Fix almost-unreachable use-after-free.

davidchisnall · davidchisnall · commit e3e1e5ee529d · 2026-04-17T15:29:20.000+01:00
diff --git a/eh_personality.c b/eh_personality.c
@@ -735,10 +735,11 @@ OBJC_PUBLIC void objc_exception_rethrow(struct _Unwind_Exception *e)
 		// rethrown exception in objc_end_catch
 		ex->catch_count = -ex->catch_count;
 		_Unwind_Reason_Code err = _Unwind_Resume_or_Rethrow(e);
+		id object = ex->object;
 		free(ex);
 		if (_URC_END_OF_STACK == err && 0 != _objc_unexpected_exception)
 		{
-			_objc_unexpected_exception(ex->object);
+			_objc_unexpected_exception(object);
 		}
 		abort();
 	}

Original file line number	Diff line number	Diff line change
`@@ -735,10 +735,11 @@ OBJC_PUBLIC void objc_exception_rethrow(struct _Unwind_Exception *e)`
`735`	`735`	`// rethrown exception in objc_end_catch`
`736`	`736`	`ex->catch_count = -ex->catch_count;`
`737`	`737`	`_Unwind_Reason_Code err = _Unwind_Resume_or_Rethrow(e);`
	`738`	`+ id object = ex->object;`
`738`	`739`	`free(ex);`
`739`	`740`	`if (_URC_END_OF_STACK == err && 0 != _objc_unexpected_exception)`
`740`	`741`	`{`
`741`		`- _objc_unexpected_exception(ex->object);`
	`742`	`+ _objc_unexpected_exception(object);`
`742`	`743`	`}`
`743`	`744`	`abort();`
`744`	`745`	`}`