LoopUnroll - use after free

[llvmbot]

Bugzilla Link	1947
Resolution	FIXED
Resolved on	Jan 27, 2008 12:35
Version	unspecified
OS	Linux
Reporter	LLVM Bugzilla Contributor
CC	@asl,@nlewycky

Extended Description

Valgrind shows memory being used after being freed in the testcase
test/Transforms/LoopUnroll/2007-11-05-Crash.ll:

Invalid read of size 4
at 0x82D551A: llvm::Use::getNext() const (Use.h:65)
by 0x82D62D7: llvm::value_use_iteratorllvm::User::operator++() (Use.h:130)
by 0x83ED7EA: (anonymous namespace)::LoopUnroll::unrollLoop(llvm::LoopBasellvm::BasicBlock, unsigned, unsigned) (LoopUnroll.cpp:367)
by 0x83EE2FD: (anonymous namespace)::LoopUnroll::runOnLoop(llvm::LoopBasellvm::BasicBlock, llvm::LPPassManager&) (LoopUnroll.cpp:182)
by 0x84B375C: llvm::LPPassManager::runOnFunction(llvm::Function&) (LoopPass.cpp:225)
by 0x857626F: llvm::FPPassManager::runOnFunction(llvm::Function&) (PassManager.cpp:1171)
by 0x8576411: llvm::FPPassManager::runOnModule(llvm::Module&) (PassManager.cpp:1191)
by 0x8575F45: llvm::MPPassManager::runOnModule(llvm::Module&) (PassManager.cpp:1240)
by 0x85760FD: llvm::PassManagerImpl::run(llvm::Module&) (PassManager.cpp:1313)
by 0x857614F: llvm::PassManager::run(llvm::Module&) (PassManager.cpp:1345)
by 0x82E2C74: main (opt.cpp:426)
Address 0x42e0db4 is 20 bytes inside a block of size 68 free'd
at 0x4021EFC: operator delete (vg_replace_malloc.c:364)
by 0x85572E1: llvm::PHINode::resizeOperands(unsigned) (Instructions.cpp:176)
by 0x831DA38: llvm::PHINode::addIncoming(llvm::Value*, llvm::BasicBlock*) (Instructions.h:1303)
by 0x83ED7DC: (anonymous namespace)::LoopUnroll::unrollLoop(llvm::LoopBasellvm::BasicBlock, unsigned, unsigned) (LoopUnroll.cpp:373)
by 0x83EE2FD: (anonymous namespace)::LoopUnroll::runOnLoop(llvm::LoopBasellvm::BasicBlock, llvm::LPPassManager&) (LoopUnroll.cpp:182)
by 0x84B375C: llvm::LPPassManager::runOnFunction(llvm::Function&) (LoopPass.cpp:225)
by 0x857626F: llvm::FPPassManager::runOnFunction(llvm::Function&) (PassManager.cpp:1171)
by 0x8576411: llvm::FPPassManager::runOnModule(llvm::Module&) (PassManager.cpp:1191)
by 0x8575F45: llvm::MPPassManager::runOnModule(llvm::Module&) (PassManager.cpp:1240)
by 0x85760FD: llvm::PassManagerImpl::run(llvm::Module&) (PassManager.cpp:1313)
by 0x857614F: llvm::PassManager::run(llvm::Module&) (PassManager.cpp:1345)
by 0x82E2C74: main (opt.cpp:426)

[nlewycky]

Fixed in r46417. Patch here:
http://lists.cs.uiuc.edu/pipermail/llvm-commits/Week-of-Mon-20080121/057623.html