[CodeGen] Fix new-delete-type-mismatch in ~CodeGenTypes()

[m1kit]

It is undefined behavior to use delete expression on something which was not created with corresponding new expression. Switching to explicit global operator delete() call to match with operator new() call at CGFunctionInfo::create().

This issue is raised by Chromium ClusterFuzz, with ASan enabled. https://crbug.com/410141973

[github-actions]

Thank you for submitting a Pull Request (PR) to the LLVM Project!

This PR will be automatically labeled and the relevant teams will be notified.

If you wish to, you can add reviewers by using the "Reviewers" section on this page.

If this is not working for you, it is probably because you do not have write permissions for the repository. In which case you can instead tag reviewers by name in a comment by using @ followed by their GitHub username.

If you have received no comments on your PR for a week, you can request a review by "ping"ing the PR by adding a comment “Ping”. The common courtesy "ping" rate is once a week. Please remember that you are asking for valuable time from other developers.

If you have further questions, they may be answered by the LLVM GitHub User Guide.

You can also ask questions in a comment on this PR, on the LLVM Discord or on the forums.

[llvmbot]

@llvm/pr-subscribers-clang

Author: mikit (m1kit)

Changes

It is undefined behavior to use delete expression on something which was not created with corresponding new expression. Switching to explicit global operator delete() call to match with operator new() call at CGFunctionInfo::create().

This issue is raised by Chromium ClusterFuzz, with ASan enabled. https://crbug.com/410141973

---

Full diff: https://github.com/llvm/llvm-project/pull/135787.diff

1 Files Affected:

• (modified) clang/lib/CodeGen/CodeGenTypes.cpp (+1-1)

diff --git a/clang/lib/CodeGen/CodeGenTypes.cpp b/clang/lib/CodeGen/CodeGenTypes.cpp
index b94c11802a268..dec3b087b107f 100644
--- a/clang/lib/CodeGen/CodeGenTypes.cpp
+++ b/clang/lib/CodeGen/CodeGenTypes.cpp
@@ -41,7 +41,7 @@ CodeGenTypes::CodeGenTypes(CodeGenModule &cgm)
 CodeGenTypes::~CodeGenTypes() {
   for (llvm::FoldingSet<CGFunctionInfo>::iterator
        I = FunctionInfos.begin(), E = FunctionInfos.end(); I != E; )
-    delete &*I++;
+    operator delete(&*I++);
 }
 
 CGCXXABI &CodeGenTypes::getCXXABI() const { return getCGM().getCXXABI(); }

[llvmbot]

@llvm/pr-subscribers-clang-codegen

Author: mikit (m1kit)

Changes

It is undefined behavior to use delete expression on something which was not created with corresponding new expression. Switching to explicit global operator delete() call to match with operator new() call at CGFunctionInfo::create().

This issue is raised by Chromium ClusterFuzz, with ASan enabled. https://crbug.com/410141973

---

Full diff: https://github.com/llvm/llvm-project/pull/135787.diff

1 Files Affected:

• (modified) clang/lib/CodeGen/CodeGenTypes.cpp (+1-1)

diff --git a/clang/lib/CodeGen/CodeGenTypes.cpp b/clang/lib/CodeGen/CodeGenTypes.cpp
index b94c11802a268..dec3b087b107f 100644
--- a/clang/lib/CodeGen/CodeGenTypes.cpp
+++ b/clang/lib/CodeGen/CodeGenTypes.cpp
@@ -41,7 +41,7 @@ CodeGenTypes::CodeGenTypes(CodeGenModule &cgm)
 CodeGenTypes::~CodeGenTypes() {
   for (llvm::FoldingSet<CGFunctionInfo>::iterator
        I = FunctionInfos.begin(), E = FunctionInfos.end(); I != E; )
-    delete &*I++;
+    operator delete(&*I++);
 }
 
 CGCXXABI &CodeGenTypes::getCXXABI() const { return getCGM().getCXXABI(); }

[github-actions]

⚠️ We detected that you are using a GitHub private e-mail address to contribute to the repo.
Please turn off Keep my email addresses private setting in your account.
See LLVM Discourse for more information.

[efriedma-quic]

Do you need to invoke the destructor?

[github-actions]

⚠️ C/C++ code formatter, clang-format found issues in your code. ⚠️

You can test this locally with the following command:

git-clang-format --diff HEAD~1 HEAD --extensions cpp -- clang/lib/CodeGen/CodeGenTypes.cpp

View the diff from clang-format here.

diff --git a/clang/lib/CodeGen/CodeGenTypes.cpp b/clang/lib/CodeGen/CodeGenTypes.cpp
index 3600203fe..80997580b 100644
--- a/clang/lib/CodeGen/CodeGenTypes.cpp
+++ b/clang/lib/CodeGen/CodeGenTypes.cpp
@@ -39,8 +39,9 @@ CodeGenTypes::CodeGenTypes(CodeGenModule &cgm)
 }
 
 CodeGenTypes::~CodeGenTypes() {
-  for (llvm::FoldingSet<CGFunctionInfo>::iterator
-       I = FunctionInfos.begin(), E = FunctionInfos.end(); I != E; ) {
+  for (llvm::FoldingSet<CGFunctionInfo>::iterator I = FunctionInfos.begin(),
+                                                  E = FunctionInfos.end();
+       I != E;) {
     I->~CGFunctionInfo();
     operator delete(&*I++);
   }

[efriedma-quic]

Please also make the unused "operator delete" in CGFunctionInfo.h deleted, since it shouldn't have any callers.

I think this never actually led to a real issue because of that operator delete... it calls the right deallocation function even if it's technically undefined. So the only way to spot an issue would be a sanitizer that specifically checks for this. But I'm happy to fix this anyway.

[amaiorano]

Please also make the unused "operator delete" in CGFunctionInfo.h deleted, since it shouldn't have any callers.

I think this never actually led to a real issue because of that operator delete... it calls the right deallocation function even if it's technically undefined. So the only way to spot an issue would be a sanitizer that specifically checks for this. But I'm happy to "fix" this anyway.

Just to clarify, this was caught in an ASAN build of DXC, which is a fork of Clang. This may be reproducible with Clang by compiling with -fsized-deallocation.