# 22902339 memory corruption caused by undefined behavior in LLVM IR Module

# Miscellaneous cleanup fixes.

# Replace SmallVectorImpl | SmallVector with std::vector.

# 3.9.X upstream.

--- include/llvm/Analysis/BlockFrequencyInfoImpl.h 2015-12-18 12:53:24.000000000 -0900

+++ include/llvm/Analysis/BlockFrequencyInfoImpl.h 2016-07-07 10:08:31.067332185 -0800

@@ -249,7 +249,9 @@

LoopData *Loop; ///< The loop this block is inside.

BlockMass Mass; ///< Mass distribution from the entry block.

- WorkingData(const BlockNode &Node) : Node(Node), Loop(nullptr) {}

+ WorkingData() : Node(), Loop(nullptr), Mass() { }

+ WorkingData(const BlockNode &Node) : Node(Node), Loop(nullptr), Mass() { }

+ ~WorkingData() { }

bool isLoopHeader() const { return Loop && Loop->isHeader(Node); }

bool isDoubleLoopHeader() const {

@@ -332,9 +334,10 @@

DistType Type;

BlockNode TargetNode;

uint64_t Amount;

- Weight() : Type(Local), Amount(0) {}

+ Weight() : Type(Local), TargetNode(), Amount(0ULL) { }

Weight(DistType Type, BlockNode TargetNode, uint64_t Amount)

- : Type(Type), TargetNode(TargetNode), Amount(Amount) {}

+ : Type(Type), TargetNode(TargetNode), Amount(Amount) { }

+ ~Weight() { }

};

/// \brief Distribution of unscaled probability weight.

@@ -985,7 +988,9 @@

template <class BT> void BlockFrequencyInfoImpl<BT>::initializeRPOT() {

const BlockT *Entry = &F->front();

- RPOT.reserve(F->size());

+ if (F->size())

+ RPOT.reserve(F->size());

+

std::copy(po_begin(Entry), po_end(Entry), std::back_inserter(RPOT));

std::reverse(RPOT.begin(), RPOT.end());

@@ -999,7 +1004,9 @@

Nodes[*I] = Node;

}

- Working.reserve(RPOT.size());

+ if (RPOT.size())

+ Working.reserve(RPOT.size());

+

for (size_t Index = 0; Index < RPOT.size(); ++Index)

Working.emplace_back(Index);

Freqs.resize(RPOT.size());

###

--- lib/Analysis/LazyCallGraph.cpp 2015-12-27 20:54:20.000000000 -0500

+++ lib/Analysis/LazyCallGraph.cpp 2016-05-28 13:36:41.670887743 -0400

@@ -234,7 +234,7 @@

ConnectedSCCs.insert(&CallerC);

// We build up a DFS stack of the parents chains.

- SmallVector<std::pair<SCC *, SCC::parent_iterator>, 8> DFSSCCs;

+ std::vector<std::pair<SCC *, SCC::parent_iterator> > DFSSCCs;

SmallPtrSet<SCC *, 8> VisitedSCCs;

int ConnectedDepth = -1;

SCC *C = this;

@@ -265,7 +265,7 @@

// If we've found a connection anywhere below this point on the stack (and

// thus up the parent graph from the caller), the current node needs to be

// added to the connected set now that we've processed all of its parents.

- if ((int)DFSSCCs.size() == ConnectedDepth) {

+ if (static_cast<int>(DFSSCCs.size()) == ConnectedDepth) {

--ConnectedDepth; // We're finished with this connection.

ConnectedSCCs.insert(C);

} else {

@@ -279,8 +279,9 @@

break; // We've walked all the parents of the caller transitively.

// Pop off the prior node and position to unwind the depth first recursion.

- std::tie(C, I) = DFSSCCs.pop_back_val();

+ std::tie(C, I) = DFSSCCs.back();

E = C->parent_end();

+ DFSSCCs.pop_back();

}

// Now that we have identified all of the SCCs which need to be merged into

###

--- lib/Analysis/CFG.cpp 2015-11-20 15:02:06.000000000 -0800

+++ lib/Analysis/CFG.cpp 2016-05-24 19:44:24.894893025 -0700

@@ -19,6 +19,8 @@

using namespace llvm;

+#include <vector>

+

/// FindFunctionBackedges - Analyze the specified function to find all of the

/// loop backedges in the function and return them. This is a relatively cheap

/// (compared to computing dominators and loop info) analysis.

@@ -31,7 +33,7 @@

return;

SmallPtrSet<const BasicBlock*, 8> Visited;

- SmallVector<std::pair<const BasicBlock*, succ_const_iterator>, 8> VisitStack;

+ std::vector<std::pair<const BasicBlock*, succ_const_iterator> > VisitStack;

SmallPtrSet<const BasicBlock*, 8> InStack;

Visited.insert(BB);

@@ -60,7 +62,10 @@

VisitStack.push_back(std::make_pair(BB, succ_begin(BB)));

} else {

// Go up one level.

- InStack.erase(VisitStack.pop_back_val().first);

+ std::pair<const BasicBlock*, succ_const_iterator> &Back =

+ VisitStack.back();

+ InStack.erase(Back.first);

+ VisitStack.pop_back();

}

} while (!VisitStack.empty());

}