[IR] Don't fold all-ones `bitcast` to pointers
`FoldBitCast` folded any all-ones value to `getAllOnesValue(DestTy)`.
That asserts for pointers, which `bitcast bN to ptr` can now produce.
There is no pointer constant for an address without provenance, so keep
the cast.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply at anthropic.com>
polkit: update to 128.
All pkgsrc patches were merged upstream.
## polkit 128
### Highlights:
- fix two authentication-helper input vulnerabilities (CVE-2026-4897 and CVE-2026-85498) [7e122c8, eea1729]
- sanitize values written to syslog from authorization requests [9dca831]
- fix a use-after-free in the authentication agent's session handling [6f3cec7]
- revalidate the administrator behind cached `auth_admin_keep` authorizations [9a49bd6]
- fix agent cleanup races, resource leaks, and several error-path leaks [148422b, 4e67dde, 8ceeed8, ac4d9ac, dae50d6]
- support systemd watchdog notifications and locked system accounts with systemd 257+ [b3492d5, 13276c1]
- improve FreeBSD and Solaris portability, including tests without Linux user namespaces [c3aefa7, 3111583, 72c2878, 0453c24]
- add Kazakh, Serbian, and Serbian Latin translations; update Slovenian [6fe59cd, 8a797e5, 0d87075]
- add a polkit-agent-helper manual page and expand contributor documentation [5195b3a, 3ee2927, 935f9cd, 46df56e, d3ba690]
- remove the systemd service memory limits introduced in polkit 127 [44365bb]
jjui: update to 0.10.12.
Mostly a bugfix release, with fixes for the bookmark pane and view
layering, live theme reloading, and groundwork for context-aware
key bindings.
hiredis: update to 1.5.0.
Breaking Changes
Add optional TLS peer certificate name verification @hristostaykov-del (#1355)
Bug Fixes
Fix use after free in redisMacOSAttach on CF failure @Hashim1999164 (#1368)
Drain Linux socket error queue after nonblocking TCP connect @swills (#1375)
Guard Windows wincert check when cacert_filename is NULL @Hashim1999164 (#1370)
Add a maxdepth redisReader configuration member. @michael-grunder (#1335)
Protect against overflow of map elements @michael-grunder (#1323)
Maintenance
Fix Release Drafter release naming and draft isolation @uglide (#1385)
Remove spellcheck CI and modernise Release Drafter config @uglide (#1384)
[10 lines not shown]
gopls: update to 0.24.0.
This release includes a number of improvements to support for Go
assembly files, including Hover, DocumentHighlight, References,
and “zero configuration” (automatic selection of appropriate build
tags).
[SLP][modularisation][NFC] Move loop trip-count helpers to SLPUtils (#222614)
Move the BoUpSLP-independent helpers findInnermostNonInvariantLoop and
getLoopTripCount out of SLPVectorizer.cpp into the self-contained
SLPVectorizer/SLPUtils.{h,cpp} module. getLoopTripCount reads the
file-local
LoopAwareTripCount cl::opt, which stays static in SLPVectorizer.cpp and
is
passed to the moved helper as an explicit parameter. NFC.
Part of the SLPVectorizer.cpp modularization effort:
https://discourse.llvm.org/t/modularizing-slpvectorizer-cpp/90922
chromaprint: update to 1.6.2.
Switch to ffmpeg9.
Version 1.6.2 -- October 15, 2026
=================================
- Fixed a crash in fpcalc when the channel layout changes mid-stream
(e.g. AC-3 files switching between 5.1 and stereo)
- Fixed decoding of audio with more than 8 planar channels in fpcalc
- Fingerprint decoding now rejects invalid input that previously caused
undefined behaviour (shifting past 32 bits)
- The C API encoding/decoding functions now return an error for a negative
size, a NULL buffer with a nonzero size, and, when encoding, more items
than the fingerprint header can hold (previously silently truncated)
[ELF] Move layout-changing transforms before address assignment (#232189)
finalizeAddressDependentContent assigns addresses, then
--randomize-section-padding and CFI jump table relaxation
(--branch-to-branch, implied by -O2) move input sections, so the first
fixed-point iteration computes address-dependent content from stale
addresses. Since #179089, EhFrameHeader::updateAllocSize caches the
.eh_frame_hdr search table; if no iteration changes anything, the loop
exits and the table keys no longer match the FDEs' initial_location.
Neither transform reads addresses, so run them before the first
assignAddresses. SHF_LINK_ORDER sections are now sorted by the relaxed
layout as well.
LLM-aided. Partially fix #226166
(cherry picked from commit 115554f90f920fc000234c2c247b8318d4e7d2d8)
[PowerPC] Don't let optimizeCompareInstr define CR0 while it is still live (#220999)
This replaces the compare-against-zero in
`PPCInstrInfo::optimizeCompareInstr` with the record form of the
instruction defining the compared register only when CR0 is dead at that
point, checked with `MachineBasicBlock::computeRegisterLiveness`
scanning to the end of the block.
Fixes #220996.
## Why
The conversion makes `MI` define CR0. CR0 can still be live there: the
`ANDI_rec_1_{EQ,GT}_BIT` pseudo expansion emits `ANDI_rec` followed by
COPYs of `$cr0eq`/`$cr0gt`, and nothing keeps those copies adjacent to
their `andi.` once other instructions are scheduled in between. A later
compare candidate sitting between an `andi.` and one of its copies gets
converted, clobbers CR0, and the copy then reads the wrong value — the
two flag tests swap conditions.
[43 lines not shown]
[Clang][counted_by] Load the count through unions by byte offset (#228309)
`getGEPIndicesToField()` indexed into a union with 0 and kept walking the
counter's struct field numbers, but the union's IR type is its largest
member, so the count was loaded from inside that member instead.
In Linux, `landlock_domain` hits this and FORTIFY panics on every nested
`landlock_restrict_self()` on kernel 7.3.0-rc5-next as of this writing.
I ran into this bug when trying to daily drive the aforementioned
kernel.
Below is a reduced version of `landlock_domain`. The `work` member
stands in for the kernel's `struct work_struct`, which is larger than the
anonymous struct holding the count, so it becomes the union's IR type.
```c
struct dom {
void *rules[3];
[21 lines not shown]
[clang] Treat pack-index-specifiers as non-deduced contexts (#232883)
Per C++26 [temp.deduct.type]p5.2, a pack-index-specifier is a
non-deduced context. Deduction against an unresolved PackIndexingType
used to fail with a bare IncompletePack result that carried no
parameter/argument info, so matching an explicit instantiation, explicit
specialization, or address-of against such a function template was
rejected, and emitting the resulting diagnostic crashed in
DiagnoseBadDeduction (assertion "no parameter found for incomplete
deduction result" in +asserts builds, null dereference otherwise).
A pack-index-specifier whose pack and index are fully substituted
canonicalizes to its selected type, so the PackIndexing case in
DeduceTemplateArgumentsByTypeMatch only ever sees unresolved ones;
returning Success there (deducing nothing) is all that is needed.
Fixes #232220
