search

JuliaLang / julia

The Julia Programming Language
https://julialang.org/
MIT License
45.72k stars 5.48k forks source link

Alloc opt creates invalid GC pointer #55305

Open wsmoses opened 3 months ago

wsmoses commented 3 months ago

Input test case is https://godbolt.org/z/77f9K43bj

  %17 = call noalias nonnull dereferenceable(352) dereferenceable_or_null(352) {} addrspace(10)* @julia.gc_alloc_obj({}** nonnull %16, i64 noundef 352, {} addrspace(10)* noundef addrspacecast ({}* inttoptr (i64 131902303301776 to {}*) to {} addrspace(10)*)), !dbg !412
  %18 = bitcast {} addrspace(10)* %17 to { i8*, i8*, { {} addrspace(10)*, {} addrspace(10)*, i8*, i8*, i64 }, {} addrspace(10)*, {} addrspace(10)*, {} addrspace(10)*, {} addrspace(10)*, {} addrspace(10)*, {} addrspace(10)*, {} addrspace(10)*, {} addrspace(10)*, {} addrspace(10)*, {} addrspace(10)*, {} addrspace(10)*, {} addrspace(10)*, {} addrspace(10)*, {} addrspace(10)*, i64 } addrspace(10)*, !dbg !412

This object is optimized by Julia into part of the [X x {} addrspace(10)] on the stack. This is invalid because the i8's [and i64] are not necessarily valid julia objects. This results in garbage collection reading that memory and crashing.

cc @gbaraldi @vtjnash @vchuravy

wsmoses commented 3 months ago

https://godbolt.org/z/1ooc6bGT7