Skip to content

Alloc opt creates invalid GC pointer #55305

@wsmoses

Description

@wsmoses
Contributor

Input test case is https://godbolt.org/z/77f9K43bj

  %17 = call noalias nonnull dereferenceable(352) dereferenceable_or_null(352) {} addrspace(10)* @julia.gc_alloc_obj({}** nonnull %16, i64 noundef 352, {} addrspace(10)* noundef addrspacecast ({}* inttoptr (i64 131902303301776 to {}*) to {} addrspace(10)*)), !dbg !412
  %18 = bitcast {} addrspace(10)* %17 to { i8*, i8*, { {} addrspace(10)*, {} addrspace(10)*, i8*, i8*, i64 }, {} addrspace(10)*, {} addrspace(10)*, {} addrspace(10)*, {} addrspace(10)*, {} addrspace(10)*, {} addrspace(10)*, {} addrspace(10)*, {} addrspace(10)*, {} addrspace(10)*, {} addrspace(10)*, {} addrspace(10)*, {} addrspace(10)*, {} addrspace(10)*, {} addrspace(10)*, i64 } addrspace(10)*, !dbg !412

This object is optimized by Julia into part of the [X x {} addrspace(10)] on the stack. This is invalid because the i8's [and i64] are not necessarily valid julia objects. This results in garbage collection reading that memory and crashing.

cc @gbaraldi @vtjnash @vchuravy

Metadata

Metadata

Assignees

No one assigned

    Labels

    GCGarbage collectorcompiler:optimizerOptimization passes (mostly in base/compiler/ssair/)

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

      Development

      No branches or pull requests

        Participants

        @wsmoses

        Issue actions

          Alloc opt creates invalid GC pointer · Issue #55305 · JuliaLang/julia