llvm / llvm/llvm-project

[compiler-rt][tysan][libc++] False positives with std::function callable storage

Open
#208,649 0 comments 0 reactions 0 assignees View on GitHub
compiler-rt:tysan false-positive libc++ needs-reduction
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

# `std::function`
#### Flags: `-stdlib=libc++ -fsanitize=type -O0` or `-stdlib=libc++ -fsanitize=type -O1`
#### Compiler: x86-64 clang 22.1.0
#### Link: https://godbolt.org/z/PYT6Mob5Y
#### Code:
```.cpp
#include

std::function f = [](){};

int main() {
f();
}
```
#### Logs:
```
==1==ERROR: TypeSanitizer: type-aliasing-violation on address 0x648731af5f30 (pc 0x648731199f57 bp 0x7ffcbb8ccd10 sp 0x7ffcbb8ccca0 tid 1)
WRITE of size 8 at 0x648731af5f30 with type vtable pointer accesses an existing object of type std::__1::function
#0 0x648731199f56 (/app/output.s+0x37f56)

==1==ERROR: TypeSanitizer: type-aliasing-violation on address 0x648731af5f30 (pc 0x648731199360 bp 0x7ffcbb8ccd40 sp 0x7ffcbb8cccd0 tid 1)
WRITE of size 8 at 0x648731af5f30 with type vtable pointer accesses an existing object of type std::__1::function
#0 0x64873119935f (/app/output.s+0x3735f)
...
```
#### Explanation:
libc++ `std::function` is likely doing placement-new vtable.

Contributor guide

Open the contributing guide

Research direction

Reproduce the report using the Godbolt link with libc++, -fsanitize=type, and -O0 or -O1, then inspect the libc++ std::function callable-storage path involved in the placement-new operation. Compare the TypeSanitizer diagnostics with the storage behavior; the issue is done when this valid example no longer produces false-positive type-aliasing violations.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.