release/20.x: [IR] Fix assertion error in User new/delete edge case (#129914)

[llvmbot]

Backport 8d38906

Requested by: @marcauberer

[llvmbot]

@llvm/pr-subscribers-llvm-ir

Author: None (llvmbot)

Changes

Backport 8d38906

Requested by: @marcauberer

---

Full diff: https://github.com/llvm/llvm-project/pull/130580.diff

1 Files Affected:

• (modified) llvm/lib/IR/User.cpp (+6)

diff --git a/llvm/lib/IR/User.cpp b/llvm/lib/IR/User.cpp
index b0aa785deb9af..ab44cb4b8a3f7 100644
--- a/llvm/lib/IR/User.cpp
+++ b/llvm/lib/IR/User.cpp
@@ -146,6 +146,9 @@ void *User::allocateFixedOperandUser(size_t Size, unsigned Us,
   Use *Start = reinterpret_cast<Use *>(Storage + DescBytesToAllocate);
   Use *End = Start + Us;
   User *Obj = reinterpret_cast<User *>(End);
+  Obj->NumUserOperands = Us;
+  Obj->HasHungOffUses = false;
+  Obj->HasDescriptor = DescBytes != 0;
   for (; Start != End; Start++)
     new (Start) Use(Obj);
 
@@ -172,6 +175,9 @@ void *User::operator new(size_t Size, HungOffOperandsAllocMarker) {
   void *Storage = ::operator new(Size + sizeof(Use *));
   Use **HungOffOperandList = static_cast<Use **>(Storage);
   User *Obj = reinterpret_cast<User *>(HungOffOperandList + 1);
+  Obj->NumUserOperands = 0;
+  Obj->HasHungOffUses = true;
+  Obj->HasDescriptor = false;
   *HungOffOperandList = nullptr;
   return Obj;
 }

[nikic]

I'm not sure this is the right fix. I left a comment on the original PR: #129914 (review)

[tstellar]

@nikic Should we close this?

[nikic]

I think this is okay to backport. We should do this properly on main, but this is probably the more conservative fix.

[github-actions]

@marcauberer (or anyone else). If you would like to add a note about this fix in the release notes (completely optional). Please reply to this comment with a one or two sentence description of the fix. When you are done, please add the release:note label to this PR.

[marcauberer]

@marcauberer (or anyone else). If you would like to add a note about this fix in the release notes (completely optional). Please reply to this comment with a one or two sentence description of the fix. When you are done, please add the release:note label to this PR.

This fixes some undefined behaviour when operator delete is called on User after an unsuccessful constructor call
after operator new.