DynamoRIO / DynamoRIO/drmemory

False positive "uninitialized read" on bitfield access

Open
#1,731 2 comments 0 reactions 0 assignees View on GitHub
Bug-FalsePositive Component-FullMode FalsePos-BitLevel Hotlist-Chrome
Dominant language
C
Stars
2.7k
Forks
290
PR merge metrics
No merged PRs in 30d

Description

This happened while running Blink (the rendering engine for Chrome) tests.

First reported here:
https://code.google.com/p/chromium/issues/detail?id=498519

The code was essentially the following code.

``` c++
class ElementRareData {
public:
ElementRareData() : m_proxyCount(0) { }
uint32_t proxyCount() const { return m_proxyCount; }
...
private:
unsigned short m_proxyCount: 10;
...
};

ElementRareData erd;
uint32_t x = erd.proxyCount(); // (*)
```

`m_proxyCount` does not have neighboring bits used by other bitfields, so the compiler
adds padding of 6 bits. On the (*) timing, compiler emits 16bit read instruction and
applies 10bit bitmask, then extend to unsigned 32bit, but at the read instruction
it shouldn't be counted as "uninitialized read".

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.