re PR target/84272 (AddressSanitizer: heap-use-after-free ../../gcc/config/aarch64...

	PR target/84272
	* config/aarch64/cortex-a57-fma-steering.c (fma_forest::merge_forest):
	Use ++iter rather than iter++ for std::list iterators.
	(func_fma_steering::dfs): Likewise.  Don't delete nodes right away,
	defer deleting them until all nodes in the forest are processed.  Do
	free even leaf nodes.  Change to_process into auto_vec.

	* g++.dg/opt/pr84272.C: New test.

From-SVN: r257727

diff --git a/gcc/ChangeLog b/gcc/ChangeLog
index 85c7880e237064cad571f23b0c6a3c7e133256b8..67e207385eea700176d842090aad3047b0a5c1f3 100644 (file)
--- a/gcc/ChangeLog
+++ b/gcc/ChangeLog
@@ -1,5 +1,12 @@
 2018-02-16  Jakub Jelinek  <jakub@redhat.com>
 
+       PR target/84272
+       * config/aarch64/cortex-a57-fma-steering.c (fma_forest::merge_forest):
+       Use ++iter rather than iter++ for std::list iterators.
+       (func_fma_steering::dfs): Likewise.  Don't delete nodes right away,
+       defer deleting them until all nodes in the forest are processed.  Do
+       free even leaf nodes.  Change to_process into auto_vec.
+
        PR bootstrap/84405
        * system.h (BROKEN_VALUE_INITIALIZATION): Define for GCC < 4.3.
        * vec.h (vec_default_construct): Use memset instead of placement new

diff --git a/gcc/config/aarch64/cortex-a57-fma-steering.c b/gcc/config/aarch64/cortex-a57-fma-steering.c
index 92e3d045996e8ec6bc5ab92575e9cf1eba1bcb37..50e5108aa59f63b465a91451ce0decb0028fd8ab 100644 (file)
--- a/gcc/config/aarch64/cortex-a57-fma-steering.c
+++ b/gcc/config/aarch64/cortex-a57-fma-steering.c
@@ -406,7 +406,7 @@ fma_forest::merge_forest (fma_forest *other_forest)
 
   /* Update root nodes' pointer to forest.  */
   for (other_root_iter = other_roots->begin ();
-       other_root_iter != other_roots->end (); other_root_iter++)
+       other_root_iter != other_roots->end (); ++other_root_iter)
     (*other_root_iter)->set_forest (this);
 
   /* Remove other_forest from the list of forests and move its tree roots in
@@ -847,14 +847,13 @@ func_fma_steering::dfs (void (*process_forest) (fma_forest *),
                        void (*process_node) (fma_forest *, fma_node *),
                        bool free)
 {
-  vec<fma_node *> to_process;
+  auto_vec<fma_node *> to_process;
+  auto_vec<fma_node *> to_free;
   std::list<fma_forest *>::iterator forest_iter;
 
-  to_process.create (0);
-
   /* For each forest.  */
   for (forest_iter = this->m_fma_forests.begin ();
-       forest_iter != this->m_fma_forests.end (); forest_iter++)
+       forest_iter != this->m_fma_forests.end (); ++forest_iter)
     {
       std::list<fma_root_node *>::iterator root_iter;
 
@@ -863,7 +862,7 @@ func_fma_steering::dfs (void (*process_forest) (fma_forest *),
 
       /* For each tree root in this forest.  */
       for (root_iter = (*forest_iter)->get_roots ()->begin ();
-          root_iter != (*forest_iter)->get_roots ()->end (); root_iter++)
+          root_iter != (*forest_iter)->get_roots ()->end (); ++root_iter)
        {
          if (process_root)
            process_root (*forest_iter, *root_iter);
@@ -881,28 +880,30 @@ func_fma_steering::dfs (void (*process_forest) (fma_forest *),
          if (process_node)
            process_node (*forest_iter, node);
 
-         /* Absence of children might indicate an alternate root of a *chain*.
-            It's ok to skip it here as the chain will be renamed when
-            processing the canonical root for that chain.  */
-         if (node->get_children ()->empty ())
-           continue;
-
          for (child_iter = node->get_children ()->begin ();
-              child_iter != node->get_children ()->end (); child_iter++)
+              child_iter != node->get_children ()->end (); ++child_iter)
            to_process.safe_push (*child_iter);
+
+         /* Defer freeing so that the process_node callback can access the
+            parent and children of the node being processed.  */
          if (free)
+           to_free.safe_push (node);
+       }
+
+      if (free)
+       {
+         delete *forest_iter;
+
+         while (!to_free.is_empty ())
            {
+             fma_node *node = to_free.pop ();
              if (node->root_p ())
                delete static_cast<fma_root_node *> (node);
              else
                delete node;
            }
        }
-      if (free)
-       delete *forest_iter;
     }
-
-  to_process.release ();
 }
 
 /* Build the dependency trees of FMUL and FMADD/FMSUB instructions.  */

diff --git a/gcc/testsuite/ChangeLog b/gcc/testsuite/ChangeLog
index 64d0308ff01fc95f3381d2b25539baff7a355c30..2ead408c90a6e632c1c7e1b9902540d5186703f9 100644 (file)
--- a/gcc/testsuite/ChangeLog
+++ b/gcc/testsuite/ChangeLog
@@ -1,5 +1,8 @@
 2018-02-16  Jakub Jelinek  <jakub@redhat.com>
 
+       PR target/84272
+       * g++.dg/opt/pr84272.C: New test.
+
        PR rtl-optimization/83723
        * gcc.dg/pr83723.c: New test.
 

diff --git a/gcc/testsuite/g++.dg/opt/pr84272.C b/gcc/testsuite/g++.dg/opt/pr84272.C
new file mode 100644 (file)
index 0000000..ad4b8a2
--- /dev/null
+++ b/gcc/testsuite/g++.dg/opt/pr84272.C
@@ -0,0 +1,23 @@
+// PR target/84272
+// { dg-do compile }
+// { dg-options "-O2" }
+// { dg-additional-options "-march=armv8-a -mtune=cortex-a57" { target aarch64-*-* } }
+
+struct A
+{
+  float b, c;
+  A ();
+  A (float, float, float);
+  float operator * (A)
+  {
+    float d = b * b + c * c;
+    return d;
+  }
+};
+
+void
+foo ()
+{
+  A g[1];
+  A h (0, 0, h * g[2]);
+}