llvm / llvm/llvm-project

AddressSanitizer reports errors for tests in llvm-test-suite

Open
#158,628 1 comment 0 reactions 0 assignees View on GitHub
test-suite
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

Current llvm-test-suite version triggers a number of ASan failures.

The issue was tested at the commit f3710ea5dcfdcef972f2cfd18e2733b7c83ca3f3 of llvm-test-suite, built with system-provided Clang 20 from Ubuntu 25.04 (x86_64) repository.

## How to reproduce

Checkout current version of llvm-test-suite from https://github.com/llvm/llvm-test-suite, create `cmake/caches/asan.cmake` file with the following contents:

```cmake
set(OPTFLAGS "${OPTFLAGS} -O1 -g -fsanitize=address -fno-omit-frame-pointer -fno-optimize-sibling-calls")

set(CMAKE_C_FLAGS_RELEASE "${OPTFLAGS}" CACHE STRING "")
set(CMAKE_CXX_FLAGS_RELEASE "${OPTFLAGS}" CACHE STRING "")
set(CMAKE_BUILD_TYPE "Release" CACHE STRING "")
```

disable `Bitcode/*` and `MicroBenchmarks/XRay/*` tests:

git diff

```
diff --git a/Bitcode/CMakeLists.txt b/Bitcode/CMakeLists.txt
index 7da7a43a5..9daed2f42 100644
--- a/Bitcode/CMakeLists.txt
+++ b/Bitcode/CMakeLists.txt
@@ -1,3 +1,5 @@
+return()
+
# We need at least clang 3.9 to process the bitcode here.
if(CMAKE_C_COMPILER_ID STREQUAL "Clang" AND
CMAKE_CXX_COMPILER_ID STREQUAL "Clang" AND
diff --git a/MicroBenchmarks/CMakeLists.txt b/MicroBenchmarks/CMakeLists.txt
index 08d3dd44f..2ea44c0c9 100644
--- a/MicroBenchmarks/CMakeLists.txt
+++ b/MicroBenchmarks/CMakeLists.txt
@@ -2,7 +2,7 @@ file(COPY lit.local.cfg DESTINATION ${CMAKE_CURRENT_BINARY_DIR})

add_subdirectory(Builtins)
add_subdirectory(libs)
-add_subdirectory(XRay)
+# add_subdirectory(XRay)
add_subdirectory(LCALS)
add_subdirectory(harris)
add_subdirectory(ImageProcessing)
```

Then build and run the test suite with

```bash
$ mkdir build && cd build
$ CC=clang CXX=clang++ cmake -G Ninja .. -C ../cmake/caches/asan.cmake
$ ninja
$ ASAN_OPTIONS=detect_leaks=0 /path/to/bin/llvm-lit -va .
```

Note that LeakSanitizer is disabled, as otherwise its reports would make the output of test executables differ from the reference output.

## Expected results

No unexpected failures are reported (at least non-false-positives).

## Actual results

13 test failures are reported:

```
Failed Tests (13):
test-suite :: MicroBenchmarks/SLPVectorization/SLPVectorizationBenchmarks.test
test-suite :: MultiSource/Applications/hbd/hbd.test
test-suite :: MultiSource/Applications/hexxagon/hexxagon.test
test-suite :: MultiSource/Applications/siod/siod.test
test-suite :: MultiSource/Benchmarks/DOE-ProxyApps-C++/PENNANT/PENNANT.test
test-suite :: MultiSource/Benchmarks/MallocBench/gs/gs.test
test-suite :: MultiSource/Benchmarks/PAQ8p/paq8p.test
test-suite :: MultiSource/Benchmarks/Prolangs-C++/life/life.test
test-suite :: MultiSource/Benchmarks/Trimaran/netbench-url/netbench-url.test
test-suite :: MultiSource/Benchmarks/mediabench/jpeg/jpeg-6a/cjpeg.test
test-suite :: SingleSource/Regression/C/Regression-C-PR10189.test
test-suite :: SingleSource/UnitTests/Vectorizer/find-last.test
test-suite :: SingleSource/UnitTests/Vectorizer/index-select.test

Testing Time: 309.53s

Total Discovered Tests: 2059
Passed: 2046 (99.37%)
Failed: 13 (0.63%)
```

Here are the reports produced for the particular tests.

### `stack-buffer-overflow`

MicroBenchmarks/SLPVectorization/SLPVectorizationBenchmarks.test

```
==2911097==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd44a3e080 at pc 0x642e7bdcaa96 bp 0x7ffd44a3cb40 sp 0x7ffd44a3cb38
READ of size 8 at 0x7ffd44a3e080 thread T0
#0 0x642e7bdcaa95 in void do_multiply_accumulate<2u, double>(double*, double*, double) /LLVMTS/MicroBenchmarks/SLPVectorization/Versioning.cpp:152:17
#1 0x642e7bdc6e93 in void benchmark_multiply_accumulate_runtime_checks_fail<2u, double>(benchmark::State&) /LLVMTS/MicroBenchmarks/SLPVectorization/Versioning.cpp:179:5
#2 0x642e7bde8291 in benchmark::internal::FunctionBenchmark::Run(benchmark::State&) /LLVMTS/MicroBenchmarks/libs/benchmark/src/benchmark_register.cc:498:42
#3 0x642e7be5caeb in benchmark::internal::BenchmarkInstance::Run(long, int, benchmark::internal::ThreadTimer*, benchmark::internal::ThreadManager*, benchmark::internal::PerfCountersMeasurement*, benchmark::ProfilerManager*) const /LLVMTS/MicroBenchmarks/libs/benchmark/src/benchmark_api_internal.cc:99:14
#4 0x642e7be2d06f in benchmark::internal::(anonymous namespace)::RunInThread(benchmark::internal::BenchmarkInstance const*, long, int, benchmark::internal::ThreadManager*, benchmark::internal::PerfCountersMeasurement*, benchmark::ProfilerManager*) /LLVMTS/MicroBenchmarks/libs/benchmark/src/benchmark_runner.cc:143:17
#5 0x642e7be2c38b in benchmark::internal::BenchmarkRunner::DoNIterations() /LLVMTS/MicroBenchmarks/libs/benchmark/src/benchmark_runner.cc:295:3
#6 0x642e7be2eee0 in benchmark::internal::BenchmarkRunner::DoOneRepetition() /LLVMTS/MicroBenchmarks/libs/benchmark/src/benchmark_runner.cc:476:9
#7 0x642e7bdce900 in benchmark::internal::(anonymous namespace)::RunBenchmarks(std::vector> const&, benchmark::BenchmarkReporter*, benchmark::BenchmarkReporter*) /LLVMTS/MicroBenchmarks/libs/benchmark/src/benchmark.cc:458:14
#8 0x642e7bdce900 in benchmark::RunSpecifiedBenchmarks(benchmark::BenchmarkReporter*, benchmark::BenchmarkReporter*, std::__cxx11::basic_string, std::allocator>) /LLVMTS/MicroBenchmarks/libs/benchmark/src/benchmark.cc:641:5
#9 0x642e7bdcd4b1 in benchmark::RunSpecifiedBenchmarks() /LLVMTS/MicroBenchmarks/libs/benchmark/src/benchmark.cc:555:10
#10 0x642e7bdc4e0b in main /LLVMTS/MicroBenchmarks/SLPVectorization/main.cpp:6:3
#11 0x7c3afda2a577 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#12 0x7c3afda2a63a in __libc_start_main csu/../csu/libc-start.c:360:3
#13 0x642e7bcdb2b4 in _start (/LLVMTS/build/MicroBenchmarks/SLPVectorization/SLPVectorizationBenchmarks+0x432b4) (BuildId: 484b57c0fd6e1e20713d5ec48ccd20b3fd9d7d02)

Address 0x7ffd44a3e080 is located in stack of thread T0 at offset 5312 in frame
#0 0x642e7bdc6b8f in void benchmark_multiply_accumulate_runtime_checks_fail<2u, double>(benchmark::State&) /LLVMTS/MicroBenchmarks/SLPVectorization/Versioning.cpp:174

This frame has 2 object(s):
[32, 5032) 'rng.i' (line 11)
[5296, 5312) 'A' (line 175) <== Memory access at offset 5312 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /LLVMTS/MicroBenchmarks/SLPVectorization/Versioning.cpp:152:17 in void do_multiply_accumulate<2u, double>(double*, double*, double)
Shadow bytes around the buggy address:
0x7ffd44a3de00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
0x7ffd44a3de80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
0x7ffd44a3df00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f2 f2 f2
0x7ffd44a3df80: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2
0x7ffd44a3e000: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 00 00
=>0x7ffd44a3e080:[f3]f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
0x7ffd44a3e100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7ffd44a3e180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7ffd44a3e200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7ffd44a3e280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7ffd44a3e300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==2911097==ABORTING
```

### `global-buffer-overflow`

MultiSource/Applications/hbd/hbd.test

```
==2911459==ERROR: AddressSanitizer: global-buffer-overflow on address 0x57121fb05e98 at pc 0x57121f15b3ea bp 0x7ffeaeefae10 sp 0x7ffeaeefae08
READ of size 8 at 0x57121fb05e98 thread T0
#0 0x57121f15b3e9 in pushunop(Classfile*) /LLVMTS/MultiSource/Applications/hbd/d6-arith.cpp:37:13
#1 0x57121f1667a2 in decompileblock(Classfile*, method_info*) /LLVMTS/MultiSource/Applications/hbd/decomp.cpp:177:12
#2 0x57121f062f3e in Classfile::print() /LLVMTS/MultiSource/Applications/hbd/class.cpp:415:9
#3 0x57121f063732 in main /LLVMTS/MultiSource/Applications/hbd/hbd.cpp:19:5
#4 0x78f27422a577 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#5 0x78f27422a63a in __libc_start_main csu/../csu/libc-start.c:360:3
#6 0x57121f065554 in _start (/LLVMTS/build/MultiSource/Applications/hbd/hbd+0x35554) (BuildId: 63e04fc3273d32411f39946dfbad6c3eb7d801cb)

0x57121fb05e98 is located 8 bytes before global variable 'stack' defined in '/LLVMTS/MultiSource/Applications/hbd/decomp.cpp:46' (0x57121fb05ea0) of size 64
0x57121fb05e98 is located 16 bytes after global variable 'miptr' defined in '/LLVMTS/MultiSource/Applications/hbd/decomp.cpp:44' (0x57121fb05e80) of size 8
SUMMARY: AddressSanitizer: global-buffer-overflow /LLVMTS/MultiSource/Applications/hbd/d6-arith.cpp:37:13 in pushunop(Classfile*)
Shadow bytes around the buggy address:
0x57121fb05c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x57121fb05c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9
0x57121fb05d00: 00 00 00 00 04 f9 f9 f9 00 f9 f9 f9 00 f9 f9 f9
0x57121fb05d80: 00 f9 f9 f9 00 f9 f9 f9 00 00 00 00 04 f9 f9 f9
0x57121fb05e00: 00 f9 f9 f9 04 f9 f9 f9 04 f9 f9 f9 04 f9 f9 f9
=>0x57121fb05e80: 00 f9 f9[f9]00 00 00 00 00 00 00 00 f9 f9 f9 f9
0x57121fb05f00: 00 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
0x57121fb05f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x57121fb06000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x57121fb06080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x57121fb06100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==2911459==ABORTING
```

MultiSource/Benchmarks/mediabench/jpeg/jpeg-6a/cjpeg.test

```
==2913382==ERROR: AddressSanitizer: global-buffer-overflow on address 0x58c689e1f38c at pc 0x58c689d4d4af bp 0x7ffe2e1fa1d0 sp 0x7ffe2e1f9990
READ of size 256 at 0x58c689e1f38c thread T0
#0 0x58c689d4d4ae in __asan_memcpy (/LLVMTS/build/MultiSource/Benchmarks/mediabench/jpeg/jpeg-6a/cjpeg+0xd44ae) (BuildId: 3c90250ab6e9912e3608151b3b98ca45ebab4b0e)
#1 0x58c689d988b5 in add_huff_table /LLVMTS/MultiSource/Benchmarks/mediabench/jpeg/jpeg-6a/jcparam.c:155:3
#2 0x58c689d988b5 in std_huff_tables /LLVMTS/MultiSource/Benchmarks/mediabench/jpeg/jpeg-6a/jcparam.c:227:3
#3 0x58c689d988b5 in jpeg_set_defaults /LLVMTS/MultiSource/Benchmarks/mediabench/jpeg/jpeg-6a/jcparam.c:272:3
#4 0x58c689dfcd5c in main /LLVMTS/MultiSource/Benchmarks/mediabench/jpeg/jpeg-6a/cjpeg.c:503:3
#5 0x73db4b42a577 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#6 0x73db4b42a63a in __libc_start_main csu/../csu/libc-start.c:360:3
#7 0x58c689cabac4 in _start (/LLVMTS/build/MultiSource/Benchmarks/mediabench/jpeg/jpeg-6a/cjpeg+0x32ac4) (BuildId: 3c90250ab6e9912e3608151b3b98ca45ebab4b0e)

0x58c689e1f38c is located 20 bytes before global variable 'std_huff_tables.bits_dc_chrominance' defined in '/LLVMTS/MultiSource/Benchmarks/mediabench/jpeg/jpeg-6a/jcparam.c:172' (0x58c689e1f3a0) of size 17
0x58c689e1f38c is located 0 bytes after global variable 'std_huff_tables.val_dc_luminance' defined in '/LLVMTS/MultiSource/Benchmarks/mediabench/jpeg/jpeg-6a/jcparam.c:169' (0x58c689e1f380) of size 12
SUMMARY: AddressSanitizer: global-buffer-overflow (/LLVMTS/build/MultiSource/Benchmarks/mediabench/jpeg/jpeg-6a/cjpeg+0xd44ae) (BuildId: 3c90250ab6e9912e3608151b3b98ca45ebab4b0e) in __asan_memcpy
Shadow bytes around the buggy address:
0x58c689e1f100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x58c689e1f180: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 f9
0x58c689e1f200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x58c689e1f280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x58c689e1f300: f9 f9 f9 f9 f9 f9 f9 f9 00 00 01 f9 f9 f9 f9 f9
=>0x58c689e1f380: 00[04]f9 f9 00 00 01 f9 f9 f9 f9 f9 00 04 f9 f9
0x58c689e1f400: 00 00 01 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
0x58c689e1f480: 00 00 00 00 00 00 00 00 00 00 00 00 02 f9 f9 f9
0x58c689e1f500: f9 f9 f9 f9 00 00 01 f9 f9 f9 f9 f9 00 00 00 00
0x58c689e1f580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x58c689e1f600: 02 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==2913382==ABORTING
```

SingleSource/Regression/C/Regression-C-PR10189.test

```
==2913595==ERROR: AddressSanitizer: global-buffer-overflow on address 0x57f287182d84 at pc 0x57f2867f2c3f bp 0x7ffd898d2630 sp 0x7ffd898d2628
READ of size 4 at 0x57f287182d84 thread T0
#0 0x57f2867f2c3e in main /LLVMTS/SingleSource/Regression/C/PR10189.c
#1 0x75c35342a577 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#2 0x75c35342a63a in __libc_start_main csu/../csu/libc-start.c:360:3
#3 0x57f28670a354 in _start (/LLVMTS/build/SingleSource/Regression/C/Regression-C-PR10189+0x2c354) (BuildId: ea01971fc0fc9455272ae3958e71a1d9dad4a2fe)

0x57f287182d84 is located 28 bytes before global variable 'g_1639' defined in '/LLVMTS/SingleSource/Regression/C/PR10189.c:42' (0x57f287182da0) of size 4
0x57f287182d84 is located 4 bytes after global variable 'g_20' defined in '/LLVMTS/SingleSource/Regression/C/PR10189.c' (0x57f287182d80) of size 0
'g_20' is ascii string ''
SUMMARY: AddressSanitizer: global-buffer-overflow /LLVMTS/SingleSource/Regression/C/PR10189.c in main
Shadow bytes around the buggy address:
0x57f287182b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x57f287182b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x57f287182c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x57f287182c80: 00 00 00 00 00 00 00 00 00 00 00 00 04 f9 f9 f9
0x57f287182d00: 04 f9 f9 f9 04 f9 f9 f9 04 f9 f9 f9 02 f9 f9 f9
=>0x57f287182d80:[f9]f9 f9 f9 04 f9 f9 f9 00 00 00 00 00 00 00 00
0x57f287182e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x57f287182e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x57f287182f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x57f287182f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x57f287183000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==2913595==ABORTING
```

### `heap-buffer-overflow`

MultiSource/Benchmarks/DOE-ProxyApps-C++/PENNANT/PENNANT.test

```
==2912124==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7bc9068bea00 at pc 0x5e163f24f8a4 bp 0x7ffeaff4b6b0 sp 0x7ffeaff4b6a8
READ of size 4 at 0x7bc9068bea00 thread T0
#0 0x5e163f24f8a3 in Mesh::initInvMap() /LLVMTS/MultiSource/Benchmarks/DOE-ProxyApps-C++/PENNANT/Mesh.cc:276:30
#1 0x5e163f24b0e6 in Mesh::init() /LLVMTS/MultiSource/Benchmarks/DOE-ProxyApps-C++/PENNANT/Mesh.cc:102:5
#2 0x5e163f24a5b5 in Mesh::Mesh(InputFile const*) /LLVMTS/MultiSource/Benchmarks/DOE-ProxyApps-C++/PENNANT/Mesh.cc:57:5
#3 0x5e163f219d2b in Driver::Driver(InputFile const*, std::__cxx11::basic_string, std::allocator> const&) /LLVMTS/MultiSource/Benchmarks/DOE-ProxyApps-C++/PENNANT/Driver.cc:67:16
#4 0x5e163f25bbe6 in main /LLVMTS/MultiSource/Benchmarks/DOE-ProxyApps-C++/PENNANT/main.cc:43:12
#5 0x7fc90a22a577 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#6 0x7fc90a22a63a in __libc_start_main csu/../csu/libc-start.c:360:3
#7 0x5e163f12f684 in _start (/LLVMTS/build/MultiSource/Benchmarks/DOE-ProxyApps-C++/PENNANT/PENNANT+0x31684) (BuildId: f9f966030e7b55ea93d005f245cafa4b62bbda62)

0x7bc9068bea00 is located 0 bytes after 2880000-byte region [0x7bc9065ff800,0x7bc9068bea00)
allocated by thread T0 here:
#0 0x5e163f217cb1 in operator new(unsigned long) (/LLVMTS/build/MultiSource/Benchmarks/DOE-ProxyApps-C++/PENNANT/PENNANT+0x119cb1) (BuildId: f9f966030e7b55ea93d005f245cafa4b62bbda62)
#1 0x5e163f24f40a in std::__new_allocator>::allocate(unsigned long, void const*) /usr/lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/new_allocator.h:151:27
#2 0x5e163f24f40a in std::allocator_traits>>::allocate(std::allocator>&, unsigned long) /usr/lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/alloc_traits.h:515:20
#3 0x5e163f24f40a in std::_Vector_base, std::allocator>>::_M_allocate(unsigned long) /usr/lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/stl_vector.h:380:20
#4 0x5e163f24f40a in std::_Vector_base, std::allocator>>::_M_create_storage(unsigned long) /usr/lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/stl_vector.h:398:33
#5 0x5e163f24f40a in std::_Vector_base, std::allocator>>::_Vector_base(unsigned long, std::allocator> const&) /usr/lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/stl_vector.h:334:9
#6 0x5e163f24f40a in std::vector, std::allocator>>::vector(unsigned long, std::allocator> const&) /usr/lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/stl_vector.h:557:9
#7 0x5e163f24f40a in Mesh::initInvMap() /LLVMTS/MultiSource/Benchmarks/DOE-ProxyApps-C++/PENNANT/Mesh.cc:270:29
#8 0x5e163f24b0e6 in Mesh::init() /LLVMTS/MultiSource/Benchmarks/DOE-ProxyApps-C++/PENNANT/Mesh.cc:102:5
#9 0x5e163f24a5b5 in Mesh::Mesh(InputFile const*) /LLVMTS/MultiSource/Benchmarks/DOE-ProxyApps-C++/PENNANT/Mesh.cc:57:5
#10 0x5e163f219d2b in Driver::Driver(InputFile const*, std::__cxx11::basic_string, std::allocator> const&) /LLVMTS/MultiSource/Benchmarks/DOE-ProxyApps-C++/PENNANT/Driver.cc:67:16
#11 0x5e163f25bbe6 in main /LLVMTS/MultiSource/Benchmarks/DOE-ProxyApps-C++/PENNANT/main.cc:43:12
#12 0x7fc90a22a577 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#13 0x7fc90a22a63a in __libc_start_main csu/../csu/libc-start.c:360:3
#14 0x5e163f12f684 in _start (/LLVMTS/build/MultiSource/Benchmarks/DOE-ProxyApps-C++/PENNANT/PENNANT+0x31684) (BuildId: f9f966030e7b55ea93d005f245cafa4b62bbda62)

SUMMARY: AddressSanitizer: heap-buffer-overflow /LLVMTS/MultiSource/Benchmarks/DOE-ProxyApps-C++/PENNANT/Mesh.cc:276:30 in Mesh::initInvMap()
Shadow bytes around the buggy address:
0x7bc9068be780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7bc9068be800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7bc9068be880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7bc9068be900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7bc9068be980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x7bc9068bea00:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x7bc9068bea80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x7bc9068beb00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x7bc9068beb80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x7bc9068bec00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x7bc9068bec80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==2912124==ABORTING
```

MultiSource/Benchmarks/MallocBench/gs/gs.test

```
==2912488==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x77420c3e0298 at pc 0x5bfb16ef1edf bp 0x7ffcae789410 sp 0x7ffcae788bd0
READ of size 20 at 0x77420c3e0298 thread T0
#0 0x5bfb16ef1ede in __asan_memcpy (/LLVMTS/build/MultiSource/Benchmarks/MallocBench/gs/gs+0xddede) (BuildId: 7ae352b4c09ca54ad711d8f2d01b321bacf0ab4c)
#1 0x5bfb16f414e2 in dynamic_grow /LLVMTS/MultiSource/Benchmarks/MallocBench/gs/iscan.c:101:3
#2 0x5bfb16f414e2 in scan_token /LLVMTS/MultiSource/Benchmarks/MallocBench/gs/iscan.c:341:11
#3 0x5bfb16f3f5cd in interp /LLVMTS/MultiSource/Benchmarks/MallocBench/gs/interp.c:455:19
#4 0x5bfb16f3f078 in interpret /LLVMTS/MultiSource/Benchmarks/MallocBench/gs/interp.c:140:15
#5 0x5bfb16f399df in run_file /LLVMTS/MultiSource/Benchmarks/MallocBench/gs/gs.c:272:9
#6 0x5bfb16f398c0 in init2 /LLVMTS/MultiSource/Benchmarks/MallocBench/gs/gs.c:244:3
#7 0x5bfb16f393bd in argproc /LLVMTS/MultiSource/Benchmarks/MallocBench/gs/gs.c:203:2
#8 0x5bfb16f39dfd in gs_main /LLVMTS/MultiSource/Benchmarks/MallocBench/gs/gsmain.c:170:4
#9 0x5bfb16f38bbd in main /LLVMTS/MultiSource/Benchmarks/MallocBench/gs/gs.c:86:14
#10 0x79e20d02a577 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#11 0x79e20d02a63a in __libc_start_main csu/../csu/libc-start.c:360:3
#12 0x5bfb16e504f4 in _start (/LLVMTS/build/MultiSource/Benchmarks/MallocBench/gs/gs+0x3c4f4) (BuildId: 7ae352b4c09ca54ad711d8f2d01b321bacf0ab4c)

0x77420c3e0298 is located 0 bytes after 536-byte region [0x77420c3e0080,0x77420c3e0298)
allocated by thread T0 here:
#0 0x5bfb16ef41e8 in malloc (/LLVMTS/build/MultiSource/Benchmarks/MallocBench/gs/gs+0xe01e8) (BuildId: 7ae352b4c09ca54ad711d8f2d01b321bacf0ab4c)
#1 0x5bfb16f84155 in gs_malloc /LLVMTS/MultiSource/Benchmarks/MallocBench/gs/gsmisc.c:39:14
#2 0x5bfb16f3a88c in alloc_large /LLVMTS/MultiSource/Benchmarks/MallocBench/gs/ialloc.c:577:3
#3 0x5bfb16f3a88c in alloc /LLVMTS/MultiSource/Benchmarks/MallocBench/gs/ialloc.c:188:17
#4 0x5bfb16f51f7b in file_open /LLVMTS/MultiSource/Benchmarks/MallocBench/gs/zfile.c:740:19
#5 0x5bfb16f516fb in lib_file_open /LLVMTS/MultiSource/Benchmarks/MallocBench/gs/zfile.c:688:9
#6 0x5bfb16f39987 in run_file /LLVMTS/MultiSource/Benchmarks/MallocBench/gs/gs.c:263:7
#7 0x5bfb16f398c0 in init2 /LLVMTS/MultiSource/Benchmarks/MallocBench/gs/gs.c:244:3
#8 0x5bfb16f393bd in argproc /LLVMTS/MultiSource/Benchmarks/MallocBench/gs/gs.c:203:2
#9 0x5bfb16f39dfd in gs_main /LLVMTS/MultiSource/Benchmarks/MallocBench/gs/gsmain.c:170:4
#10 0x5bfb16f38bbd in main /LLVMTS/MultiSource/Benchmarks/MallocBench/gs/gs.c:86:14
#11 0x79e20d02a577 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#12 0x79e20d02a63a in __libc_start_main csu/../csu/libc-start.c:360:3
#13 0x5bfb16e504f4 in _start (/LLVMTS/build/MultiSource/Benchmarks/MallocBench/gs/gs+0x3c4f4) (BuildId: 7ae352b4c09ca54ad711d8f2d01b321bacf0ab4c)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/LLVMTS/build/MultiSource/Benchmarks/MallocBench/gs/gs+0xddede) (BuildId: 7ae352b4c09ca54ad711d8f2d01b321bacf0ab4c) in __asan_memcpy
Shadow bytes around the buggy address:
0x77420c3e0000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x77420c3e0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x77420c3e0100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x77420c3e0180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x77420c3e0200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x77420c3e0280: 00 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa
0x77420c3e0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x77420c3e0380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x77420c3e0400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x77420c3e0480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x77420c3e0500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==2912488==ABORTING
```

MultiSource/Benchmarks/Trimaran/netbench-url/netbench-url.test

```
==2915068==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7a8455fe007a at pc 0x5b05a2f15f1a bp 0x7ffc5bc67e80 sp 0x7ffc5bc67e78
READ of size 1 at 0x70626f3e007a thread T0
#0 0x567f0c389f19 in find_lcs /LLVMTS/MultiSource/Benchmarks/Trimaran/netbench-url/search.c:240:31
#1 0x567f0c389fc3 in insert_rule /LLVMTS/MultiSource/Benchmarks/Trimaran/netbench-url/search.c:300:24
#2 0x567f0c38a540 in db_init /LLVMTS/MultiSource/Benchmarks/Trimaran/netbench-url/search.c:403:7
#3 0x567f0c38a788 in main /LLVMTS/MultiSource/Benchmarks/Trimaran/netbench-url/url.c:107:3
#4 0x74427002a577 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#5 0x74427002a63a in __libc_start_main csu/../csu/libc-start.c:360:3
#6 0x567f0c2a0434 in _start (/LLVMTS/build/MultiSource/Benchmarks/Trimaran/netbench-url/netbench-url+0x2d434) (BuildId: 96c308ca07dacf85085e34341b13bad1aaced297)

0x70626f3e007a is located 0 bytes after 10-byte region [0x70626f3e0070,0x70626f3e007a)
allocated by thread T0 here:
#0 0x567f0c344128 in malloc (/LLVMTS/build/MultiSource/Benchmarks/Trimaran/netbench-url/netbench-url+0xd1128) (BuildId: 96c308ca07dacf85085e34341b13bad1aaced297)
#1 0x567f0c38a437 in db_init /LLVMTS/MultiSource/Benchmarks/Trimaran/netbench-url/search.c:382:31
#2 0x567f0c38a788 in main /LLVMTS/MultiSource/Benchmarks/Trimaran/netbench-url/url.c:107:3
#3 0x74427002a577 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#4 0x74427002a63a in __libc_start_main csu/../csu/libc-start.c:360:3
#5 0x567f0c2a0434 in _start (/LLVMTS/build/MultiSource/Benchmarks/Trimaran/netbench-url/netbench-url+0x2d434) (BuildId: 96c308ca07dacf85085e34341b13bad1aaced297)

SUMMARY: AddressSanitizer: heap-buffer-overflow /LLVMTS/MultiSource/Benchmarks/Trimaran/netbench-url/search.c:240:31 in find_lcs
Shadow bytes around the buggy address:
0x70626f3dfd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x70626f3dfe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x70626f3dfe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x70626f3dff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x70626f3dff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x70626f3e0000: fa fa 06 fa fa fa 05 fa fa fa 05 fa fa fa 00[02]
0x70626f3e0080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x70626f3e0100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x70626f3e0180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x70626f3e0200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x70626f3e0280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==2913240==ABORTING
```

SingleSource/UnitTests/Vectorizer/find-last.test

```
==2913703==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6e6ec2df64a0 at pc 0x64857d00df3e bp 0x7fff3e8449a0 sp 0x7fff3e844998
READ of size 4 at 0x6e6ec2df64a0 thread T0
#0 0x64857d00df3d in _ZZ4mainENK4$_16clIiiEEiPT_PT0_i /LLVMTS/SingleSource/UnitTests/Vectorizer/find-last.cpp:241:5
#1 0x64857d00df3d in int std::__invoke_impl(std::__invoke_other, main::$_16&, int*&&, int*&&, int&&) /usr/lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/invoke.h:61:14
#2 0x64857d00df3d in std::enable_if, int>::type std::__invoke_r(main::$_16&, int*&&, int*&&, int&&) /usr/lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/invoke.h:114:9
#3 0x64857d00df3d in std::_Function_handler::_M_invoke(std::_Any_data const&, int*&&, int*&&, int&&) /usr/lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/std_function.h:290:9
#4 0x64857d007847 in std::function::operator()(int*, int*, int) const /usr/lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/std_function.h:591:9
#5 0x64857d007847 in void checkVectorFunction(std::function, std::function, char const*) /LLVMTS/SingleSource/UnitTests/Vectorizer/find-last.cpp:26:22
#6 0x64857d005cae in main /LLVMTS/SingleSource/UnitTests/Vectorizer/find-last.cpp:248:5
#7 0x705ec3a2a577 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#8 0x705ec3a2a63a in __libc_start_main csu/../csu/libc-start.c:360:3
#9 0x64857cf1b4b4 in _start (/LLVMTS/build/SingleSource/UnitTests/Vectorizer/find-last+0x2f4b4) (BuildId: ce7325077b0468de97a726e35d8e89963bb1ad61)

0x6e6ec2df64a0 is located 0 bytes after 4000-byte region [0x6e6ec2df5500,0x6e6ec2df64a0)
allocated by thread T0 here:
#0 0x64857d003c01 in operator new[](unsigned long) (/LLVMTS/build/SingleSource/UnitTests/Vectorizer/find-last+0x117c01) (BuildId: ce7325077b0468de97a726e35d8e89963bb1ad61)
#1 0x64857d007496 in void checkVectorFunction(std::function, std::function, char const*) /LLVMTS/SingleSource/UnitTests/Vectorizer/find-last.cpp:18:30
#2 0x64857d005cae in main /LLVMTS/SingleSource/UnitTests/Vectorizer/find-last.cpp:248:5
#3 0x705ec3a2a577 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#4 0x705ec3a2a63a in __libc_start_main csu/../csu/libc-start.c:360:3
#5 0x64857cf1b4b4 in _start (/LLVMTS/build/SingleSource/UnitTests/Vectorizer/find-last+0x2f4b4) (BuildId: ce7325077b0468de97a726e35d8e89963bb1ad61)

SUMMARY: AddressSanitizer: heap-buffer-overflow /LLVMTS/SingleSource/UnitTests/Vectorizer/find-last.cpp:241:5 in _ZZ4mainENK4$_16clIiiEEiPT_PT0_i
Shadow bytes around the buggy address:
0x6e6ec2df6200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x6e6ec2df6280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x6e6ec2df6300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x6e6ec2df6380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x6e6ec2df6400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x6e6ec2df6480: 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa
0x6e6ec2df6500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x6e6ec2df6580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x6e6ec2df6600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x6e6ec2df6680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x6e6ec2df6700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==2913703==ABORTING
```

SingleSource/UnitTests/Vectorizer/index-select.test

```
==2913977==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6e3a66dec4a0 at pc 0x60d3a97bb77d bp 0x7ffc52d17650 sp 0x7ffc52d17648
READ of size 4 at 0x6e3a66dec4a0 thread T0
#0 0x60d3a97bb77c in _ZZ4mainENK3$_8clIjjEEDaPT_PT0_j /LLVMTS/SingleSource/UnitTests/Vectorizer/index-select.cpp:182:5
#1 0x60d3a97bb77c in unsigned int std::__invoke_impl(std::__invoke_other, main::$_8&, unsigned int*&&, unsigned int*&&, unsigned int&&) /usr/lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/invoke.h:61:14
#2 0x60d3a97bb77c in std::enable_if, unsigned int>::type std::__invoke_r(main::$_8&, unsigned int*&&, unsigned int*&&, unsigned int&&) /usr/lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/invoke.h:114:9
#3 0x60d3a97bb77c in std::_Function_handler::_M_invoke(std::_Any_data const&, unsigned int*&&, unsigned int*&&, unsigned int&&) /usr/lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/std_function.h:290:9
#4 0x60d3a97ba079 in std::function::operator()(unsigned int*, unsigned int*, unsigned int) const /usr/lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/std_function.h:591:9
#5 0x60d3a97ba079 in void checkVectorFunction(std::function, std::function, char const*) /LLVMTS/SingleSource/UnitTests/Vectorizer/index-select.cpp:26:22
#6 0x60d3a97b9465 in main /LLVMTS/SingleSource/UnitTests/Vectorizer/index-select.cpp:194:5
#7 0x702a67a2a577 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#8 0x702a67a2a63a in __libc_start_main csu/../csu/libc-start.c:360:3
#9 0x60d3a96cf4b4 in _start (/LLVMTS/build/SingleSource/UnitTests/Vectorizer/index-select+0x2e4b4) (BuildId: 8e7e16e625ed4b47277e64dc3bbc8208e0caf3a2)

0x6e3a66dec4a0 is located 0 bytes after 4000-byte region [0x6e3a66deb500,0x6e3a66dec4a0)
allocated by thread T0 here:
#0 0x60d3a97b7c01 in operator new[](unsigned long) (/LLVMTS/build/SingleSource/UnitTests/Vectorizer/index-select+0x116c01) (BuildId: 8e7e16e625ed4b47277e64dc3bbc8208e0caf3a2)
#1 0x60d3a97b9d30 in void checkVectorFunction(std::function, std::function, char const*) /LLVMTS/SingleSource/UnitTests/Vectorizer/index-select.cpp:18:30
#2 0x60d3a97b9465 in main /LLVMTS/SingleSource/UnitTests/Vectorizer/index-select.cpp:194:5
#3 0x702a67a2a577 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#4 0x702a67a2a63a in __libc_start_main csu/../csu/libc-start.c:360:3
#5 0x60d3a96cf4b4 in _start (/LLVMTS/build/SingleSource/UnitTests/Vectorizer/index-select+0x2e4b4) (BuildId: 8e7e16e625ed4b47277e64dc3bbc8208e0caf3a2)

SUMMARY: AddressSanitizer: heap-buffer-overflow /LLVMTS/SingleSource/UnitTests/Vectorizer/index-select.cpp:182:5 in _ZZ4mainENK3$_8clIjjEEDaPT_PT0_j
Shadow bytes around the buggy address:
0x6e3a66dec200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x6e3a66dec280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x6e3a66dec300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x6e3a66dec380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x6e3a66dec400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x6e3a66dec480: 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa
0x6e3a66dec500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x6e3a66dec580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x6e3a66dec600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x6e3a66dec680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x6e3a66dec700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==2913977==ABORTING
```

### strcpy-param-overlap

MultiSource/Benchmarks/PAQ8p/paq8p.test

```
=================================================================
==2912651==ERROR: AddressSanitizer: strcpy-param-overlap: memory ranges [0x7b1d897e02f0,0x7b1d897e02f2) and [0x7b1d897e02f0, 0x7b1d897e02f2) overlap
#0 0x61c3b4df4a66 in strcpy (/LLVMTS/build/MultiSource/Benchmarks/PAQ8p/paq8p+0xbda66) (BuildId: 20482f1e9aea3d778a45bb6dbb98a5e16f97aea3)
#1 0x61c3b4e7f7bd in String::operator=(char const*) /LLVMTS/MultiSource/Benchmarks/PAQ8p/paq8p.cpp:792:5
#2 0x61c3b4e7f7bd in paqmain(int, char**) /LLVMTS/MultiSource/Benchmarks/PAQ8p/paq8p.cpp:4442:10
#3 0x61c3b4e82162 in main /LLVMTS/MultiSource/Benchmarks/PAQ8p/paq8p.cpp:4494:7
#4 0x7efd8a62a577 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#5 0x7efd8a62a63a in __libc_start_main csu/../csu/libc-start.c:360:3
#6 0x61c3b4d6ae24 in _start (/LLVMTS/build/MultiSource/Benchmarks/PAQ8p/paq8p+0x33e24) (BuildId: 20482f1e9aea3d778a45bb6dbb98a5e16f97aea3)

0x7b1d897e02f0 is located 0 bytes inside of 16-byte region [0x7b1d897e02f0,0x7b1d897e0300)
allocated by thread T0 here:
#0 0x61c3b4e0eced in calloc (/LLVMTS/build/MultiSource/Benchmarks/PAQ8p/paq8p+0xd7ced) (BuildId: 20482f1e9aea3d778a45bb6dbb98a5e16f97aea3)
#1 0x61c3b4e874e1 in Array::create(int) /LLVMTS/MultiSource/Benchmarks/PAQ8p/paq8p.cpp:762:16
#2 0x61c3b4e874e1 in Array::resize(int) /LLVMTS/MultiSource/Benchmarks/PAQ8p/paq8p.cpp:743:3
#3 0x61c3b4e86f31 in Array::push_back(char const&) /LLVMTS/MultiSource/Benchmarks/PAQ8p/paq8p.cpp:776:5
#4 0x61c3b4e86f31 in String::operator+=(char const*) /LLVMTS/MultiSource/Benchmarks/PAQ8p/paq8p.cpp:797:16
#5 0x61c3b4e86f31 in String::String(char const*) /LLVMTS/MultiSource/Benchmarks/PAQ8p/paq8p.cpp:801:12
#6 0x61c3b4e7f3ff in paqmain(int, char**) /LLVMTS/MultiSource/Benchmarks/PAQ8p/paq8p.cpp:4427:14
#7 0x61c3b4e82162 in main /LLVMTS/MultiSource/Benchmarks/PAQ8p/paq8p.cpp:4494:7
#8 0x7efd8a62a577 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#9 0x7efd8a62a63a in __libc_start_main csu/../csu/libc-start.c:360:3
#10 0x61c3b4d6ae24 in _start (/LLVMTS/build/MultiSource/Benchmarks/PAQ8p/paq8p+0x33e24) (BuildId: 20482f1e9aea3d778a45bb6dbb98a5e16f97aea3)

0x7b1d897e02f0 is located 0 bytes inside of 16-byte region [0x7b1d897e02f0,0x7b1d897e0300)
allocated by thread T0 here:
#0 0x61c3b4e0eced in calloc (/LLVMTS/build/MultiSource/Benchmarks/PAQ8p/paq8p+0xd7ced) (BuildId: 20482f1e9aea3d778a45bb6dbb98a5e16f97aea3)
#1 0x61c3b4e874e1 in Array::create(int) /LLVMTS/MultiSource/Benchmarks/PAQ8p/paq8p.cpp:762:16
#2 0x61c3b4e874e1 in Array::resize(int) /LLVMTS/MultiSource/Benchmarks/PAQ8p/paq8p.cpp:743:3
#3 0x61c3b4e86f31 in Array::push_back(char const&) /LLVMTS/MultiSource/Benchmarks/PAQ8p/paq8p.cpp:776:5
#4 0x61c3b4e86f31 in String::operator+=(char const*) /LLVMTS/MultiSource/Benchmarks/PAQ8p/paq8p.cpp:797:16
#5 0x61c3b4e86f31 in String::String(char const*) /LLVMTS/MultiSource/Benchmarks/PAQ8p/paq8p.cpp:801:12
#6 0x61c3b4e7f3ff in paqmain(int, char**) /LLVMTS/MultiSource/Benchmarks/PAQ8p/paq8p.cpp:4427:14
#7 0x61c3b4e82162 in main /LLVMTS/MultiSource/Benchmarks/PAQ8p/paq8p.cpp:4494:7
#8 0x7efd8a62a577 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#9 0x7efd8a62a63a in __libc_start_main csu/../csu/libc-start.c:360:3
#10 0x61c3b4d6ae24 in _start (/LLVMTS/build/MultiSource/Benchmarks/PAQ8p/paq8p+0x33e24) (BuildId: 20482f1e9aea3d778a45bb6dbb98a5e16f97aea3)

SUMMARY: AddressSanitizer: strcpy-param-overlap (/LLVMTS/build/MultiSource/Benchmarks/PAQ8p/paq8p+0xbda66) (BuildId: 20482f1e9aea3d778a45bb6dbb98a5e16f97aea3) in strcpy
==2912651==ABORTING
```

### Possibly harmless / false positives

MultiSource/Applications/hexxagon/hexxagon.test

```
=================================================================
==2911719==ERROR: AddressSanitizer: alloc-dealloc-mismatch (operator new [] vs operator delete) on 0x6e742bfe0040
#0 0x56bc7359c676 in operator delete(void*, unsigned long) (/LLVMTS/build/MultiSource/Applications/hexxagon/hexxagon+0x118676) (BuildId: 63e81f69f24cc45b1115713a353c9c6dfc8df0eb)
#1 0x56bc735a2f69 in HexxagonMoveList::addMove(HexxagonMove&) /LLVMTS/MultiSource/Applications/hexxagon/hexxagonmove.cpp:51:5
#2 0x56bc735a0ff4 in HexxagonBoard::generateMoveList() /LLVMTS/MultiSource/Applications/hexxagon/hexxagonboard.cpp:324:13
#3 0x56bc735a1a1e in HexxagonBoard::endOfGame() /LLVMTS/MultiSource/Applications/hexxagon/hexxagonboard.cpp:342:13
#4 0x56bc735a1a1e in HexxagonBoard::displayBoardText(int) /LLVMTS/MultiSource/Applications/hexxagon/hexxagonboard.cpp:434:11
#5 0x56bc7359e0f3 in HexxagonGame::displayText() /LLVMTS/MultiSource/Applications/hexxagon/hexxagongame.h:61:28
#6 0x56bc7359e0f3 in main /LLVMTS/MultiSource/Applications/hexxagon/hexxagon.cpp:169:8
#7 0x71b42cc2a577 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#8 0x71b42cc2a63a in __libc_start_main csu/../csu/libc-start.c:360:3
#9 0x56bc734b33c4 in _start (/LLVMTS/build/MultiSource/Applications/hexxagon/hexxagon+0x2f3c4) (BuildId: 63e81f69f24cc45b1115713a353c9c6dfc8df0eb)

0x6e742bfe0040 is located 0 bytes inside of 128-byte region [0x6e742bfe0040,0x6e742bfe00c0)
allocated by thread T0 here:
#0 0x56bc7359bb11 in operator new[](unsigned long) (/LLVMTS/build/MultiSource/Applications/hexxagon/hexxagon+0x117b11) (BuildId: 63e81f69f24cc45b1115713a353c9c6dfc8df0eb)
#1 0x56bc735a0df6 in HexxagonMoveList::HexxagonMoveList() /LLVMTS/MultiSource/Applications/hexxagon/hexxagonmove.h:46:31
#2 0x56bc735a0df6 in HexxagonBoard::generateMoveList() /LLVMTS/MultiSource/Applications/hexxagon/hexxagonboard.cpp:298:31
#3 0x56bc735a1a1e in HexxagonBoard::endOfGame() /LLVMTS/MultiSource/Applications/hexxagon/hexxagonboard.cpp:342:13
#4 0x56bc735a1a1e in HexxagonBoard::displayBoardText(int) /LLVMTS/MultiSource/Applications/hexxagon/hexxagonboard.cpp:434:11
#5 0x56bc7359e0f3 in HexxagonGame::displayText() /LLVMTS/MultiSource/Applications/hexxagon/hexxagongame.h:61:28
#6 0x56bc7359e0f3 in main /LLVMTS/MultiSource/Applications/hexxagon/hexxagon.cpp:169:8
#7 0x71b42cc2a577 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#8 0x71b42cc2a63a in __libc_start_main csu/../csu/libc-start.c:360:3
#9 0x56bc734b33c4 in _start (/LLVMTS/build/MultiSource/Applications/hexxagon/hexxagon+0x2f3c4) (BuildId: 63e81f69f24cc45b1115713a353c9c6dfc8df0eb)

SUMMARY: AddressSanitizer: alloc-dealloc-mismatch (/LLVMTS/build/MultiSource/Applications/hexxagon/hexxagon+0x118676) (BuildId: 63e81f69f24cc45b1115713a353c9c6dfc8df0eb) in operator delete(void*, unsigned long)
==2911719==HINT: if you don't care about these errors you may set ASAN_OPTIONS=alloc_dealloc_mismatch=0
==2911719==ABORTING
```

MultiSource/Applications/siod/siod.test

```
ERROR: the currently assigned stack limit has been exceded
```

MultiSource/Benchmarks/Prolangs-C++/life/life.test

```
==2913017==ERROR: AddressSanitizer: new-delete-type-mismatch on 0x74e7a4be07c0 in thread T0:
object passed to delete has wrong type:
size of the allocated type: 24 bytes;
size of the deallocated type: 16 bytes.
#0 0x6289e5243606 in operator delete(void*, unsigned long) (/LLVMTS/build/MultiSource/Benchmarks/Prolangs-C++/life/life+0x116606) (BuildId: 1bd44f0a6a5dcc262a0d457f0818c212aedee70e)
#1 0x6289e524626b in dele(living* (*) [40]) /LLVMTS/MultiSource/Benchmarks/Prolangs-C++/life/life.cpp:150:7
#2 0x6289e524626b in main /LLVMTS/MultiSource/Benchmarks/Prolangs-C++/life/life.cpp:182:7
#3 0x78b7a582a577 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#4 0x78b7a582a63a in __libc_start_main csu/../csu/libc-start.c:360:3
#5 0x6289e515a354 in _start (/LLVMTS/build/MultiSource/Benchmarks/Prolangs-C++/life/life+0x2d354) (BuildId: 1bd44f0a6a5dcc262a0d457f0818c212aedee70e)

0x74e7a4be07c0 is located 0 bytes inside of 24-byte region [0x74e7a4be07c0,0x74e7a4be07d8)
allocated by thread T0 here:
#0 0x6289e5242981 in operator new(unsigned long) (/LLVMTS/build/MultiSource/Benchmarks/Prolangs-C++/life/life+0x115981) (BuildId: 1bd44f0a6a5dcc262a0d457f0818c212aedee70e)
#1 0x6289e5245f29 in eden(living* (*) [40]) /LLVMTS/MultiSource/Benchmarks/Prolangs-C++/life/life.cpp:159:29
#2 0x6289e5245f29 in main /LLVMTS/MultiSource/Benchmarks/Prolangs-C++/life/life.cpp:173:3
#3 0x78b7a582a577 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#4 0x78b7a582a63a in __libc_start_main csu/../csu/libc-start.c:360:3
#5 0x6289e515a354 in _start (/LLVMTS/build/MultiSource/Benchmarks/Prolangs-C++/life/life+0x2d354) (BuildId: 1bd44f0a6a5dcc262a0d457f0818c212aedee70e)

SUMMARY: AddressSanitizer: new-delete-type-mismatch (/LLVMTS/build/MultiSource/Benchmarks/Prolangs-C++/life/life+0x116606) (BuildId: 1bd44f0a6a5dcc262a0d457f0818c212aedee70e) in operator delete(void*, unsigned long)
==2913017==HINT: if you don't care about these errors you may set ASAN_OPTIONS=new_delete_type_mismatch=0
==2913017==ABORTING
```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the ASan configuration from cmake/caches/asan.cmake and running the provided CMake, Ninja, and llvm-lit commands. Then inspect the reported failures, including Versioning.cpp, d6-arith.cpp, decomp.cpp, and jcparam.c. Done means the suite reports no unexpected failures.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, cmake, cpp
Domain
build-system, compilers, testing-qa
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.