public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug analyzer/110433] New: ASAN reports mismatching new/delete when compiling analyzer testcases
@ 2023-06-27  9:56 jamborm at gcc dot gnu.org
  2023-06-27 20:25 ` [Bug analyzer/110433] " dmalcolm at gcc dot gnu.org
                   ` (4 more replies)
  0 siblings, 5 replies; 6+ messages in thread
From: jamborm at gcc dot gnu.org @ 2023-06-27  9:56 UTC (permalink / raw)
  To: gcc-bugs

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110433

            Bug ID: 110433
           Summary: ASAN reports mismatching new/delete when compiling
                    analyzer testcases
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: jamborm at gcc dot gnu.org
                CC: dmalcolm at gcc dot gnu.org
            Blocks: 86656
  Target Milestone: ---
              Host: x86_64-linux
            Target: x86_64-linux

With a bootstrapped compiler configured with
--with-build-config=bootstrap-asan I get errors about new/delete
mismatching types when compiling testcases:

  - gcc.dg/analyzer/out-of-bounds-diagram-13.c
  - gcc.dg/analyzer/out-of-bounds-diagram-15.c
  - gcc.dg/analyzer/out-of-bounds-diagram-4.c
  - gcc.dg/analyzer/out-of-bounds-diagram-5-ascii.c
  - gcc.dg/analyzer/out-of-bounds-diagram-5-unicode.c and
  - gcc.dg/analyzer/out-of-bounds-diagram-7.c

The errors all look like:

Executing on host: /home/worker/buildworker/tiber-gcc-asan/objdir/gcc/xgcc
-B/home/worker/buildworker/tiber-gcc-asan/objdir/gcc/ 
/home/worker/buildworker/tiber-gcc-asan/build/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-13.c
   -fdiagnostics-plain-output   -fanalyzer -Wanalyzer-too-complex
-fanalyzer-call-summaries -fdiagnostics-text-art-charset=unicode -S -o
out-of-bounds-diagram-13.s    (timeout = 300)
spawn -ignore SIGHUP /home/worker/buildworker/tiber-gcc-asan/objdir/gcc/xgcc
-B/home/worker/buildworker/tiber-gcc-asan/objdir/gcc/
/home/worker/buildworker/tiber-gcc-asan/build/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-13.c
-fdiagnostics-plain-output -fanalyzer -Wanalyzer-too-complex
-fanalyzer-call-summaries -fdiagnostics-text-art-charset=unicode -S -o
out-of-bounds-diagram-13.s
/home/worker/buildworker/tiber-gcc-asan/build/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-13.c:
In function 'test_non_ascii':
/home/worker/buildworker/tiber-gcc-asan/build/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-13.c:9:3:
warning: stack-based buffer overflow [CWE-121] [-Wanalyzer-out-of-bounds]
/home/worker/buildworker/tiber-gcc-asan/build/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-13.c:8:8:
note: (1) capacity: 9 bytes
/home/worker/buildworker/tiber-gcc-asan/build/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-13.c:9:3:
note: (2) out-of-bounds write at byte 9 but 'buf' ends at byte 9
/home/worker/buildworker/tiber-gcc-asan/build/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-13.c:9:3:
note: write of 1 byte to beyond the end of 'buf'
/home/worker/buildworker/tiber-gcc-asan/build/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-13.c:9:3:
note: valid subscripts for 'buf' are '[0]' to '[8]'
=================================================================
==58507==ERROR: AddressSanitizer: new-delete-type-mismatch on 0x50d000000a00 in
thread T0:
  object passed to delete has wrong type:
  size of the allocated type:   136 bytes;
  size of the deallocated type: 104 bytes.
    #0 0x83eba8 in operator delete(void*, unsigned long)
/home/worker/buildworker/tiber-gcc-asan/build/libsanitizer/asan/asan_new_delete.cpp:164
    #1 0x51e6e45 in
std::default_delete<ana::svalue_spatial_item>::operator()(ana::svalue_spatial_item*)
const
/home/worker/buildworker/tiber-gcc-asan/objdir/prev-x86_64-pc-linux-gnu/libstdc++-v3/include/bits/unique_ptr.h:99
    #2 0x51e6e45 in std::unique_ptr<ana::svalue_spatial_item,
std::default_delete<ana::svalue_spatial_item> >::~unique_ptr()
/home/worker/buildworker/tiber-gcc-asan/objdir/prev-x86_64-pc-linux-gnu/libstdc++-v3/include/bits/unique_ptr.h:404
    #3 0x51e6e45 in ana::access_diagram_impl::~access_diagram_impl()
/home/worker/buildworker/tiber-gcc-asan/build/gcc/analyzer/access-diagram.cc:1728
    #4 0x51e703c in ana::access_diagram_impl::~access_diagram_impl()
/home/worker/buildworker/tiber-gcc-asan/build/gcc/analyzer/access-diagram.cc:1728
    #5 0x4e97142 in
std::default_delete<text_art::widget>::operator()(text_art::widget*) const
/home/worker/buildworker/tiber-gcc-asan/objdir/prev-x86_64-pc-linux-gnu/libstdc++-v3/include/bits/unique_ptr.h:99
    #6 0x4e97142 in std::unique_ptr<text_art::widget,
std::default_delete<text_art::widget> >::~unique_ptr()
/home/worker/buildworker/tiber-gcc-asan/objdir/prev-x86_64-pc-linux-gnu/libstdc++-v3/include/bits/unique_ptr.h:404
--
==58507==HINT: if you don't care about these errors you may set
ASAN_OPTIONS=new_delete_type_mismatch=0
==58507==ABORTING
compiler exited with status 1
PASS: gcc.dg/analyzer/out-of-bounds-diagram-13.c  (test for warnings, line 9)
FAIL: gcc.dg/analyzer/out-of-bounds-diagram-13.c  at line 10 (test for
warnings, line 9)
FAIL: gcc.dg/analyzer/out-of-bounds-diagram-13.c expected multiline pattern
lines 17-42
FAIL: gcc.dg/analyzer/out-of-bounds-diagram-13.c 2 blank line(s) in output
FAIL: gcc.dg/analyzer/out-of-bounds-diagram-13.c (test for excess errors)
Excess errors:
=================================================================
==58507==ERROR: AddressSanitizer: new-delete-type-mismatch on 0x50d000000a00 in
thread T0:
  object passed to delete has wrong type:
  size of the allocated type:   136 bytes;
  size of the deallocated type: 104 bytes.
    #0 0x83eba8 in operator delete(void*, unsigned long)
/home/worker/buildworker/tiber-gcc-asan/build/libsanitizer/asan/asan_new_delete.cpp:164
    #1 0x51e6e45 in
std::default_delete<ana::svalue_spatial_item>::operator()(ana::svalue_spatial_item*)
const
/home/worker/buildworker/tiber-gcc-asan/objdir/prev-x86_64-pc-linux-gnu/libstdc++-v3/include/bits/unique_ptr.h:99
    #2 0x51e6e45 in std::unique_ptr<ana::svalue_spatial_item,
std::default_delete<ana::svalue_spatial_item> >::~unique_ptr()
/home/worker/buildworker/tiber-gcc-asan/objdir/prev-x86_64-pc-linux-gnu/libstdc++-v3/include/bits/unique_ptr.h:404
    #3 0x51e6e45 in ana::access_diagram_impl::~access_diagram_impl()
/home/worker/buildworker/tiber-gcc-asan/build/gcc/analyzer/access-diagram.cc:1728
    #4 0x51e703c in ana::access_diagram_impl::~access_diagram_impl()
/home/worker/buildworker/tiber-gcc-asan/build/gcc/analyzer/access-diagram.cc:1728
    #5 0x4e97142 in
std::default_delete<text_art::widget>::operator()(text_art::widget*) const
/home/worker/buildworker/tiber-gcc-asan/objdir/prev-x86_64-pc-linux-gnu/libstdc++-v3/include/bits/unique_ptr.h:99
    #6 0x4e97142 in std::unique_ptr<text_art::widget,
std::default_delete<text_art::widget> >::~unique_ptr()
/home/worker/buildworker/tiber-gcc-asan/objdir/prev-x86_64-pc-linux-gnu/libstdc++-v3/include/bits/unique_ptr.h:404


I'll see if I can provide longer stack traces (in reasonable time).


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=86656
[Bug 86656] [meta-bug] Issues found with -fsanitize=address

^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2023-07-22 18:18 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-06-27  9:56 [Bug analyzer/110433] New: ASAN reports mismatching new/delete when compiling analyzer testcases jamborm at gcc dot gnu.org
2023-06-27 20:25 ` [Bug analyzer/110433] " dmalcolm at gcc dot gnu.org
2023-06-28  9:41 ` jamborm at gcc dot gnu.org
2023-07-21  0:29 ` cvs-commit at gcc dot gnu.org
2023-07-21  0:36 ` dmalcolm at gcc dot gnu.org
2023-07-22 18:18 ` jamborm at gcc dot gnu.org

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).