llvm-symbolizer crashes on large binaries when pruneCache is triggered
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
When running llvm-symbolizer on exceptionally large debug files, it can cause a crash when pruneCache runs.
The debug file that demonstrates the issue has the following llvm-dwarfdump statistics:
"#functions": 2967243,
"#functions with location": 2926638,
"#inlined functions": 34111408,
"#inlined functions with abstract origins": 34111408,
"#unique source variables": 7853978,
"#source variables": 446186887,
"#source variables with location": 41196627,
When the application crashes, we spawn an llvm-symbolizer and request the entire callstack's worth of symbols.
The behavior we're seeing is that once the internal cache hits the maximum cache size, LLVMSymbolizer::pruneCache() is run, which frees up LRU data. However, some of that data is still referenced by raw pointers inside the symbolizer, and later on the freed memory is dereferenced, causing a crash.
Raising the MaxCacheSize significantly has allowed us to work around the problem, but I'm raising this issue so that a proper fix for pruneCache can be investigated. Thank you.
Contributor guide
Research direction
Start with llvm-symbolizer and the LLVMSymbolizer::pruneCache() entry point, then reproduce the crash using the exceptionally large debug file described by the llvm-dwarfdump statistics. Trace the cache's LRU cleanup and verify that requesting a full callstack after the cache reaches its maximum no longer dereferences freed data.
Written by the indexing model from the issue text.
Assessment
- Domain
- cli, compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100