llvm / llvm/llvm-project

llvm-symbolizer crashes on large binaries when pruneCache is triggered

Open
#177,556 2 comments 0 reactions 0 assignees View on GitHub
crash tools:llvm-symbolizer
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

When running llvm-symbolizer on exceptionally large debug files, it can cause a crash when pruneCache runs.

The debug file that demonstrates the issue has the following llvm-dwarfdump statistics:
"#functions": 2967243,
"#functions with location": 2926638,
"#inlined functions": 34111408,
"#inlined functions with abstract origins": 34111408,
"#unique source variables": 7853978,
"#source variables": 446186887,
"#source variables with location": 41196627,

When the application crashes, we spawn an llvm-symbolizer and request the entire callstack's worth of symbols.
The behavior we're seeing is that once the internal cache hits the maximum cache size, LLVMSymbolizer::pruneCache() is run, which frees up LRU data. However, some of that data is still referenced by raw pointers inside the symbolizer, and later on the freed memory is dereferenced, causing a crash.

Raising the MaxCacheSize significantly has allowed us to work around the problem, but I'm raising this issue so that a proper fix for pruneCache can be investigated. Thank you.

Contributor guide

Open the contributing guide

Research direction

Start with llvm-symbolizer and the LLVMSymbolizer::pruneCache() entry point, then reproduce the crash using the exceptionally large debug file described by the llvm-dwarfdump statistics. Trace the cache's LRU cleanup and verify that requesting a full callstack after the cache reaches its maximum no longer dereferences freed data.

Written by the indexing model from the issue text.

Assessment

Domain
cli, compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.