Skip to content

Disable concurrent compilation to prevent dangling Module pointers#565

Open
0xeb wants to merge 1 commit intoroot-project:masterfrom
lallouslab:fix/disable-concurrent-compilation
Open

Disable concurrent compilation to prevent dangling Module pointers#565
0xeb wants to merge 1 commit intoroot-project:masterfrom
lallouslab:fix/disable-concurrent-compilation

Conversation

@0xeb
Copy link

@0xeb 0xeb commented Mar 23, 2026

Summary

Cling uses a single LLVMContext (SingleThreadedContext) and keeps raw pointers to Modules (Transaction::m_CompiledModule) for later unloading via TransactionUnloader::unloadModule. When concurrent compilation is enabled, LLJIT sets CloneToNewContextOnEmit which clones each Module into a fresh context during materialization, destroying the original. That turns m_CompiledModule into a dangling pointer and crashes in RevertTransaction (use-after-free in the Module's function list).

Fix: Call Builder.setSupportConcurrentCompilation(false) in the IncrementalJIT constructor.

Test plan

  • Without this fix, undo() / RevertTransaction crashes with use-after-free
  • With the fix, 34/34 tests pass including undo/rollback tests
  • Tested on ARM64 Linux and Windows x64
Cling uses a single LLVMContext (SingleThreadedContext) and keeps raw pointers to Modules (Transaction::m_CompiledModule) for later unloading via TransactionUnloader::unloadModule. When concurrent compilation is enabled, LLJIT sets CloneToNewContextOnEmit which clones each Module into a fresh context during materialization, destroying the original. That turns m_CompiledModule into a dangling pointer and crashes in RevertTransaction (use-after-free in the Module's function list). Fix: call Builder.setSupportConcurrentCompilation(false) in the IncrementalJIT constructor.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

1 participant