[compiler-rt][tysan][libc++] False positives with global/static struct containing STL containers
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
# global/static `struct` offset and layout
#### Flags: `-stdlib=libc++ -fsanitize=type -O1`
#### Compiler: x86-64 clang 22.1.0
#### Link: https://godbolt.org/z/x4nM6K5Mv
#### Code:
```.cpp
#include
struct Registry {
std::vector arr;
char temp_byte;
bool bool_var = false;
};
int main() {
static Registry r;
r.arr.push_back(0); // reserve is also repro
r.bool_var = true;
}
```
#### Logs:
```
==1==ERROR: TypeSanitizer: type-aliasing-violation on address 0x62c0c8b4df08 (pc 0x62c0c81f3179 bp 0x7ffdf94d1420 sp 0x7ffdf94d13b0 tid 1)
WRITE of size 1 at 0x62c0c8b4df08 with type bool (in Registry at offset 32) accesses part of an existing object of type p1 int (in std::__1::vector> at offset 0) that starts at offset -32
#0 0x62c0c81f3178 (/app/output.s+0x36178)
```
#### Explanation:
- If we remove the “static” keyword in Registry initialization, it will not reproduce.
- If we replace the vector array with three int pointers, it will not reproduce.
- If we remove the vector function, it will not reproduce.
- If we reorder struct variables it will not reproduce:
```.cpp
#include
struct Registry {
char temp_byte;
std::vector arr;
bool bool_var = false;
};
int main() {
static Registry r;
r.arr.push_back(0);
r.bool_var = true;
}
```
- Global `struct` also fires:
```.cpp
#include
struct Registry {
std::vector arr;
char temp_byte;
bool bool_var = false;
};
Registry r;
int main() {
r.arr.push_back(0); // reserve is also repro
r.bool_var = true;
}
```
Might be related to global/static STL containers FP in 20.1.0: https://godbolt.org/z/q3TsrK5c4
But fixed in 22.1.0: https://godbolt.org/z/1qE3z6eea
Contributor guide
Research direction
Start with the linked Godbolt reproducer using -stdlib=libc++ -fsanitize=type -O1, and compare the static/global cases with the non-static, reordered, and pointer variants. Trace the TypeSanitizer report around the libc++ vector layout and global/static struct offsets. Done means the reproducer no longer reports a false positive while genuine type-aliasing diagnostics remain intact.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100