[qt/clang/llvm-project]: Summary of bulk changes made

Git repository change summary for qt/clang/llvm-project
Pushed by mirror-service into branch 'upstream/users/yuxuanchen1997/fix-coro-halo-suspend-never-bad-free'.
Changed from 055ab022b52c0813fb7c5aec22aafa1855507553 to f3528f86ab969030210998333741c0d6bbc2e902
Acknowledgement was received that this change introduces only existing code that has been pushed to another public open source repository.

This change contains the following new commits:

Git commit f3528f86ab969030210998333741c0d6bbc2e902 by Yuxuan Chen on 19/07/2026 at 06:24..
[Coroutines] Use destroy slot for CoroElide resume fallthrough

Fixes https://github.com/llvm/llvm-project/issues/188230

A switch coroutine with a CoroElide noalloc variant uses the frame destroy slot as a runtime discriminator: heap-allocated frames store the destroy clone, while allocation-elided frames store the cleanup clone. Its resume clone can reach a fallthrough coro.end after the final suspend.

The coroutine body can invoke a continuation before reaching that coro.end. A suspend_never continuation can complete and free its frame before control returns. When the callee frame was elided into that caller allocation, loading the destroy slot at coro.end reads freed storage, which AddressSanitizer reports as a use-after-free.

Load and cache the destroy function in the switch-resume entry block before executing the resume body, then tail-call the cached value at fallthrough coro.end. The cache retains the frame slot as the allocation discriminator without dereferencing an elided frame after the continuation returns.

Add a C++ CodeGen regression for the original suspend_never final-suspend shape and update CoroSplit tests to require the entry load.

Assisted-By: Codex GPT 5.5
https://invent.kde.org/qt/clang/llvm-project/-/commit/f3528f86ab969030210998333741c0d6bbc2e902