public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug analyzer/110433] New: ASAN reports mismatching new/delete when compiling analyzer testcases
@ 2023-06-27 9:56 jamborm at gcc dot gnu.org
2023-06-27 20:25 ` [Bug analyzer/110433] " dmalcolm at gcc dot gnu.org
` (4 more replies)
0 siblings, 5 replies; 6+ messages in thread
From: jamborm at gcc dot gnu.org @ 2023-06-27 9:56 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110433
Bug ID: 110433
Summary: ASAN reports mismatching new/delete when compiling
analyzer testcases
Product: gcc
Version: 14.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: jamborm at gcc dot gnu.org
CC: dmalcolm at gcc dot gnu.org
Blocks: 86656
Target Milestone: ---
Host: x86_64-linux
Target: x86_64-linux
With a bootstrapped compiler configured with
--with-build-config=bootstrap-asan I get errors about new/delete
mismatching types when compiling testcases:
- gcc.dg/analyzer/out-of-bounds-diagram-13.c
- gcc.dg/analyzer/out-of-bounds-diagram-15.c
- gcc.dg/analyzer/out-of-bounds-diagram-4.c
- gcc.dg/analyzer/out-of-bounds-diagram-5-ascii.c
- gcc.dg/analyzer/out-of-bounds-diagram-5-unicode.c and
- gcc.dg/analyzer/out-of-bounds-diagram-7.c
The errors all look like:
Executing on host: /home/worker/buildworker/tiber-gcc-asan/objdir/gcc/xgcc
-B/home/worker/buildworker/tiber-gcc-asan/objdir/gcc/
/home/worker/buildworker/tiber-gcc-asan/build/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-13.c
-fdiagnostics-plain-output -fanalyzer -Wanalyzer-too-complex
-fanalyzer-call-summaries -fdiagnostics-text-art-charset=unicode -S -o
out-of-bounds-diagram-13.s (timeout = 300)
spawn -ignore SIGHUP /home/worker/buildworker/tiber-gcc-asan/objdir/gcc/xgcc
-B/home/worker/buildworker/tiber-gcc-asan/objdir/gcc/
/home/worker/buildworker/tiber-gcc-asan/build/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-13.c
-fdiagnostics-plain-output -fanalyzer -Wanalyzer-too-complex
-fanalyzer-call-summaries -fdiagnostics-text-art-charset=unicode -S -o
out-of-bounds-diagram-13.s
/home/worker/buildworker/tiber-gcc-asan/build/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-13.c:
In function 'test_non_ascii':
/home/worker/buildworker/tiber-gcc-asan/build/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-13.c:9:3:
warning: stack-based buffer overflow [CWE-121] [-Wanalyzer-out-of-bounds]
/home/worker/buildworker/tiber-gcc-asan/build/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-13.c:8:8:
note: (1) capacity: 9 bytes
/home/worker/buildworker/tiber-gcc-asan/build/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-13.c:9:3:
note: (2) out-of-bounds write at byte 9 but 'buf' ends at byte 9
/home/worker/buildworker/tiber-gcc-asan/build/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-13.c:9:3:
note: write of 1 byte to beyond the end of 'buf'
/home/worker/buildworker/tiber-gcc-asan/build/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-13.c:9:3:
note: valid subscripts for 'buf' are '[0]' to '[8]'
=================================================================
==58507==ERROR: AddressSanitizer: new-delete-type-mismatch on 0x50d000000a00 in
thread T0:
object passed to delete has wrong type:
size of the allocated type: 136 bytes;
size of the deallocated type: 104 bytes.
#0 0x83eba8 in operator delete(void*, unsigned long)
/home/worker/buildworker/tiber-gcc-asan/build/libsanitizer/asan/asan_new_delete.cpp:164
#1 0x51e6e45 in
std::default_delete<ana::svalue_spatial_item>::operator()(ana::svalue_spatial_item*)
const
/home/worker/buildworker/tiber-gcc-asan/objdir/prev-x86_64-pc-linux-gnu/libstdc++-v3/include/bits/unique_ptr.h:99
#2 0x51e6e45 in std::unique_ptr<ana::svalue_spatial_item,
std::default_delete<ana::svalue_spatial_item> >::~unique_ptr()
/home/worker/buildworker/tiber-gcc-asan/objdir/prev-x86_64-pc-linux-gnu/libstdc++-v3/include/bits/unique_ptr.h:404
#3 0x51e6e45 in ana::access_diagram_impl::~access_diagram_impl()
/home/worker/buildworker/tiber-gcc-asan/build/gcc/analyzer/access-diagram.cc:1728
#4 0x51e703c in ana::access_diagram_impl::~access_diagram_impl()
/home/worker/buildworker/tiber-gcc-asan/build/gcc/analyzer/access-diagram.cc:1728
#5 0x4e97142 in
std::default_delete<text_art::widget>::operator()(text_art::widget*) const
/home/worker/buildworker/tiber-gcc-asan/objdir/prev-x86_64-pc-linux-gnu/libstdc++-v3/include/bits/unique_ptr.h:99
#6 0x4e97142 in std::unique_ptr<text_art::widget,
std::default_delete<text_art::widget> >::~unique_ptr()
/home/worker/buildworker/tiber-gcc-asan/objdir/prev-x86_64-pc-linux-gnu/libstdc++-v3/include/bits/unique_ptr.h:404
--
==58507==HINT: if you don't care about these errors you may set
ASAN_OPTIONS=new_delete_type_mismatch=0
==58507==ABORTING
compiler exited with status 1
PASS: gcc.dg/analyzer/out-of-bounds-diagram-13.c (test for warnings, line 9)
FAIL: gcc.dg/analyzer/out-of-bounds-diagram-13.c at line 10 (test for
warnings, line 9)
FAIL: gcc.dg/analyzer/out-of-bounds-diagram-13.c expected multiline pattern
lines 17-42
FAIL: gcc.dg/analyzer/out-of-bounds-diagram-13.c 2 blank line(s) in output
FAIL: gcc.dg/analyzer/out-of-bounds-diagram-13.c (test for excess errors)
Excess errors:
=================================================================
==58507==ERROR: AddressSanitizer: new-delete-type-mismatch on 0x50d000000a00 in
thread T0:
object passed to delete has wrong type:
size of the allocated type: 136 bytes;
size of the deallocated type: 104 bytes.
#0 0x83eba8 in operator delete(void*, unsigned long)
/home/worker/buildworker/tiber-gcc-asan/build/libsanitizer/asan/asan_new_delete.cpp:164
#1 0x51e6e45 in
std::default_delete<ana::svalue_spatial_item>::operator()(ana::svalue_spatial_item*)
const
/home/worker/buildworker/tiber-gcc-asan/objdir/prev-x86_64-pc-linux-gnu/libstdc++-v3/include/bits/unique_ptr.h:99
#2 0x51e6e45 in std::unique_ptr<ana::svalue_spatial_item,
std::default_delete<ana::svalue_spatial_item> >::~unique_ptr()
/home/worker/buildworker/tiber-gcc-asan/objdir/prev-x86_64-pc-linux-gnu/libstdc++-v3/include/bits/unique_ptr.h:404
#3 0x51e6e45 in ana::access_diagram_impl::~access_diagram_impl()
/home/worker/buildworker/tiber-gcc-asan/build/gcc/analyzer/access-diagram.cc:1728
#4 0x51e703c in ana::access_diagram_impl::~access_diagram_impl()
/home/worker/buildworker/tiber-gcc-asan/build/gcc/analyzer/access-diagram.cc:1728
#5 0x4e97142 in
std::default_delete<text_art::widget>::operator()(text_art::widget*) const
/home/worker/buildworker/tiber-gcc-asan/objdir/prev-x86_64-pc-linux-gnu/libstdc++-v3/include/bits/unique_ptr.h:99
#6 0x4e97142 in std::unique_ptr<text_art::widget,
std::default_delete<text_art::widget> >::~unique_ptr()
/home/worker/buildworker/tiber-gcc-asan/objdir/prev-x86_64-pc-linux-gnu/libstdc++-v3/include/bits/unique_ptr.h:404
I'll see if I can provide longer stack traces (in reasonable time).
Referenced Bugs:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=86656
[Bug 86656] [meta-bug] Issues found with -fsanitize=address
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug analyzer/110433] ASAN reports mismatching new/delete when compiling analyzer testcases
2023-06-27 9:56 [Bug analyzer/110433] New: ASAN reports mismatching new/delete when compiling analyzer testcases jamborm at gcc dot gnu.org
@ 2023-06-27 20:25 ` dmalcolm at gcc dot gnu.org
2023-06-28 9:41 ` jamborm at gcc dot gnu.org
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2023-06-27 20:25 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110433
--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
I haven't reproduced this yet, but I notice that I forgot to give class
spatial_item a virtual dtor, which looking at the backtrace may be the root
cause.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug analyzer/110433] ASAN reports mismatching new/delete when compiling analyzer testcases
2023-06-27 9:56 [Bug analyzer/110433] New: ASAN reports mismatching new/delete when compiling analyzer testcases jamborm at gcc dot gnu.org
2023-06-27 20:25 ` [Bug analyzer/110433] " dmalcolm at gcc dot gnu.org
@ 2023-06-28 9:41 ` jamborm at gcc dot gnu.org
2023-07-21 0:29 ` cvs-commit at gcc dot gnu.org
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: jamborm at gcc dot gnu.org @ 2023-06-28 9:41 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110433
--- Comment #2 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Here is the promised longer trace (from compiling
testsuite/gcc.dg/analyzer/out-of-bounds-diagram-5-unicode.c):
=================================================================
==58010==ERROR: AddressSanitizer: new-delete-type-mismatch on 0x50d000000a00 in
thread T0:
object passed to delete has wrong type:
size of the allocated type: 136 bytes;
size of the deallocated type: 104 bytes.
#0 0x83eba8 in operator delete(void*, unsigned long)
/home/worker/buildworker/tiber-gcc-asan/build/libsanitizer/asan/asan_new_delete.cpp:164
#1 0x51e6e45 in
std::default_delete<ana::svalue_spatial_item>::operator()(ana::svalue_spatial_item*)
const
/home/worker/buildworker/tiber-gcc-asan/objdir/prev-x86_64-pc-linux-gnu/libstdc++-v3/include/bits/unique_ptr.h:99
#2 0x51e6e45 in std::unique_ptr<ana::svalue_spatial_item,
std::default_delete<ana::svalue_spatial_item> >::~unique_ptr()
/home/worker/buildworker/tiber-gcc-asan/objdir/prev-x86_64-pc-linux-gnu/libstdc++-v3/include/bits/unique_ptr.h:404
#3 0x51e6e45 in ana::access_diagram_impl::~access_diagram_impl()
/home/worker/buildworker/tiber-gcc-asan/build/gcc/analyzer/access-diagram.cc:1728
#4 0x51e703c in ana::access_diagram_impl::~access_diagram_impl()
/home/worker/buildworker/tiber-gcc-asan/build/gcc/analyzer/access-diagram.cc:1728
#5 0x4e97142 in
std::default_delete<text_art::widget>::operator()(text_art::widget*) const
/home/worker/buildworker/tiber-gcc-asan/objdir/prev-x86_64-pc-linux-gnu/libstdc++-v3/include/bits/unique_ptr.h:99
#6 0x4e97142 in std::unique_ptr<text_art::widget,
std::default_delete<text_art::widget> >::~unique_ptr()
/home/worker/buildworker/tiber-gcc-asan/objdir/prev-x86_64-pc-linux-gnu/libstdc++-v3/include/bits/unique_ptr.h:404
#7 0x4e97142 in text_art::wrapper_widget::~wrapper_widget()
/home/worker/buildworker/tiber-gcc-asan/build/gcc/text-art/widget.h:136
#8 0x4e97142 in ana::access_diagram::~access_diagram()
/home/worker/buildworker/tiber-gcc-asan/build/gcc/analyzer/access-diagram.h:149
#9 0x4e97142 in
ana::out_of_bounds::make_access_diagram(ana::access_operation const&,
text_art::style_manager&, text_art::theme const&, ana::logger*) const
/home/worker/buildworker/tiber-gcc-asan/build/gcc/analyzer/bounds-checking.cc:192
#10 0x4e97142 in ana::out_of_bounds::maybe_show_diagram(ana::logger*) const
/home/worker/buildworker/tiber-gcc-asan/build/gcc/analyzer/bounds-checking.cc:169
#11 0x4e9928c in ana::out_of_bounds::maybe_show_notes(unsigned int,
ana::logger*) const
/home/worker/buildworker/tiber-gcc-asan/build/gcc/analyzer/bounds-checking.cc:125
#12 0x4e9928c in ana::concrete_buffer_overflow::emit(rich_location*,
ana::logger*)
/home/worker/buildworker/tiber-gcc-asan/build/gcc/analyzer/bounds-checking.cc:333
#13 0x4eee9ed in
ana::diagnostic_manager::emit_saved_diagnostic(ana::exploded_graph const&,
ana::saved_diagnostic const&)
/home/worker/buildworker/tiber-gcc-asan/build/gcc/analyzer/diagnostic-manager.cc:1424
#14 0x4efca7a in ana::dedupe_winners::emit_best(ana::diagnostic_manager*,
ana::exploded_graph const&)
/home/worker/buildworker/tiber-gcc-asan/build/gcc/analyzer/diagnostic-manager.cc:1311
#15 0x4eefd35 in
ana::diagnostic_manager::emit_saved_diagnostics(ana::exploded_graph const&)
/home/worker/buildworker/tiber-gcc-asan/build/gcc/analyzer/diagnostic-manager.cc:1363
#16 0x2a647b6 in ana::impl_run_checkers(ana::logger*)
/home/worker/buildworker/tiber-gcc-asan/build/gcc/analyzer/engine.cc:6139
#17 0x2a66f59 in ana::run_checkers()
/home/worker/buildworker/tiber-gcc-asan/build/gcc/analyzer/engine.cc:6213
#18 0x2a2f8dc in execute
/home/worker/buildworker/tiber-gcc-asan/build/gcc/analyzer/analyzer-pass.cc:87
#19 0x197af8b in execute_one_pass(opt_pass*)
/home/worker/buildworker/tiber-gcc-asan/build/gcc/passes.cc:2651
#20 0x197d6d0 in execute_ipa_pass_list(opt_pass*)
/home/worker/buildworker/tiber-gcc-asan/build/gcc/passes.cc:3100
#21 0xd6f193 in ipa_passes
/home/worker/buildworker/tiber-gcc-asan/build/gcc/cgraphunit.cc:2268
#22 0xd6f193 in symbol_table::compile()
/home/worker/buildworker/tiber-gcc-asan/build/gcc/cgraphunit.cc:2331
#23 0xd6f193 in symbol_table::compile()
/home/worker/buildworker/tiber-gcc-asan/build/gcc/cgraphunit.cc:2309
#24 0xd76f09 in symbol_table::finalize_compilation_unit()
/home/worker/buildworker/tiber-gcc-asan/build/gcc/cgraphunit.cc:2583
#25 0x1d81ed8 in compile_file
/home/worker/buildworker/tiber-gcc-asan/build/gcc/toplev.cc:471
#26 0x77e8fb in do_compile
/home/worker/buildworker/tiber-gcc-asan/build/gcc/toplev.cc:2126
#27 0x77e8fb in toplev::main(int, char**)
/home/worker/buildworker/tiber-gcc-asan/build/gcc/toplev.cc:2282
#28 0x789813 in main
/home/worker/buildworker/tiber-gcc-asan/build/gcc/main.cc:39
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug analyzer/110433] ASAN reports mismatching new/delete when compiling analyzer testcases
2023-06-27 9:56 [Bug analyzer/110433] New: ASAN reports mismatching new/delete when compiling analyzer testcases jamborm at gcc dot gnu.org
2023-06-27 20:25 ` [Bug analyzer/110433] " dmalcolm at gcc dot gnu.org
2023-06-28 9:41 ` jamborm at gcc dot gnu.org
@ 2023-07-21 0:29 ` cvs-commit at gcc dot gnu.org
2023-07-21 0:36 ` dmalcolm at gcc dot gnu.org
2023-07-22 18:18 ` jamborm at gcc dot gnu.org
4 siblings, 0 replies; 6+ messages in thread
From: cvs-commit at gcc dot gnu.org @ 2023-07-21 0:29 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110433
--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:
https://gcc.gnu.org/g:7006f02bbc3f1d0b7ed7fe2122abc0896aa848d2
commit r14-2689-g7006f02bbc3f1d0b7ed7fe2122abc0896aa848d2
Author: David Malcolm <dmalcolm@redhat.com>
Date: Thu Jul 20 20:24:06 2023 -0400
analyzer/text-art: fix clang warnings [PR110433,PR110612]
gcc/analyzer/ChangeLog:
PR analyzer/110433
PR middle-end/110612
* access-diagram.cc (class spatial_item): Add virtual dtor.
gcc/ChangeLog:
PR middle-end/110612
* text-art/table.cc (table_geometry::table_geometry): Drop m_table
field.
(table_geometry::table_x_to_canvas_x): Add cast to comparison.
(table_geometry::table_y_to_canvas_y): Likewise.
* text-art/table.h (table_geometry::m_table): Drop unused field.
* text-art/widget.h (wrapper_widget::update_child_alloc_rects):
Add "override".
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug analyzer/110433] ASAN reports mismatching new/delete when compiling analyzer testcases
2023-06-27 9:56 [Bug analyzer/110433] New: ASAN reports mismatching new/delete when compiling analyzer testcases jamborm at gcc dot gnu.org
` (2 preceding siblings ...)
2023-07-21 0:29 ` cvs-commit at gcc dot gnu.org
@ 2023-07-21 0:36 ` dmalcolm at gcc dot gnu.org
2023-07-22 18:18 ` jamborm at gcc dot gnu.org
4 siblings, 0 replies; 6+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2023-07-21 0:36 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110433
David Malcolm <dmalcolm at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |RESOLVED
Resolution|--- |FIXED
--- Comment #4 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Probably fixed by the above patch (by adding the virtual dtor); please reopen
if it isn't.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug analyzer/110433] ASAN reports mismatching new/delete when compiling analyzer testcases
2023-06-27 9:56 [Bug analyzer/110433] New: ASAN reports mismatching new/delete when compiling analyzer testcases jamborm at gcc dot gnu.org
` (3 preceding siblings ...)
2023-07-21 0:36 ` dmalcolm at gcc dot gnu.org
@ 2023-07-22 18:18 ` jamborm at gcc dot gnu.org
4 siblings, 0 replies; 6+ messages in thread
From: jamborm at gcc dot gnu.org @ 2023-07-22 18:18 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110433
--- Comment #5 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Indeed, the error is no longer reported. Thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2023-07-22 18:18 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-06-27 9:56 [Bug analyzer/110433] New: ASAN reports mismatching new/delete when compiling analyzer testcases jamborm at gcc dot gnu.org
2023-06-27 20:25 ` [Bug analyzer/110433] " dmalcolm at gcc dot gnu.org
2023-06-28 9:41 ` jamborm at gcc dot gnu.org
2023-07-21 0:29 ` cvs-commit at gcc dot gnu.org
2023-07-21 0:36 ` dmalcolm at gcc dot gnu.org
2023-07-22 18:18 ` jamborm at gcc dot gnu.org
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).