boostorg / boostorg/phoenix

[Asan + MSVC] Boost\libs\phoenix failed to build with stack-use-after-scope on windows

Open
#128 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
33
Forks
51
PR merge metrics
No merged PRs in 30d

Description

Issue Description:

Building Boost\libs\phoenix with Asan on windows failed due to stack-use-after-scope, could you please take a look? Thanks in advance.

Reproduce Steps:
```
1. git clone -c core.autocrlf=true --recursive ​https://github.com/boostorg/boost.git C:\gitP\boostorg and checkout commit 1a80576
2. open a VS 2022 x64 command prompt and browse to C:\gitP\boostorg
3. set _CL_= /fsanitize=address /GS- /wd5072 /DBOOST_TIMER_ENABLE_DEPRECATED & set _LINK_= /InferASanLibs /incremental:no /debug
4. .\bootstrap
5. .\b2 headers variant=release --build-dir=C:\gitP\boostorg\boost\amd64 address-model=64 architecture=x86
6. .\b2 variant=release --build-dir=C:\gitP\boostorg\boost\amd64 address-model=64 architecture=x86
7. .\b2 -j16 variant=release --build-dir=C:\gitP\boostorg\boost\amd64 libs\phoenix\test address-model=64

```
Failures:
```
testing.capture-output C:\gitP\boostorg\boost\amd64\boost\bin.v2\libs\phoenix\test\bind_dm_test.test\msvc-14.3\release\x86_64\threading-multi\bind_dm_test.run
====== BEGIN OUTPUT ======
=================================================================
==3924==ERROR: AddressSanitizer: stack-use-after-scope on address 0x0078ad59fb78 at pc 0x7ff67240428b bp 0x0078ad59f910 sp 0x0078ad59f910
READ of size 4 at 0x0078ad59fb78 thread T0
#0 0x7ff67240428a in main (C:\gitP\boostorg\boost\amd64\boost\bin.v2\libs\phoenix\test\bind_dm_test.test\msvc-14.3\release\x86_64\threading-multi\bind_dm_test.exe+0x14000428a)
#1 0x7ff67240598e in invoke_main C:\repos\msvc\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
#2 0x7ff67240598e in __scrt_common_main_seh C:\repos\msvc\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
#3 0x7fff8bf5e956 (C:\WINDOWS\System32\KERNEL32.DLL+0x18002e956)
#4 0x7fff8db47c1b (C:\WINDOWS\SYSTEM32\ntdll.dll+0x180087c1b)

Address 0x0078ad59fb78 is located in stack of thread T0 at offset 568 in frame
#0 0x7ff6724039cf in main (C:\gitP\boostorg\boost\amd64\boost\bin.v2\libs\phoenix\test\bind_dm_test.test\msvc-14.3\release\x86_64\threading-multi\bind_dm_test.exe+0x1400039cf)

This frame has 18 object(s):
[32, 36) 'x'
[48, 56) 'compiler temporary'
[64, 72) 'compiler temporary'
[80, 88) 'compiler temporary'
[96, 112) 'compiler temporary'
[112, 128) 'compiler temporary'
[128, 132) 'cx'
[144, 152) 'compiler temporary'
[160, 168) 'compiler temporary'
[176, 184) 'compiler temporary'
[192, 208) 'compiler temporary'
[208, 224) 'compiler temporary'
[224, 248) 'compiler temporary'
[240, 256) 'that'
[256, 272) 'that'
[272, 280) 'compiler temporary'
[288, 304) 'that'
[304, 308) 'compiler temporary' <== Memory access at offset 568 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
(longjmp, SEH and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-use-after-scope (C:\gitP\boostorg\boost\amd64\boost\bin.v2\libs\phoenix\test\bind_dm_test.test\msvc-14.3\release\x86_64\threading-multi\bind_dm_test.exe+0x14000428a) in main
Shadow bytes around the buggy address:
0x0078ad59f880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0078ad59f900: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f2 f8 f2
0x0078ad59f980: f8 f2 f8 f2 f8 f8 f2 f2 f2 f2 f8 f8 f2 f2 f2 f2
0x0078ad59fa00: 04 f2 f8 f2 f8 f2 f8 f2 f8 f8 f2 f2 f2 f2 f8 f8
0x0078ad59fa80: f2 f2 f2 f2 00 00 00 f2 f2 f2 f2 f8 f8 f2 f2 f2
=>0x0078ad59fb00: f2 f8 f8 f2 f2 f2 f2 f8 f2 f8 f8 f2 f2 f2 f2[f8]
0x0078ad59fb80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
0x0078ad59fc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0078ad59fc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0078ad59fd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0078ad59fd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==3924==ABORTING

EXIT STATUS: 1
====== END OUTPUT ======

testing.capture-output C:\gitP\boostorg\boost\amd64\boost\bin.v2\libs\phoenix\test\more_let_tests.test\msvc-14.3\release\x86_64\threading-multi\more_let_tests.run
====== BEGIN OUTPUT ======
=================================================================
==30784==ERROR: AddressSanitizer: stack-use-after-scope on address 0x00568beff450 at pc 0x7ff732d29b94 bp 0x00568beff090 sp 0x00568beff090
READ of size 4 at 0x00568beff450 thread T0
#0 0x7ff732d29b93 in main (C:\gitP\boostorg\boost\amd64\boost\bin.v2\libs\phoenix\test\more_let_tests.test\msvc-14.3\release\x86_64\threading-multi\more_let_tests.exe+0x140009b93)
#1 0x7ff732d2c08e in invoke_main C:\repos\msvc\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
#2 0x7ff732d2c08e in __scrt_common_main_seh C:\repos\msvc\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
#3 0x7fff8bf5e956 (C:\WINDOWS\System32\KERNEL32.DLL+0x18002e956)
#4 0x7fff8db47c1b (C:\WINDOWS\SYSTEM32\ntdll.dll+0x180087c1b)

Address 0x00568beff450 is located in stack of thread T0 at offset 912 in frame
#0 0x7ff732d290ff in main (C:\gitP\boostorg\boost\amd64\boost\bin.v2\libs\phoenix\test\more_let_tests.test\msvc-14.3\release\x86_64\threading-multi\more_let_tests.exe+0x1400090ff)

This frame has 64 object(s):
[32, 40) 'compiler temporary'
[48, 56) 'compiler temporary'
[64, 72) 'compiler temporary'
[80, 88) 'compiler temporary'
[96, 100) 'y'
[112, 117) 'compiler temporary'
[128, 132) 'y'
[144, 149) 'compiler temporary'
[160, 164) 'y'
[176, 184) 'compiler temporary'
[192, 193) 'compiler temporary'
[208, 211) 'compiler temporary'
[224, 236) 'compiler temporary'
[240, 244) 'y'
[256, 264) 'compiler temporary'
[272, 273) 'compiler temporary'
[288, 291) 'compiler temporary'
[304, 316) 'compiler temporary'
[320, 324) 'y'
[336, 344) 'compiler temporary'
[352, 353) 'compiler temporary'
[368, 371) 'compiler temporary'
[384, 396) 'compiler temporary'
[400, 404) 'y'
[416, 424) 'compiler temporary'
[432, 433) 'compiler temporary'
[448, 451) 'compiler temporary'
[464, 476) 'compiler temporary'
[480, 484) 'y'
[496, 497) 'compiler temporary'
[512, 515) 'compiler temporary'
[528, 540) 'compiler temporary'
[544, 548) 'y'
[560, 561) 'compiler temporary'
[576, 579) 'compiler temporary'
[592, 604) 'compiler temporary'
[608, 609) 'compiler temporary'
[624, 632) 'env'
[640, 641) 'compiler temporary'
[656, 672) 'compiler temporary'
[672, 680) 'env'
[688, 692) 'vars_'
[704, 712) 'locals'
[720, 736) 'env'
[736, 737) 'compiler temporary'
[752, 753) 'compiler temporary'
[768, 784) 'compiler temporary'
[784, 800) 'env'
[800, 808) 'locals'
[816, 832) 'env'
[832, 848) 'compiler temporary'
[848, 849) 'compiler temporary'
[864, 876) 'that'
[880, 881) 'compiler temporary'
[896, 897) 'd'
[912, 928) 'env' <== Memory access at offset 912 is inside this variable
[928, 929) 'compiler temporary'
[944, 960) 'compiler temporary'
[960, 968) 'vars_'
[976, 992) 'locals'
[992, 1016) 'env'
[1008, 1024) 'compiler temporary'
[1024, 1025) 'compiler temporary'
[1040, 1041) 'd'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
(longjmp, SEH and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-use-after-scope (C:\gitP\boostorg\boost\amd64\boost\bin.v2\libs\phoenix\test\more_let_tests.test\msvc-14.3\release\x86_64\threading-multi\more_let_tests.exe+0x140009b93) in main
Shadow bytes around the buggy address:
0x00568beff180: 01 f2 03 f2 00 04 f2 f2 f2 f2 04 f2 00 f2 01 f2
0x00568beff200: 03 f2 00 04 f2 f2 f2 f2 04 f2 00 f2 01 f2 03 f2
0x00568beff280: 00 04 f2 f2 f2 f2 04 f2 00 f2 01 f2 03 f2 00 04
0x00568beff300: f2 f2 f2 f2 04 f2 01 f2 03 f2 00 04 f2 f2 f2 f2
0x00568beff380: 04 f2 01 f2 03 f2 00 04 f2 f2 f2 f2 f8 f2 f8 f2
=>0x00568beff400: f8 f2 f8 f8 f2 f2 f2 f2 f8 f2[f8]f2 f8 f2 00 00
0x00568beff480: f2 f2 f2 f2 01 f2 01 f2 00 00 f2 f2 f2 f2 00 00
0x00568beff500: f2 f2 f2 f2 00 f2 00 00 f2 f2 f2 f2 00 00 f2 f2
0x00568beff580: f2 f2 01 f2 00 04 f2 f2 f2 f2 01 f2 01 f2 00 00
0x00568beff600: f2 f2 f2 f2 01 f2 00 00 f2 f2 f2 f2 00 f2 00 00
0x00568beff680: f2 f2 f2 f2 00 00 00 f2 f2 f2 f2 00 00 f2 f2 f2
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==30784==ABORTING

EXIT STATUS: 1
====== END OUTPUT ======
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the reported failure with the listed VS 2022, AddressSanitizer, and b2 commands. Inspect the Phoenix tests named bind_dm_test and more_let_tests and their stack-use-after-scope reports; done means both tests pass under the reported Windows/MSVC configuration without the sanitizer errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
build-system, testing
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.