https://github.com/rjodinchr updated https://github.com/llvm/llvm-project/pull/238330
>From 2dc982b6b1df298cbb6174d946fbaa92777ac596 Mon Sep 17 00:00:00 2001 From: Romaric Jodin <[email protected]> Date: Tue, 3 Nov 2026 11:53:13 +0100 Subject: [PATCH] [Analysis] Avoid typed Allocate<T> before new in ConstructionContext ConstructionContext::create<T> allocated storage for ConstructionContext subclasses via C.getAllocator().Allocate<T>() before constructing the T instance with placement new. AllocatorBase::Allocate<T> casts the newly allocated raw void * buffer to T * via static_cast<T *>. Because ConstructionContext is a polymorphic class hierarchy, building with Control Flow Integrity (-fsanitize=cfi-unrelated-cast) instruments static_cast<T *> to check the vtable pointer in the uninitialized BumpPtrAllocator memory before placement new has run the constructor, trapping at runtime. Allocate raw storage with C.getAllocator().Allocate(sizeof(T), alignof(T)) and pass the void * buffer directly to placement new so the typed T * pointer is produced only after construction. --- clang/include/clang/Analysis/ConstructionContext.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/clang/include/clang/Analysis/ConstructionContext.h b/clang/include/clang/Analysis/ConstructionContext.h index e19a2050009590..6794737317400f 100644 --- a/clang/include/clang/Analysis/ConstructionContext.h +++ b/clang/include/clang/Analysis/ConstructionContext.h @@ -275,7 +275,7 @@ class ConstructionContext { // A helper function for constructing an instance into a bump vector context. template <typename T, typename... ArgTypes> static T *create(BumpVectorContext &C, ArgTypes... Args) { - auto *CC = C.getAllocator().Allocate<T>(); + void *CC = C.getAllocator().Allocate(sizeof(T), alignof(T)); return new (CC) T(Args...); } _______________________________________________ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
