google / google/sanitizers

Use-after-dtor reports are hard to read

Open
#592 0 comments 0 reactions 0 assignees View on GitHub
Priority-Medium ProjectMemorySanitizer Status-New Type-Defect
Dominant language
C
Stars
12.5k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

Originally reported on Google Code with ID 89

```
The "origin" portion of use-after-dtor reports on global variables looks something like
this:
#0 in __sanitizer_dtor_callback
#1 in MSanAtExitWrapper
#2 in __run_exit_handlers
...
# in __libc_start_main

There are 2 issues here:
1. There is no destructor frame. That's probably because __sanitizer_dtor_callback
is the last thing a destructor does, and it is tail-called. We should suppress tail-call
optimization in this case. This affects both global and heap-allocated objects.
2. For globals it should be possible to print the variable name (and the location of
the global definition). There is no support for this in MSan (because globals are almost
always initialized); there is code in TSan that does this and support in llvm-symbolizer.
3. I wonder how hard it would be to do the same for local (stack) variables.

```

Reported by `eugenis@google.com` on 2015-07-21 23:31:21

Contributor guide

Open the contributing guide

Research direction

Start by comparing the existing ThreadSanitizer global-reporting code with llvm-symbolizer support, then trace __sanitizer_dtor_callback and MSanAtExitWrapper. Determine how destructor frames, global names, and definition locations are represented; completion would address the reported global and heap cases and clarify whether local-variable reporting is feasible.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
devtools, testing-qa
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.