Annotate small_vector for MSan (for use-after-destruction detection)#12
Merged
azat merged 1 commit intoClickHouse:masterfrom Apr 29, 2021
Merged
Annotate small_vector for MSan (for use-after-destruction detection)#12azat merged 1 commit intoClickHouse:masterfrom
azat merged 1 commit intoClickHouse:masterfrom
Conversation
Simple reproducer [1]:
#include <boost/container/small_vector.hpp>
struct Foo
{
std::string i;
bool operator<(const Foo &rhs) const { return i < rhs.i; }
};
int main()
{
boost::container::small_vector<Foo, 10> vector;
vector.reserve(3);
for (size_t i = 0; i < 3; ++i)
vector.push_back(Foo{});
return 0;
}
And run it:
$ clang++ -O2 -g3 -fsanitize-memory-track-origins -fsanitize=memory test-msan-3.cpp -o test-msan-3; MSAN_OPTIONS='abort_on_error=1 poison_in_dtor=1' ./test-msan-3
==30125==WARNING: MemorySanitizer: use-of-uninitialized-value
0 0x5555555f606e in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_dispose() /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../include/c++/10.2.0/bits/basic_string.h:231:6
1 0x5555555f606e in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::~basic_string() /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../include/c++/10.2.0/bits/basic_string.h:658:9
2 0x5555555f606e in Foo::~Foo() /tmp/test-msan-3.cpp:3:8
3 0x5555555f606e in void boost::container::allocator_traits<boost::container::small_vector_allocator<Foo, boost::container::new_allocator<void>, void> >::priv_destroy<Foo>(boost::move_detail::integral_constant<bool, false>, boost::container::small_vector_allocator<Foo, boost::container::new_allocator<void>, void>&, Foo*) /usr/include/boost/container/allocator_traits.hpp:394:11
4 0x5555555f606e in void boost::container::allocator_traits<boost::container::small_vector_allocator<Foo, boost::container::new_allocator<void>, void> >::destroy<Foo>(boost::container::small_vector_allocator<Foo, boost::container::new_allocator<void>, void>&, Foo*) /usr/include/boost/container/allocator_traits.hpp:322:7
5 0x5555555f606e in boost::container::dtl::disable_if_trivially_destructible<Foo*, void>::type boost::container::destroy_alloc_n<boost::container::small_vector_allocator<Foo, boost::container::new_allocator<void>, void>, Foo*, unsigned long>(boost::container::small_vector_allocator<Foo, boost::container::new_allocator<void>, void>&, Foo*, unsigned long) /usr/include/boost/container/detail/copy_move_algo.hpp:987:7
6 0x5555555f606e in boost::container::vector<Foo, boost::container::small_vector_allocator<Foo, boost::container::new_allocator<void>, void>, void>::~vector() /usr/include/boost/container/vector.hpp:1098:7
7 0x5555555f5cf8 in boost::container::small_vector_base<Foo, void, void>::~small_vector_base() /usr/include/boost/container/small_vector.hpp:369:7
8 0x5555555f5cf8 in main /tmp/test-msan-3.cpp:16:1
9 0x7ffff7a8cb24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
10 0x5555555751dd in _start (/tmp/test-msan-3+0x211dd)
Memory was marked as uninitialized
0 0x5555555d110b in __sanitizer_dtor_callback (/tmp/test-msan-3+0x7d10b)
1 0x5555555f5cdc in boost::container::small_vector_base<Foo, void, void>::~small_vector_base() /usr/include/boost/container/small_vector.hpp:369:7
2 0x5555555f5cdc in main /tmp/test-msan-3.cpp:16:1
SUMMARY: MemorySanitizer: use-of-uninitialized-value /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../include/c++/10.2.0/bits/basic_string.h:231:6 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_dispose()
Exiting
Aborted (core dumped)
[1]: https://gist.github.com/azat/9a9560bfddef36f7701023cafb7a778e
Originally it was found in clickhouse hyperscan test
(01681_hyperscan_debug_assertion) [2].
[2]: https://gist.github.com/azat/020938e221d519717338f099606c39fb
Check boost version 1.70 (ch) and 1.75 (system).
Clang version 11.1.
Refs: https://lists.llvm.org/pipermail/llvm-commits/Week-of-Mon-20150831/297043.html
Refs: google/sanitizers#854
alexey-milovidov
approved these changes
Apr 29, 2021
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Simple reproducer 1:
And run it:
Originally it was found in clickhouse hyperscan test
(01681_hyperscan_debug_assertion) 2.
Check boost version 1.70 (ch) and 1.75 (system).
Clang version 11.1.
Refs: https://lists.llvm.org/pipermail/llvm-commits/Week-of-Mon-20150831/297043.html
Refs: google/sanitizers#854