commit 8a8fdd875512c782d5be447234811aaf5b48fcd0
author Andrew Trick <atrick@apple.com> Wed Oct 18 22:31:28 2017 -0700
committer Andrew Trick <atrick@apple.com> Thu Oct 19 00:33:17 2017 -0700
tree a8fb35e25b43b83df98ce1e61bd253f2f8e2c533
parent 379afbdc37c1c8eb1aaf3dfc17661d3196aec662

Fix a use-after-free in MandatoryInlining.

Bug introduced in @noescape lowering: https://github.com/apple/swift/pull/12420

Fixes <rdar://problem/35055251> FAILED: ASAN use-after-free in MandatoryInlining.

lib/SILOptimizer/Mandatory/MandatoryInlining.cpp

diff --git a/lib/SILOptimizer/Mandatory/MandatoryInlining.cpp b/lib/SILOptimizer/Mandatory/MandatoryInlining.cpp
index c346b15..3472d9a 100644
--- a/lib/SILOptimizer/Mandatory/MandatoryInlining.cpp
+++ b/lib/SILOptimizer/Mandatory/MandatoryInlining.cpp
@@ -182,6 +182,10 @@
   }
 
   SILValue CalleeSource = CalleeValue;
+  // Handle partial_apply/thin_to_thick -> convert_function:
+  // tryDeleteDeadClosure must run before deleting a ConvertFunction that
+  // uses the PartialApplyInst or ThinToThickFunctionInst. tryDeleteDeadClosure
+  // will delete any uses of the closure, including this ConvertFunction.
   if (auto *CFI = dyn_cast<ConvertFunctionInst>(CalleeValue))
     CalleeSource = CFI->getOperand();
 
@@ -190,15 +194,15 @@
     if (!tryDeleteDeadClosure(PAI))
       return;
     CalleeValue = Callee;
-  }
 
-  if (auto *TTTFI = dyn_cast<ThinToThickFunctionInst>(CalleeSource)) {
+  } else if (auto *TTTFI = dyn_cast<ThinToThickFunctionInst>(CalleeSource)) {
     SILValue Callee = TTTFI->getCallee();
     if (!tryDeleteDeadClosure(TTTFI))
       return;
     CalleeValue = Callee;
   }
 
+  // Handle function_ref -> convert_function -> partial_apply/thin_to_thick.
   if (auto *CFI = dyn_cast<ConvertFunctionInst>(CalleeValue)) {
     if (isInstructionTriviallyDead(CFI)) {
       recursivelyDeleteTriviallyDeadInstructions(CFI, true);