llvm / llvm/llvm-project

[compiler-rt][tysan][libc++] False positives with global/static struct containing STL containers

Open
#208,655 0 comments 0 reactions 0 assignees View on GitHub
compiler-rt:tysan false-positive libc++ needs-reduction
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

# global/static `struct` offset and layout
#### Flags: `-stdlib=libc++ -fsanitize=type -O1`
#### Compiler: x86-64 clang 22.1.0
#### Link: https://godbolt.org/z/x4nM6K5Mv
#### Code:
```.cpp
#include

struct Registry {
std::vector arr;
char temp_byte;
bool bool_var = false;
};

int main() {
static Registry r;
r.arr.push_back(0); // reserve is also repro
r.bool_var = true;
}
```
#### Logs:
```
==1==ERROR: TypeSanitizer: type-aliasing-violation on address 0x62c0c8b4df08 (pc 0x62c0c81f3179 bp 0x7ffdf94d1420 sp 0x7ffdf94d13b0 tid 1)
WRITE of size 1 at 0x62c0c8b4df08 with type bool (in Registry at offset 32) accesses part of an existing object of type p1 int (in std::__1::vector> at offset 0) that starts at offset -32
#0 0x62c0c81f3178 (/app/output.s+0x36178)
```
#### Explanation:

- If we remove the “static” keyword in Registry initialization, it will not reproduce.
- If we replace the vector array with three int pointers, it will not reproduce.
- If we remove the vector function, it will not reproduce.
- If we reorder struct variables it will not reproduce:
```.cpp
#include

struct Registry {
char temp_byte;
std::vector arr;
bool bool_var = false;
};

int main() {
static Registry r;
r.arr.push_back(0);
r.bool_var = true;
}
```
- Global `struct` also fires:
```.cpp
#include

struct Registry {
std::vector arr;
char temp_byte;
bool bool_var = false;
};

Registry r;

int main() {
r.arr.push_back(0); // reserve is also repro
r.bool_var = true;
}
```
Might be related to global/static STL containers FP in 20.1.0: https://godbolt.org/z/q3TsrK5c4
But fixed in 22.1.0: https://godbolt.org/z/1qE3z6eea

Contributor guide

Open the contributing guide

Research direction

Start with the linked Godbolt reproducer using -stdlib=libc++ -fsanitize=type -O1, and compare the static/global cases with the non-static, reordered, and pointer variants. Trace the TypeSanitizer report around the libc++ vector layout and global/static struct offsets. Done means the reproducer no longer reports a false positive while genuine type-aliasing diagnostics remain intact.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.