google / google/sanitizers

More noreturn issues

Open
#601 1 comment 0 reactions 0 assignees View on GitHub
ProjectAddressSanitizer
Dominant language
C
Stars
12.5k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

This is a continuation of https://github.com/google/sanitizers/issues/129.
Also see https://llvm.org/bugs/show_bug.cgi?id=12200.

struct A {
[[noreturn]] virtual void f();
};

void g(A *a) {
a->f();
}

In this example, unless a->f() is devirtualized, it does not get a noreturn attribute in the IR. Also there is no callee, because it's a virtual call. Therefore, we don't call __asan_handle_no_return before the call to f().

This is causing false positives here:
https://android.googlesource.com/platform/art/+/master/runtime/arch/context.h#82

I wonder if we need to treat [[noreturn]] functions as [[no_sanitize_address]]? It sounds radical, but then what's the point of clearing the entire stack shadow before a call to such function, if we immediately poison it in the function prologue? And I think we also need to call __asan_handle_no_return from such functions, in case we got there via a virtual call.

Contributor guide

Open the contributing guide

Research direction

Review the linked continuation in issue #129, LLVM bug 12200, and the ART runtime/arch/context.h example first. Trace how a virtual [[noreturn]] call is represented in IR and how AddressSanitizer decides when to call __asan_handle_no_return. Done means the noreturn path no longer produces the reported false positives, including when reached through a virtual call.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers, tooling
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.