 12.0)
@_backDeploy(before: macOS 13.0)
public var x: String {
_read {
yield "x"
}
}
}
```
The emitted SIL is invalid because the value `%9` is used after `end_apply` may have ended the lifetime of the value:
```
bb1:
%8 = function_ref @$s4test1SV1xSSvrTwB : $@yield_once @convention(method) (S) -> @yields @guaranteed String9
(%9, %10) = begin_apply %8(%0) : $@yield_once @convention(method) (S) -> @yields @guaranteed String
end_apply %10
yield %9 : $String, resume bb3, unwind bb2
```
The fix is to move the `end_apply` to the resume and unwind blocks, after the value has been yielded to the caller.
Resolves rdar://96879247@_backDeploy coroutines.1 parent d6e5805 commit ac0e966
File tree
2 files changed
+6
-3
lines changed- lib/SILGen
- test/SILGen
2 files changed
+6
-3
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
108 | 108 | | |
109 | 109 | | |
110 | 110 | | |
111 | | - | |
112 | 111 | | |
113 | 112 | | |
114 | 113 | | |
115 | 114 | | |
| 115 | + | |
116 | 116 | | |
117 | 117 | | |
118 | 118 | | |
119 | 119 | | |
| 120 | + | |
120 | 121 | | |
121 | 122 | | |
122 | 123 | | |
| |||
Lines changed: 4 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
32 | 32 | | |
33 | 33 | | |
34 | 34 | | |
35 | | - | |
36 | 35 | | |
37 | 36 | | |
38 | 37 | | |
| 38 | + | |
39 | 39 | | |
40 | 40 | | |
41 | 41 | | |
| 42 | + | |
42 | 43 | | |
43 | 44 | | |
44 | 45 | | |
45 | 46 | | |
46 | 47 | | |
47 | | - | |
48 | 48 | | |
49 | 49 | | |
50 | 50 | | |
| 51 | + | |
51 | 52 | | |
52 | 53 | | |
53 | 54 | | |
| 55 | + | |
54 | 56 | | |
55 | 57 | | |
56 | 58 | | |
| |||
0 commit comments